Pattern based password cracking

Question

I need to select a project for this semester. I'm a second year uni student in Ethical Hacking and Countermeasures. My idea was to see if using some kind of pattern based password cracking can be more efficient than standard brute forcing or dictionary attacks.

By pattern-based cracking I mean something like:

CvvcDcv

where C is uppercase consonant, v lowercase vowel, D digit and so on. I would use lists of actual leaked passwords to generate a list of most likely patterns and code a little program to brute force it's way through the list based on the patterns. The above pattern would result in something like:

Baab1ba
Baab1be
Baab1bi
...

I've been trying to research if/how this was done before. However I'm unable to find any information. I think I'm using the wrong terminology for my searches.

What would this kind of cracking be called?

Is this likely a dead-end or is it possibly a (more) efficient way of attempting to brute force passwords?

(Alternatively, and I fear this might be off-topic, what are the 'newest' and promising methods of cracking passwords in 2014, if there are any? Anything worthy of doing research in?)

EDIT:

I've started generating the pattern list, if anybody is interested you can check the list here: http://mayar.abertay.ac.uk/~1204925/temp/list.txt So far it's generated using only a list of passwords leaked from Hotmail a couple of years ago. Will have a complete pattern list in a few days if anyone is interested, using 100'000s actual passwords

Answer 1

What you're talking about sounds similar to what John The Ripper and Hashcat offer with rules based password cracking.

This essentially defines a set of rules to generate passwords rather than relying on straight brute-force. There more information on the hashcat site or the John Site

There's probably some interesting work to do there in comparison of various rules options and different password dumps..

Answer 2

What would this kind of cracking be called?

I believe you're working your way towards Markov chains. Hashcat's statsprocessor is one implementation of per-position Markov chains. In short, order the first character's keyspace by likelihood. Given the first character, order the next character's keyspace by likelihood. And so on.

There's a good forum discussion including examples at the Hashcat forum.

Essentially, you feed the statsprocessor a dictionary (perhaps the full dictionary, maybe only the 8 character and longer words, perhaps only words meeting your complexity requirements), and it will compute the per-position Markov chains.

Note that the full size Markov chains it calculates cover 100% of the keyspace, so letting the attack run to completion has exactly the same results as a brute force attack; however, it should provide more "hits" in the beginning, and fewer at the end.

Additionally, Hashcat's character set options allow for "faking it", i.e., in pseudocode: [mrst][aeui]

• For the first character, the keyspace is m, r, s, and t
• For the second character, the keyspace is a, e, u, and i. Now brute force this combination.

Then you'd have another line to handle words starting with vowels: [aeiou][kthm] - For the first character, the keyspace is a, e, i, o, and u - For the second character, the keyspace is k, t, h, and m.

Is this likely a dead-end or is it possibly a (more) efficient way of attempting to brute force passwords?

• Atom completely replaced Hashcat's old brute force algorithm with Markov chains that cover the entire keyspace.
• Hashcat is one of the leading password cracking tools available.

Therefore, I would have to say that Atom, at least, believes it's a more efficient way to brute force passwords. I personally agree, as during password auditing I have seen many more results in the early phases of Markov attacks than at the end.