2 cissp ® Official Study Guide Eighth Edition

1.
The user enters credentials such as a username and password.
2.
The user’s system hashes the password and sends the hash to the authenticating system.
3.
The authenticating system compares this hash to the hash stored in the password data-
base file. If it matches, it indicates the user entered the correct password.
This provides two important protections. Passwords do not traverse the network in clear 
text, which would make them susceptible to sniffing attacks. Password databases do not 
store passwords in clear text, which would make it easier for attackers to discover the pass-
words if they gain access to the password database.
However, password attacker tools look for a password that creates the same hash value 
as an entry stored in the account database file. If they’re successful, they can use the pass-
word to log on to the account. As an example, imagine the password IPassed has a stored 
hash value of 1A5C7G hexadecimal (though the actual hash would be much longer). A 
brute-force password tool would take these steps:
1.
Guess a password.
2.
Calculate the hash of the password.
3.
Compare the calculated hash against the stored hash in the offline database.
4.
Repeat steps 1 through 3 until a guessed password has the same hash as a stored
password.
This is also known as comparative analysis. When the password-cracking tool finds a 
matching hash value, it indicates that the guessed password is very likely the original pass-
word. The attacker can now use this password to impersonate the user.
If two separate passwords create the same hash, it results in a collision. Collisions aren’t 
desirable and ideally, collisions aren’t possible, but some hashing functions (such as MD5) 
are not collision free. This allows an attacker to create a different password that results in 
the same hash as a hashed password stored in the account database file. This is one of the 
reasons that MD5 is not recommended for hashing passwords today.

---

Understanding Access Control Attacks 
645
With the speed of modern computers and the ability to employ distributed computing, 
brute-force attacks prove successful against even some strong passwords. The actual time it 
takes to discover passwords depends on the algorithm used to hash them and the power of 
the computer. 
Many attackers are using graphic processing units (GPUs) in brute-force attacks. In 
general, GPUs have more processing power than most CPUs in desktop computers. A quick 
search on the internet reveals online directions on how to create a multiple GPU computer 
for less than $10,000 and in just a few hours after you buy the parts. 
Mandylion Research Labs created an Excel spreadsheet showing how quickly passwords 
can be cracked. The number of guessed passwords a system can try is a moving target as 
CPUs and GPUs get better and better. We set the worksheet to assume the system can try 
350 billion passwords a second, and the following bullets show some calculated times it 
will take to crack different password combinations: 
■
8 characters (6 lowercase letters, 1 uppercase, 1 number)
: Less than a second 
■
10 characters (8 lowercase letters, 1 uppercase, 1 number)
: 1.29 hours 
■
12 characters (10 lowercase letters, 1 uppercase, 1 number)
: About 36 days 
■
15 characters (13 lowercase letters, 1 uppercase, 1 number)
: About 1,753 years
As processors get better and cheaper, it will be easier for attackers to cluster more pro-
cessors into a single system. This allows the systems to try more passwords per second, 
reducing the amount of time to takes to crack longer passwords. 
With enough time, attackers can discover any hashed password using an 
offline brute-force attack. However, longer passwords result in sufficiently 
longer times, making it infeasible for attackers to crack them.