Ethical hacking and password cracking: a pattern for individualized security exercises

ABSTRACT

A design pattern provides a type of template or meta-template for solving design problems. This paper provides and discusses a pattern for creating individualized learning exercises. The domain of application is security education. The specific examples presented, that have been realized in practice in an educational setting, are password cracking/recovery and SHA-1 file hash. Additional learning exercises based on this pattern will be added in the future. Some implementation details and a discussion of the role of the SecureS software system, created by the author, are included.

REFERENCES

• 1: Joel Scambray , Stuart McClure , George Kurtz, Hacking Exposed, McGraw-Hill Professional, 2000
• 2: Bruce Schneier, Secrets & Lies: Digital Security in a Networked World, John Wiley & Sons, Inc., New York, NY, 2000
• 3: Michael T. Simpson, Hands-On Ethical Hacking and Network Defense, Course Technology Press, 2005
• 4: Smith, R. Authentication: From Passwords to Public Keys. Boston, MA: Addison-Wesley Professional, 2001.
• 5: Snyder, R., IIS security considerations of the FileSystemObject for cooperating and uncooperating users, In Proceedings of the 31st Annual Conference of the International Business Schools Computing Association (Daytona Beach, FL, July 13--16, 2003).
• 6: Snyder, R., Proactive approaches to information systems and computer security, In Proceedings of the 27th Annual Conference of the Association of Small Computer Users in Education. (Myrtle Beach, SC, June 12--16, 1994).
• 7: Snyder, R., Using ethical hacking to educate users about secure passwords by cracking insecure passwords using readily available software. In 39th Annual Conference of the Association of Small Computer Users in Education (Myrtlie Beach, SC, June 11--15, 2006).

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Cryptographic controls

  E. Data
  E.3 DATA ENCRYPTION

General Terms:
Security

Keywords:
password cracking, patterns for security exercises