Posted on 09/17/2017 2:56:01 AM PDT by Bullish
Last week, the credit reporting agency Equifax announced that malicious hackers had leaked the personal information of 143 million people in their system. That’s reason for concern, of course, but if a hacker wants to access your online data by simply guessing your password, you’re probably toast in less than an hour. Now, there’s more bad news: Scientists have harnessed the power of artificial intelligence (AI) to create a program that, combined with existing tools, figured more than a quarter of the passwords from a set of more than 43 million LinkedIn profiles. Yet the researchers say the technology may also be used to beat baddies at their own game.
The work could help average users and companies measure the strength of passwords, says Thomas Ristenpart, a computer scientist who studies computer security at Cornell Tech in New York City but was not involved with the study. “The new technique could also potentially be used to generate decoy passwords to help detect breaches.”
The strongest password guessing programs, John the Ripper and hashCat, use several techniques. One is simple brute force, in which they randomly try lots of combinations of characters until they get the right one. But other approaches involve extrapolating from previously leaked passwords and probability methods to guess each character in a password based on what came before. On some sites, these programs have guessed more than 90% of passwords. But they’ve required many years of manual coding to build up their plans of attack.
The new study aimed to speed this up by applying deep learning, a brain-inspired approach at the cutting edge of AI. Researchers at Stevens Institute of Technology in Hoboken, New Jersey, started with a so-called generative adversarial network, or GAN, which comprises two artificial neural networks. A “generator” attempts to produce artificial outputs (like images) that resemble real examples (actual photos), while a “discriminator” tries to detect real from fake. They help refine each other until the generator becomes a skilled counterfeiter.
Giuseppe Ateniese, a computer scientist at Stevens and paper co-author, compares the generator and discriminator to a police sketch artist and eye witness, respectively; the sketch artist is trying to produce something that can pass as an accurate portrait of the criminal. GANs have been used to make realistic images, but have not been applied much to text.
The Stevens team created a GAN it called PassGAN and compared it with two versions of hashCat and one version of John the Ripper. The scientists fed each tool tens of millions of leaked passwords from a gaming site called RockYou, and asked them to generate hundreds of millions of new passwords on their own. Then they counted how many of these new passwords matched a set of leaked passwords from LinkedIn, as a measure of how successful they’d be at cracking them.
On its own, PassGAN generated 12% of the passwords in the LinkedIn set, whereas its three competitors generated between 6% and 23%. But the best performance came from combining PassGAN and hashCat. Together, they were able to crack 27% of passwords in the LinkedIn set, the researchers reported this month in a draft paper posted on arXiv. Even failed passwords from PassGAN seemed pretty realistic: saddracula, santazone, coolarse18.
Using GANs to help guess passwords is “novel,” says Martin Arjovsky, a computer scientist who studies the technology at New York University in New York City. The paper “confirms that there are clear, important problems where applying simple machine learning solutions can bring a crucial advantage,” he says.
Still, Ristenpart says “It’s unclear to me if one needs the heavy machinery of GANs to achieve such gains.” Perhaps even simpler machine learning techniques could have assisted hashCat just as much, he says. (Arjovsky concurs.) Indeed, an efficient neural net produced by Carnegie Mellon University in Pittsburgh, Pennsylavania, recently showed promise, and Ateniese plans to compare it directly with PassGAN before submitting his paper for peer review.
Ateniese says that though in this pilot demonstration PassGAN gave hashCat an assist, he’s “certain” that future iterations could surpass hashCat. That’s in part because hashCat uses fixed rules and was unable to produce more than 650 million passwords on its own. PassGan, which invents its own rules, can create passwords indefinitely. “It’s generating millions of passwords as we speak,” he says. Ateniese also says PassGAN will improve with more layers in the neural networks and training on many more leaked passwords.
He compares PassGAN to AlphaGo, the Google DeepMind program that recently beat a human champion at the board game Go using deep learning algorithms. “AlphaGo was devising new strategies that experts had never seen before,” Ateniese says. “So I personally believe that if you give enough data to PassGAN, it will be able to come up with rules that humans cannot think about.”
And if you’re worried about your own security, experts suggest ways to create strong passwords—such as by making them long (but still easy to remember)—and using two-step authentication.
Most of the time, hackers use something like this AI tool to guess a list of passwords on some insecure site with a lot of users like instagram, linkedin, wordpress etc... then they will take that list along with your profile to try them on bank sites etc trying two logins and then waiting 20 minutes, change ips etc... that script runs for days until they get into a couple of the interesting sites.
Only the people that use the same password on the insecure sites and the secure sites will be vulnerable.
George: I am not giving you my code.
Kramer: I’ll bet I can guess it.
George: Pssh. Yeah. Right.
Kramer: Oh, alright. Yeah. Uh, let’s see. Um, well, we can throw out birthdays immediately. That’s too obvious. And no numbers for you, you’re a word man. Alright, let’s go deeper. Uh, what kind of man are you? Well, you’re weak, spineless, a man of temptations, but what tempts you?
George: Huh?
Kramer: You’re a portly fellow, a bit long in the waistband. So what’s your pleasure? Is it the salty snacks you crave? No no no no no, yours is a sweet tooth.
George: Get out of here.
Kramer: Oh you may stray, but you’ll always return to your dark master, the cocoa bean.
George: I’m leaving.
Kramer: No, and only the purest syrup nectar can satisfy you!
George: I gotta go.
Kramer: If you could you’d guzzle it by the gallon! Ovaltine! Hershey’s!
George: Shut up!
Kramer: Nestle’s Quik!
George: Shut up!
I’ve yanked Google as a default on anything due to that sort of thing and their corporate actions in other areas. I’ll use them from time to time, but it’s minimal.
That’s why Kramer was clever enough to get the statue back.
But then, there was the whole Michigan bottle deposit thing.
That’s a perfect demonstration of why IT needs to develop a better system than user name and password and works for human beings.
Unfortunately most IT/Security types don’t understand simple statistics. They make you use passwords that include two of these, two of those, and two more of those. Each time they include those types of restrictions, they lower the total number of possible passwords. They haven’t made passwords more secure, they have made them less.
Always wondered if nonprinting ascii would work. Never tried it
That would certainly slow a AI powered hack of your password down but time means nothing to a computer, so it would just try and try and try... a lockout would negate that patience. Consequently, what benefit to all the AI’s computing power if it was stopped after three failed attempts? What advantage if it stopped at two failed attempts and then waited 15 minutes or whatever until the password security system reset the session then tried two more? Eight attempts an hour is not going to clear the astronomical number of letter, number, symbol combinations to be tried.
Thanks. That is a strategy that uses AI to winnow down to huge number of combinations to be tried to a list that, while still quite large, is still at least manageable. Based on the desire not to trigger the account lockout feature, the hacker’s computer would have an unlimited number of two try attempts. Would an effective defense be to monitor the number of failed log on attempts per account per day without lockout and flag unusually high numbers of persistent probing for further investigation?
Someone will invent a helmet you can put on when you have to write a term paper but don't want to be bothered with typing. Then evil actors will use it for interrogations...
Fascinating; although it cut off too soon. So I listened to about half of another interview Barret did with an Australian AI geek, both of them struggling to grasp that preventing negative applications is impossible. They are still holding out hope. Alas, in vain.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.