as you just heard I'm Robin victory and
our Czech penetration tester work for
company called commerson and based in
Edinburgh and we do normal penetration
testing stuff so YouTube check worth IT
health checks code and build reviews
internal and external penetration tests
and mobile web application testing and
it's on the internal penetration test
that we almost always come up with some
kind of password cracking as usually
because we've got access to some
low-hanging fruit on the network we've
managed to Drabek is a TDS dead based on
the domain controller and we're either
turn to audited passwords for the client
or we're trying to track passwords the
main passwords to use on long domain
connected devices so whichever we're
doing we usually do the same fingers few
much everyone else does we got a
standard dictionary of what key lock
types is a favorite one but in hash cap
if varying rules depending on how much
time we've got so yeah my favorite is
one Baltimore more others use divert all
those up over 54 and speedfest and that
gets us a rather large amount of
passwords you see people aren't very
good with passwords but in order to
improve things if and more what we need
to do is start customizing the generic
word lists to our customers and I start
off with some of my own wordless which I
carry straight from Wikipedia or other
likes I got countries cities schools
cottage place names with Spanish
surnames
I have registered Scotland towards my
sister's all the baby names for each
year and I stick all those at my
password list cause I'm out by
dictionary and that gets us a lot more
but because this is Scotland I put in
all the Scottish football clubs Allah
well the football grounds every player I
could get off Wikipedia from to pick
four teams and again I guess it's
another different passport but after
that you have to start tearing things
for a specific client looking at the
normal thing you do is you spew stop
calling the database using cool it gives
you a list of words you see related to
that particular customer you might want
to call all of our websites which are in
the same industry so competitors like
regulator websites or industry or other
industry websites to find other terms if
you used youth in that company and then
you start using what I call common sense
you think about what their company does
and you try to think of what terms they
might be using his password so their
transport company and they've got a very
drivers brands of lorries breath stops
main roads their ferry company you're
looking for courtship names multiple
terms if you look at where the company
is located is there you're looking for
any local landmarks the history of the
area and you can go on but more time you
spending on this look the last time you
actually spending on doing the actual
penetration test which you came to do so
what would be good is if it could
automate a lot of this of the work
and that's whereas not looking at much
with language processing because natural
language processing uses what one of the
first me to do in natural language
processing is you tokenize all the words
and open a text corpus and you turn them
into a form which you communicate are
not done through something called word
embedding which translates every word
that it finds in text corpus into a big
vector describing its relationship to
all the other works that are in course
DS so weight usually works if you have a
sliding window to use across the text
corpus so say have 8 words within that
window and you count all words which Co
occur within that window and then you
built up a matrix of those occurrences
and then you end up with a massive
massive model that describes all the
words you then compress that down
getting rid of all of the relationships
the words which aren't related to many
other words and you end up with is
smaller but still quite hefty model but
what happens then what you find is that
words which occur in the similar context
in your test in your training focus also
have vectors which are clustered
together in vectors in the vector space
so here because the kitchen license will
trusted nicely over now so what we can
do if is you try to locate kitchen words
is find all the words of effectiveness
of cost
causing me to take bathroom and it'll
give you Elizabeth you also find that
words have relationships get
communication but that can be
represented as possible vectors so if
you you're fine disturbed the effector
for our capital city and defector for
the country which refers to always have
a similar distance to so here we have
the vectors between various countries
and the capital cities and you see it
all pretty similar and that also applies
to other friends so there codes with the
relationship between cream cream cream
and women are also pretty single
intensive vector representations so in
terms of generating your orders you
don't really want to talk yourself but
luckily there's some big retains courses
that you can get and they have trained
these courses those obtain these models
on publicly available text courses
sure as long as that so pick one normal
year so the Wikipedia top we find most
listened to their 210 models use that
and some former and this tears newswire
the detectives a couple of constant use
use wire tater as well and this is where
you can get those future courses
what's up details in order to use them
we use a library called Jensen which was
a - library that's how you pretty simple
panted how did that she learned the
models in the problem and this is how
you actually an important load model and
then finds that the word Summers read
work so guess what trace
expansion motion so that should return
to us to find most similar words to
editor and this is what it actually
comes out with
so on the left day you find words on the
right you have ranges between 0 & 1
that represents the similarity to the
original way and here it's managed to
find it all of the cities were decided
by debt versus City and it's given us
lots of Scottish cities through the
summer
the downside is that 3 minutes and 21
seconds to him also in terms of using
that to find of our candidates for
password cracking that's not very
accessible luckily and most of that is
upfront cost and when you're looking at
models and the initial search so here
she's looking for additional words on
top of that it takes roughly 3 seconds
of code word so really we don't really
be doing this through every word and
don't be this button is for every word
but you saw it once and you can once at
it it's a deep so we can also improve
the speed by indexing did there's a the
