Brute Force Attack

A brute-force attack represents a complex attack in which the attacker will submit many passwords or passphrases with the goal of guessing the correct one. Each password or passphrase is checked one-by-one by the attacker until the correct one is found. Also, the attacker may guess the key. The key is generally created from the password by using a function for key derivation. This process is known as an exhaustive key search.

We will illustrate this type of attack with the following examples to show how the attack can be used and deployed in real-life situations (algorithms). The examples provided are

• Brute-force attack on a Caesar cipher: The example (see Figure 21-1 and Listing 21-1) is based on a Caesar cipher. The example is chosen as the first case of showing a brute-force attack due to its simplicity.

• String generation for a brute-force attack: The example (see Figure 21-2 and Listing 21-2) shows how basic string generation can be done with the goal of creating complex lists and dictionaries that can be used during brute-force attacks.

#include<iostream>

using namespace std;

// the function will be used to encrypt the plaintext

// string msg - the message

// int keytValue - the key

string encrypt(string msg,int keyValue)

{

     // variable used to hold the cipher value of the plaintext

    string cipher="";

     // parse the string

    for(int i=0;i<msg.length();i++)

    {

        // verify if the character is upper case

        if(isupper(msg[i]))

           // add to the cipher the character plus the key and subtract ASCII 65 value ('A').

           // the value obtained do modulo 26 (english alphabet letters) and add ASCII value 65 back.

           cipher += (msg[i] + keyValue - 65)%26 + 65;

          // verify if the character is lower case

          else if(islower(msg[i]))

               //** the same as above. ASCII value 97 ('a')

               cipher += (msg[i] + keyValue - 97)%26 + 97;

          else

               cipher += msg[i];

    }

    return cipher;

}

// The decryption will be done using the brute force attack by

// checking all possible keys

// string encMessage - the encrypted message

void decrypt(string encMessage)

{

     // the variable for storing the plaintext

    string plaintext;

     // we will try for each key and we will do the decryption

    for(int keyTry=0;keyTry<26;keyTry++)

    {

        plaintext = "";

          // parse accordingly based on the message length

        for(int i=0;i<encMessage.length();i++)

        {

               // check if the character is upper case

            if(isupper(encMessage[i]))

            {

                if((encMessage[i] - keyTry - 65)<0)

                    plaintext += 91 + (encMessage[i] - keyTry - 65);

                else

                    plaintext += (encMessage[i] - keyTry - 65)%26 + 65;

            }

               // check if the character is lower case

            else if(islower(encMessage[i]))

            {

                if((encMessage[i] - keyTry - 97) < 0)

                    plaintext += 123 + (encMessage[i] - keyTry - 97);

                else

                    plaintext += (encMessage[i] - keyTry - 97)%26 + 97;

            }

            else

                plaintext += encMessage[i];

        }

        cout << "BRUTE-FORCE ATTACK (DECRYPTION) - The clear text for key -> " << keyTry << " :- " << plaintext << endl;

    }

}

int main()

{

     int encKey;

     string cleartext;

     cout << "ENCRYPTION - Enter the text for encryption -> ";

     getline(cin,cleartext);

     cout << "Enter the key for encryption the text -> ";

     cin >> encKey;

     string encryptedMessage = encrypt(cleartext,encKey);

     cout << "ENCRYPTED MESSAGE - The encrypted message is -> " << encryptedMessage << endl << endl;

     //** brute force attack

     decrypt(encryptedMessage);

}

Listing 21-1

Brute Force Attack on a Caesar Cipher

Buffer Overflow Attack

A buffer represents a temporary area that is used for storing data. At the moment when more data is placed by the programs or system processes, an extra data overflow will occur.

In a buffer-overflow attack , the extra data being stored can store specific instructions to take actions designed by hackers or malicious users. As an example, the data could trigger an event (function or process) to destroy files or reveal private data about users.

The attacker uses a buffer overflow to get an advantage from a program that is being executed and is waiting for user interaction. There are two types of buffer overflows: stack-based and heap-based. In a heap-based overflow, it is very difficult to launch and execute attacks based on flooding the memory space reserved for the program and its execution. In a stack-based overflow, the exploitation of the applications and programs is done on the memory stack, which is the memory space used to store the input data from the user.

The following example (see Figure 21-3 and Listing 21-3) shows the danger of such situations for C++ applications. In the example provided, we won’t do any implementation for malicious code injection. We show the main process for buffer overflow. As a comparison between modern compilers vs. old compilers, modern compilers provide options for overflow checking during the compile or linking process but at the running time it is quite difficult to check the situation without having a protection mechanism such as the handling process of the exceptions.

Conclusion

References