ch 11 Flashcards
what are the type of authenticating credentials
Where you are What you have What you are What you know What you do
what is the biggest weakness to passwords
human memory
Attacks that can be used to discover passwords:
• Attacks on Passwords
Phishing, shoulder surfing, dumpster diving
-Social engineering
Keylogger, protocol analyzer
Man-in-the-middle and replay attacks
Capturing
Attacker gains physical access to computer and resets password
-Resetting
Method used by most password attacks today
Attackers steal file of password digests
Compare with their own digests they have created
-Offline attack
Every possible combination of letters, numbers, and characters used to create encrypted passwords and matched against stolen file
Slowest, most thorough method
Brute force
(N T L M)
New Technology LAN Manager
what kind of attack is when An attacker who can steal the digest of an N T L M password would not need to try to break it
He would simply pretend to be the user and send that hash to the remote system to then be authenticated
Known as a pass the hash attack
A more targeted brute force attack that uses placeholders for characters in certain positions of the password
Mask Attack
Conducts a statistical analysis on the stolen passwords that is used to create a mask to break the largest number of passwords
Rule Attack
Attacker creates digests of common dictionary words
Compares against stolen digest file
Dictionary Attack
Two key stretching algorithms
bcrypt and P B K D F 2
When a user is using more than one type of authentication credential
Multifactor authentication
Using just oneMost common items used for authentication
Single-factor authentication
(O T P)
Used to create a one-time password
Authentication code that can be used only once or for a limited period of time
one-time password (O T P)
where is the hardware token generally
Typically a small device with a window display
where is the software token generally stored
Stored on a general-purpose device like a laptop computer or smartphone
(T O T P)
Time-based one-time password
(H O T P)
HMAC-based one-time password
Two types of O T P s
Time-based one-time password (T O T P)
HMAC-based one-time password (H O T P)
(P I V)
Personal Identity Verification