indexes tend to reduce the accuracy
which we have a somewhat more word about
increases startup cost
diversity in terms of the team and then
is just a lot of costs modification so
this is the same thing one as with
indexing this uses the annoy indexer and
qual from adding the index row to finish
the same code but you won't find the
results are different from that
so here it's found Edinboro zone perfect
which is most twice but Sofia where
results are slightly different and not
it's not going back with selfish cities
of basking but they're all related in
some way over to my his matches for
other words
so whatever language you sell whiskey
says compared with other whiskeys
fish and topic um it's all combat both
Faris that it was so the next from this
is that a wrapper around half cap and
and we do an initial run of hash cap
with the standard dictionary and then it
finds a bunch of words with passwords
you're gonna kill them up using basic
regular expression to remove all the
bits and pieces people and you had to
teach enter that are supposed to make
them London and who puts the words in
slaw
Jensen script it will follow similar
words and then we put those back in
dictionary as we move on have cut with
that you repeat until we had we had
borders not producing any new passwords
and we seed return words if we want to
or we do that and that is what I
accomplished so far
also I'm working on round so any
questions yes policies houses
[Music]
writers fluticasone tactics
yes so in terms of but it definitely
catch but what i'd motion sensor system
has digital parts of the words you can
use the same techniques with pangrams
so you can use words release both so you
can use if you think technique wave
engrams so Robert complete words to you
you're using sections of works and that
has more flexibility as mode it doesn't
require them to have your test was the
simple words already in model it can
find words which so I know that this
miss muffet put if you took up apple
pear orange you in order to it for this
who would have any kind of success you
can just split that up into half a pair
of orange again there as there's
techniques for doing that which I'm
actually playing on one putting in this
but that would be an additional step if
you have to spit spit there to pass it
up in this kind of person up the top
pair orange then you've got a pair
so each individual word in the database
and then the rules that have to put them
back in together again tonight creation
of passwords
that's of answer you question sloth fr
yeah then not one is over this won't
miss won't really help with the
situation you're describing but an
additional step just flipped it to take
it yeah combined password spit it off
before it goes of day it will cope with
that I'm just using Jenson users Milton
I'm not but this been so long since I've
done in your house line was so I'm just
using what is with the lifestyle that
might inspire you use so yeah I did a
long time ago but I might tend to use
natural ash battles on these days and
that's partly from familiarity more than
anything else yes bass mom there's money
there orange tada mm-hm
you've got to know originally that easy
don't mess with those three elements but
yeah it based on that principle was in
using upper and lower case as soon as
you start with djt in unusual soon as
she said in that into that complexity
when yes and again it though she would
process taking consideration that time
so you need to know you need to find a
password in there that has it say apple
pear orange you don't need to split that
up enter
look for similar was so I come over file
and honor of a fruity a tablet for your
rules fact you have cat will then we
combine words surrounding words together
to make of our combinations so we might
come up with banana orange pear that
gets very complex very fast so you have
to eat you know means you have to limit
the amount that key value to hold Weis
you cannot be there forever but and
usually we on a limited time for this so
yes I lost crackin question boutique
yeah just thinking or perish
complexities firstly have you come to
know how many wizards or not raise it is
in it but I've just a little Friday
which is turning but most things about
you give me Scylla call bought that
Plymouth in 21 days brother
patience to the Sun she stopped brief to
use those three words will surely throw
eulogy yeah so yeah you could probably
spit and spit but they you're unlikely
to find in seller come off turf or ready
to pass was virtually the first place an
isthmus will only find pass wasn't a
related in some form to ones which are
already you discovered if you did find
food that's listening scientist it's not
a call but let's say you got onto a
machine and you you you learning Nene
can ski water and you found
silat coral tariff as a cash password on
a machine and you use that as was one of
the initialization a supposed to be in
Europe
but you because you can you sped it up
into a setup :
Kenneth ante 12 fine it will almost
certainly find words related to each of
those words they probably won't come up
with any any matches in any other
passwords because it will find chair
basis another similar to cellar you'll
find Paul Smith as a single words at the
tariff and it will finds anything aside
and public asunder comes up with all the
new but for we think that there's
something similar it's cold you thought
those words together
ngo it's very unlikely to match anyone
else's pass within your organization but
it will find a lot of our face so hip it
it's not there to help you to get every
possible bit what this there to take a
lot of the domain knowledge did you you
need to when you get when you go into
their fur and into the clients and you
yeah you're home to spend time trying to
think of what he chooses task force what
what are they in their terms that
important to their industry and you've
got the limited time and you're trying
to work on other things at the same time
as this and this is just to take out the
requirement for you to actually wasting
time doing that while the nation's other
cities but it will be very very strange
to see how six reduce the incidence of
reductive words so that's time to the
rules you use
for Africa so this just provides the
Prime Minister of was for your
dictionary the rules which he write half
that world government how you combine
nicely up to you I just used the use
again she's a title or one rule but it
is not very part of the natural language
versus very yeah I can't really give any
way to actually tell them that without
outside the rule those rules
[Music]