How Neural Networks Can Guess Your Password

Neural networks and password guessing

Hackers have various methods of gaining access to online accounts, as the security breaches we read about on an almost daily basis shows. The most widely known is the technique known as a brute-force attack, which essentially means they try every possible password in alphabetical order. But that requires time, so sophisticated approaches use different techniques, such as a brute-force combined with dictionary attacks. And then there is password guessing software, which is also a highly useful utility in the hand of cyber-criminals.

Can machines guess your password? Yes, they can!

The training produced incredible results: using the PassGAN technique, the researchers were able to match more than 46% of the passwords in the testing set extracted from the RockYou leak.

In another experiment, UNC researchers obtained the passwords of more than 10,000 defunct accounts belonging to former university students and staff. Since users were required to change their passwords quite often, their initial dataset contained more than 50,000 passwords. After cracking roughly 60% of the passwords using a regular password-hacking approach, the researchers developed a more advanced password cracking approach that formulated guesses based on the previous password selected by the user.

They made an important discovery: users tended to come up with passwords that followed predictable patterns, which they call ‘transformations’, such as using an incremental number, or changing a letter into a similar-looking symbol. These results suggest that attackers who have previously guessed a user’s password may be able to guess the user’s later passwords fairly easily, especially if the change was initiated by an unexpected password-change prompt.