Posted on 09/17/2017 2:56:01 AM PDT by Bullish
Last week, the credit reporting agency Equifax announced that malicious hackers had leaked the personal information of 143 million people in their system. That’s reason for concern, of course, but if a hacker wants to access your online data by simply guessing your password, you’re probably toast in less than an hour. Now, there’s more bad news: Scientists have harnessed the power of artificial intelligence (AI) to create a program that, combined with existing tools, figured more than a quarter of the passwords from a set of more than 43 million LinkedIn profiles. Yet the researchers say the technology may also be used to beat baddies at their own game.
The work could help average users and companies measure the strength of passwords, says Thomas Ristenpart, a computer scientist who studies computer security at Cornell Tech in New York City but was not involved with the study. “The new technique could also potentially be used to generate decoy passwords to help detect breaches.”
The strongest password guessing programs, John the Ripper and hashCat, use several techniques. One is simple brute force, in which they randomly try lots of combinations of characters until they get the right one. But other approaches involve extrapolating from previously leaked passwords and probability methods to guess each character in a password based on what came before. On some sites, these programs have guessed more than 90% of passwords. But they’ve required many years of manual coding to build up their plans of attack.
The new study aimed to speed this up by applying deep learning, a brain-inspired approach at the cutting edge of AI. Researchers at Stevens Institute of Technology in Hoboken, New Jersey, started with a so-called generative adversarial network, or GAN, which comprises two artificial neural networks. A “generator” attempts to produce artificial outputs (like images) that resemble real examples (actual photos), while a “discriminator” tries to detect real from fake. They help refine each other until the generator becomes a skilled counterfeiter.
Giuseppe Ateniese, a computer scientist at Stevens and paper co-author, compares the generator and discriminator to a police sketch artist and eye witness, respectively; the sketch artist is trying to produce something that can pass as an accurate portrait of the criminal. GANs have been used to make realistic images, but have not been applied much to text.
The Stevens team created a GAN it called PassGAN and compared it with two versions of hashCat and one version of John the Ripper. The scientists fed each tool tens of millions of leaked passwords from a gaming site called RockYou, and asked them to generate hundreds of millions of new passwords on their own. Then they counted how many of these new passwords matched a set of leaked passwords from LinkedIn, as a measure of how successful they’d be at cracking them.
On its own, PassGAN generated 12% of the passwords in the LinkedIn set, whereas its three competitors generated between 6% and 23%. But the best performance came from combining PassGAN and hashCat. Together, they were able to crack 27% of passwords in the LinkedIn set, the researchers reported this month in a draft paper posted on arXiv. Even failed passwords from PassGAN seemed pretty realistic: saddracula, santazone, coolarse18.
Using GANs to help guess passwords is “novel,” says Martin Arjovsky, a computer scientist who studies the technology at New York University in New York City. The paper “confirms that there are clear, important problems where applying simple machine learning solutions can bring a crucial advantage,” he says.
Still, Ristenpart says “It’s unclear to me if one needs the heavy machinery of GANs to achieve such gains.” Perhaps even simpler machine learning techniques could have assisted hashCat just as much, he says. (Arjovsky concurs.) Indeed, an efficient neural net produced by Carnegie Mellon University in Pittsburgh, Pennsylavania, recently showed promise, and Ateniese plans to compare it directly with PassGAN before submitting his paper for peer review.
Ateniese says that though in this pilot demonstration PassGAN gave hashCat an assist, he’s “certain” that future iterations could surpass hashCat. That’s in part because hashCat uses fixed rules and was unable to produce more than 650 million passwords on its own. PassGan, which invents its own rules, can create passwords indefinitely. “It’s generating millions of passwords as we speak,” he says. Ateniese also says PassGAN will improve with more layers in the neural networks and training on many more leaked passwords.
He compares PassGAN to AlphaGo, the Google DeepMind program that recently beat a human champion at the board game Go using deep learning algorithms. “AlphaGo was devising new strategies that experts had never seen before,” Ateniese says. “So I personally believe that if you give enough data to PassGAN, it will be able to come up with rules that humans cannot think about.”
And if you’re worried about your own security, experts suggest ways to create strong passwords—such as by making them long (but still easy to remember)—and using two-step authentication.
Good for people with too many passwords.
AI does nothing for guessing real passwords. Real passwords do not contain words even in discombobulated forms. Real passwords are random numbers, letters and punctuation of sufficient length to prevent brute force attacks. If users want to use passwords like ‘coolarse18’ then they deserve to have their accounts broken into LOL
Just think where technology will be in 15 or 20 years.
