OMEN: Faster Password Guessing Using an Ordered Markov Enumerator

Abstract

Passwords are widely used for user authentication, and will likely remain in use in the foreseeable future, despite several weaknesses. One important weakness is that human-generated passwords are far from being random, which makes them susceptible to guessing attacks. Understanding the adversaries capabilities for guessing attacks is a fundamental necessity for estimating their impact and advising countermeasures. This paper presents OMEN, a new Markov model-based password cracker that extends ideas proposed by Narayanan and Shmatikov (CCS 2005). The main novelty of our tool is that it generates password candidates according to their occurrence probabilities, i.e., it outputs most likely passwords first. As shown by our extensive experiments, OMEN significantly improves guessing speed over existing proposals. In particular, we compare the performance of OMEN with the Markov mode of John the Ripper, which implements the password indexing function by Narayanan and Shmatikov. OMEN guesses more than 40% of passwords correctly with the first 90 million guesses, while JtR-Markov (for T = 1 billion) needs at least eight times as many guesses to reach the same goal, and OMEN guesses more than 80% of passwords correctly at 10 billion guesses, more than all probabilistic password crackers we compared against.

Geographical Security Questions for Fallback Authentication

“…Modern password crackers have been proven to be effective in efficiently guessing a large number of passwords. Notable example of password crackers use various artificial intelligence techniques such as Probabilistic Context-Free Grammar (PCFG) [18,19], Ordered Markov Enumerators (OME) [20], and Artificial Neural Networks (ANNs) [21]. These recent development in password cracking has motivated the investigation of alternative primary authentication systems.…”

Who Are You? A Statistical Approach to Measuring User Authenticity

“…Weak passwords is also a widely known problem. The strength of user-chosen passwords against password guessing attacks has been studied since the early times of password-based authentication [8], [56], [40] Current techniques for password guessing are Markov models [44], [21], [37] and probabilistic context-free grammars [55]; stateof-the-art tools include John the Ripper [51] and HashCat [52]. Historically, the strength of passwords against guessing attacks has been assessed by using password crackers to find weak passwords [42].…”

PassGAN: A Deep Learning Approach for Password Guessing

“…With PCFGs, Weir et al [92] demonstrated how to "learn" these rules from password distributions. Ma et al [49] and Durmuth et al [20] have subsequently extended this early work.…”