What is a Rainbow Table Attack?
A rainbow table attack is a password cracking method that uses a special table (a “rainbow table”) to crack the password hashes in a database. Applications don’t store passwords in plaintext, but instead encrypt passwords using hashes. After the user enters their password to login, it is converted to hashes, and the result is compared with the stored hashes on the server to look for a match. If they match, the user is authenticated and able to login to the application.
The rainbow table itself refers to a precomputed table that contains the password hash value for each plain text character used during the authentication process. If hackers gain access to the list of password hashes, they can crack all passwords very quickly with a rainbow table.
The prevalence of rainbow table attacks has dramatically decreased due to a technique known as “salting.” Salting is a modern technique used to thwart rainbow table attacks. It involves adding an extra random value to every hashed password to create a different hash value. Most modern password authentication systems include salting, which has significantly lessened the number of successful rainbow table attacks.
Though salting is more prevalent, some developers still don’t utilize it and that puts them at increased risk of a rainbow table attack.
How a Rainbow Table Attack Works
Hackers must first gain access to leaked hashes in order to carry out rainbow table attacks. The password database itself might be poorly secured, or they may have gained access to the Active Directory. Others gain access through phishing techniques of those that might have access to the password database. On top of all these techniques, there are already millions and millions of leaked password hashes on the dark web that are available to hackers.
Once they have the password hashes the rainbow table is used to help decrypt the password hashes. As long as the password hashes don't include a “salt,” (explained above) they’ll be able to translate the encrypted passwords into plaintext easily.
Examples of Rainbow Table Attacks
Below, we’ve listed two “real world” examples of how rainbow table attacks might occur.
- An attacker spots a web application with outdated password hashing techniques and poor overall security. The attacker steals the password hashes and, using a rainbow table, the attacker is able to decrypt the passwords of every user of the application.
- A hacker finds a vulnerability in a company’s Active Directory and is able to gain access to the password hashes. Once they have the list of hashes they execute a rainbow table attack to decrypt the hashes into plaintext passwords.
How to Protect Against a Rainbow Table Attack
Protecting yourself from rainbow table attacks is relatively straightforward if you follow these guidelines:
- Eliminate passwords: The ONLY way to ensure the prevention of password-based attacks is through eliminating passwords. Without a list of password hashes to steal there is no way to execute a rainbow table attack. Learn more about passwordless authentication today and keep your most critical applications secure.
- Use salting: Hashed passwords should never be stored without salting. This makes the password more difficult to decrypt. However, we recommend eliminating the alphanumeric password altogether.
- Use biometrics: Using a biometric method of authentication makes it difficult, if not impossible, for an attacker to use a rainbow table attack effectively. Rainbow table attacks will not work against biometric passwords.
- Monitor your servers: Most modern server security software monitors against attempts to access sensitive information and can automatically act to mitigate and trap intruders before they can find the password database.
- Don’t use outdated hashing algorithms: Hackers look for applications and servers using obsolete password hashing algorithms MD5 and SHA1. If your application uses either algorithm, your risk for rainbow table attacks substantially increases.