The entire notion of password has proliferated to the point that it’s gotten out of hand. I’m not particularly prolific with my online presence as far as forums, accounts with businesses, etcetera and I have more than thirty. I’ve given up trying to keep up with them all, with their constant requests to update passwords for security. I let my system generate them and save them. They autopopulate on my Apple devices. I have no clue what the individual passwords are myself. If I’m not on one of my devices I have to go through security questions or text validation or email validation and reset it to gain access, then reset it again once back on my devices so it’ll autopopulate once again. There is no way in hell anyone can keep up with all this, which is why so many otherwise intelligent people repeat the same, too-simple to the point of obvious password on all their accounts.
It already is.
My company locks my access to my computer after three failed log in attempts. In addition, I have a separate log on to my computer, have a separate log on to the system and yet another separate log on to our VPN network if working remotely. All have three failed try lock outs. You have to call a company system administrator by telephone and request unlocking to regain access to the system. All three change passwords every couple months at different frequencies.
I mention this because unsaid in this article is the fact that the AI password guessing software seems to have unlimited attempts to access a computer/system with no lock out to impede them while it goes through its algorithm-driven computational gymnastics while guessing at a password.
I don’t.
Does anyone know how these AI password systems fare in a limited attempt lockout controlled access system?
Every financial institution with which I do business does the same, three failed login attempts and you’re locked out, please call (number) to confirm identity and regain access. They have quite a litany of questions, too, several of which would not be possible to guess. The only way a potential hacker would know, would be if you’d saved it on your system and they’d not just gained access to it, but knew what it was and where it was used. My credit union asks how I first heard of them, when I signed up and why, in addition to address, next of kin listed on the account, and they ask for the account number, they’ll never assume.
re: “Food for thought... How long before this all gets out of hand? “
How much ‘stuff’ do you leave on your phone?
How much ‘stuff’ do you leave on your computer/laptop/tablet?
Every time I have to enter a password, I select ‘do not remember’. I might not have as many needs for passwords, as some of you younger (<65) folks, but do you have your machine of choice ‘remember’ your password?
Actually, thanks to the younger, and those who demanded an easier tech life, it is already out of hand, and your privacy is screwed.
Another reason to use password generators for site passwords so passwords chosen are as random as possible.
I have a device with a password that has exponential pauses between attempts. The first pause is one second. The second is two, third would be four seconds. And so on. So if you are guessing, it’s going to be a long time before you can overwhelm it.
In my instance it’s not “remembering” the password, it’s pulling it from an encrypted keychain. Could somebody potentially gain control over one of my devices and get into an account of mine? I imagine so but it won’t be especially easy and I’m not a high-value target, I’d pretty much have to get fooled by a phishing ploy or otherwise give administrative approval, nothing like that happens on an Apple without doing so. Remember that next time you hear crowing about hacking an Apple, it’s always due to a naive or stupid user granting access. An even worse risk is a bad actor internal to one of my financial institutions gaining access, because the required information exists on that end. But, I can’t control what I can’t control. What I don control is as well in hand as it can be within reason, given that I cannot possibly remember 30 different unique passwords, some of which are required to be reset every (x) months for security purposes. So I rely on the keychain.
“And if you’re worried about your own security, experts suggest ways to create strong passwords—such as by making them long (but still easy to remember)—and using two-step authentication.”
So, how does one construct “long but easy to remember passwords”? Not hard to construct one. Two is still fairly easy. I must have 50 passwords. Each is supposed to be unique. Each user name is supposed to be unique as well. Not only would I have to remember each password and username, I also would have to remember which one goes with which system.
I wonder how many “experts” follow their own advice?
Hmm, it sounds like your company is pretty lax when it actually comes to resetting your password.
If I lock myself out of the system, I physically have to go to the IT department and have my fingerprint scanned before they will unlock it. And we have 2-step authentication at work: our CAC card and a PIN. It is conceivable that one could guess the PIN, but the card encryption is more difficult to crack--especially since I keep my card in an RFID proof sleeve when I am not using it. Yes, I do work for the government.
The big downside is not having a key with you when you need it. I keep one on my company badge retractor, one on my personal keychain, and one in a living room endtable. The keys are unlabeled, so if you lose one the finder/thief won't know who it belongs to (assuming you keep all identification odd your keychain). Without the physical key, I'm not getting into my systems (unless I remember the person). My PW manager generates very long and impossible to remember passwords for sites, too.
Sorry if I gave the wrong impression. The phone call to local IT service desk is just to unlock the account so I can try again. Screening questions to establish identity are asked Cannot reasonably go to local IT department physically as it is a 50 mile one way trip from my office to their location.
Changing the password can be done online once I am admitted to the system by entering the correct password at two separate control portals. We use CAC and PINs for routine Govt unclassified system access. Access to the VPN is two part: password and a changing random number generated from an application tied to a pre-registered verified identity.
Your link does NOT work...YubiKey
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.