ITPEC FE Morning October 2018 Question 37

Rainbow table attack — the attacker looks stolen password hashes up in a table of hashes computed in advance.

Computing hashes for huge numbers of candidate passwords is the slow part of cracking, so it is done once, ahead of time, and stored in a rainbow table (compressed using chains of hash and reduce steps). After stealing a file of password hashes, the attacker only has to look each hash up to recover a matching password.

Answer (c)

Why not others:

• •(a) Brute force attack — tries every combination at attack time, with nothing pre-computed
• •(b) Malware attack — a general term for attacks by malicious software, not a password-cracking method
• •(d) Zero-day attack — exploits a vulnerability before a patch for it is released; it is not about passwords

Key rule: A unique random salt per password defeats pre-computed tables, because the attacker would need a separate table for every salt.

Security · AI-written, may contain errors