Question

A security consultant was hired to audit a company's password are account policy. The company implements the following controls:

✑ Minimum password length: 16
✑ Maximum password age: 0
✑ Minimum password age: 0
✑ Password complexity: disabled
✑ Store passwords in plain text: disabled
✑ Failed attempts lockout: 3
✑ Lockout timeout: 1 hour
The password database uses salted hashes and PBKDF2.

Which of the following is MOST likely to yield the greatest number of plain text passwords in the shortest amount of time?

A. Offline hybrid dictionary attack
B. Offline brute-force attack
C. Online hybrid dictionary password spraying attack
D. Rainbow table attack
E. Online brute-force attack
F. Pass-the-hash attack

Answer 1

An offline hybrid dictionary attack (option A) is the most effective method for cracking passwords in this scenario due to the ability to guess passwords rapidly without lockout restrictions, despite the password length and lack of complexity requirements.

Step-by-step explanation:

The question revolves around identifying which method is most likely to yield the greatest number of plain text passwords in the shortest amount of time given the security controls and password storage methods of a company. Considering the provided security measures, the use of salted hashes and PBKDF2 indicates that pre-computed rainbow table attacks would be ineffective due to the salting. Additionally, failed attempt lockouts effectively prevent rapid online attacks such as password spraying or online brute force.

An offline hybrid dictionary attack combines a dictionary attack with common substitutions and is likely tailored to the target environment. Since password complexity is disabled and passwords are not stored in plain text, attackers can't exploit simple weak passwords directly from the database, but the lack of complexity requirements makes the dictionary approach viable. Finally, brute-force attacks, whether offline or online, will tend to be slow due to the long minimum password length and computational cost of PBKDF2 hash computations.

An offline hybrid dictionary attack would likely be the most effective technique since the offline factor allows the attacker to guess passwords at a rate only limited by their computational resources, without being hindered by account lockouts. This attack exploits the fact that users often create passwords that are easy to remember, which might include common words and patterns, albeit with a length of 16 characters.