eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
When online attackers infiltrate a company’s network, their first target is frequently the password file. By stealing the password file and using brute-force decryption techniques to find weak or common passwords, the attackers can build up a collection of legitimate credentials to make extending their compromise of the corporate network easier.
Yet such attempts could be detected by placing fake hashes—or “honeywords”—in the password file, two researchers stated in a paper released in early May. Because attackers would not know which hashes are the real ones, they run the risk of being detected when they attempt to use any passwords recovered from the polluted password file, wrote the researchers, well-known Massachusetts Institute of Technology IT cryptographer Ron Rivest—the ‘R’ in RSA—and Ari Juels, a computer scientist at RSA Labs.
“An adversary who steals a file of hashed passwords and inverts the hash function cannot tell if he has found the password or a honeyword,” the authors wrote in the paper posted online. “The attempted use of a honeyword for log-in sets off an alarm.”
Security researchers have warned about the danger of weak passwords following past breaches. In the past year, LinkedIn lost 6.5 million hashed user passwords, Yahoo warned that another 400,000 were stolen from its servers, and LivingSocial reset 70 million passwords that may have been accessed by hackers. While companies will regularly encrypt, or hash, passwords to prevent them from being easily obtained, brute-force guessing attacks can decipher poorly chosen passwords.
Some administrators set up fake accounts with easy passwords to detect whether an attacker has successfully cracked passwords from a stolen file. Yet the researchers warn that such a technique may be detected by the attackers if they can determine which accounts are legitimate and which are fake.
Instead, the researchers propose that for each password, 20 honeywords should be generated, resulting in a greater than 95 percent chance to detect any attack using brute-forced passwords from the password file. The detection would be carried out by secure alternate servers known as “honeycheckers,” since the attackers’ ability to steal password files means they likely have access to any programs on the compromised computers, the researchers stated.
“There is likely no place on the computer system where one can safely store additional secret information with which to defeat the adversary,” Rivest and Juels wrote. “The honeychecker is thus a separate hardened computer system where such secret information can be stored.”
While the proposal has merit, there are a number of issues, Per Thorsheim, a security consultant, wrote in response to an email query from eWEEK. Adding honeywords and sending the results of log-in attempts to a second server would require rewriting existing software. In addition, the choice of honeywords has to reflect the password selection process of individual users so as not to stand out to the attacker, he wrote. Yet picking fake passwords that are similar to the user’s selection could result in a greater number of false positives, he argued.
“The better the honeywords are adjusted to each user, the higher the chances of a user triggering the honeyword trap by typing in the wrong password, which by chance happens to be a honeyword,” Thorsheim wrote. “Essentially, you are at risk of being flooded by false alarms, and you will have to investigate if the alarms are caused by a user entering the wrong password—being a honeyword—or if the database has actually been breached.”