What is Brute Force Attack, Hash values and Rainbow tables?

 What Is A Brute Force Attack?

One common and rather simplistic method of hacking into an account is called a brute force attack. Essentially, you take a guess at all possible passwords until you arrive at the right one. That’s the only case where you would probably incessantly jab at your keyboard. However, considering the length of the average password, there are at least a billion possible variations. You’d need to try countless combinations of letters, numbers, and symbols before arriving at the right one. Ain’t nobody got time for that. Moreover, passwords are not stored in servers as the original string of text, but are instead stored in a format known as hash values.

What Are Hash Values?

When companies store your account passwords on their servers, they don’t just store them as simple text. If they did, a simple ‘CRTL-F’ search would lead to the discovery of any password and its associated account. That’s where a hash algorithm proves to be useful. When you set a password for your account, a “hashing algorithm” is run on that string of text to convert it into a “hash value”. A hash value is essentially an encrypted form of the original text. Moreover, you cannot use a “reverse algorithm” to bring the hash value back to its original form. What one could do is “reduce” the hash value to create a new word. In some very unlikely cases, this word may be the original set of string input.

When you log in to your email account or social media website, the system can run the same hash algorithm on your password text and compare the result with the hash value it has on file. While this adds an extra layer of security, hackers could simply have a collection of thousands of passwords and their corresponding hash values. In fact, these collections do exist online and are called “hacker dictionaries”

What Are Hacker Dictionaries?

To simplify the process, hackers created huge databases full of the most frequently used passwords and their corresponding hash values. When a hash value matches one stored in a hacker dictionary, they simply use the original text corresponding to the hash value as the password and voila, they’re in. Of course, this trick only proves useful in the case of ‘common’ passwords. In other words, if your password is “password” or “password123” or some other infinitely popular password, then your account will get broken into. It’s only a matter of time. In fact, if your password is “password”, a basic brute force attack would more than suffice.

What if the password associated with an account is not a common one? What if it’s a random 8-letter word like “scrabble”? Hacker dictionaries could solve the issue of uncommon words by adding as many words as possible to their dictionary. However, storage is finite. Creating a hacker dictionary with every possible word would result in an unmanageably heavy file, much like an actual hardbound dictionary. One would have to lug around a data storage center every time they wanted to crack open an email account.

What Are Rainbow Tables?

To address this problem of file size, hackers came up with the concept of Rainbow Tables. Rainbow tables are basically indistinguishable from hacker dictionaries at first glance. They include a word, and next to it, its hash value. However, in the case of a Rainbow Table, the original word is hashed. The resultant hash value is ‘reduced’ to create a new word. Then that word is hashed. The new hash is reduced and the resultant word is hashed yet again. This process of hashing and reducing is done about one hundred thousand times. The one hundred thousandth hash value is stored along with the original text.

A Rainbow Table contains a long chain (about 100,000 links) of hash values in each row, instead of just one word and its hash. Essentially, a Rainbow Table can fit 100,000 words in a single row, as opposed to a hacker dictionary, which can fit just one. As a result, it can contain millions of words without having a proportionately large file size. Think of a rainbow table as a color palette. Each row of the table is a particular color, but each color has about 100,000 shades. Thus, we could store the color red, but have access to scarlet, maroon, burgundy, vermillion and many more shades without requiring any extra storage space.

A Rainbow Table is essentially a color palette (Photo Credit : Velazquez77/Shutterstock)

How Rainbow Tables attack work?

The hash value in a website server is compared against the list of hash values in the Rainbow Table. If there is a match, the corresponding original text is checked against the password that a person is trying to crack. If it’s right, voila, we’re in. If not, then the hash value is reduced to get the next original text in the chain. That text is tested against the password. Basically, we go down the whole chain of values through hashing and reducing at each step until arriving at a value that matches the password. This can still be quite a long, drawn-out process. Moreover, at present, we have Rainbow Tables that are able to crack passwords only up to 10 characters in length. Furthermore, these tables can’t handle complex, gibberish passwords.

This is why a lot of websites force you to somehow complicate your password. Add a capital letter, include a symbol, or have a number somewhere in between. A string of letters, numbers, and symbols, when hashed, would create a hash value that would rarely be a part of any hacker library or Rainbow Table. As a result, it makes for a super-strong password.