Weak password detection in cloud computing environments
A system and method detect weak passwords in a workload deployed in a cloud computing environment. The method includes extracting a digest value from a password record, the password record further including a cryptographic function identifier of a cryptographic function; generating a digest value by processing the cryptographic function with a value selected from a dictionary list as an input; comparing the generated digest value to the extracted digest value; determining that a password associated with the password record is weak in response to the generated digest value matching the extracted digest value.
1 . A method for detecting weak passwords in a workload deployed in a cloud computing environment, comprising:
extracting a first digest value from a password record, the password record stored in the workload deployed in the cloud computing environment, wherein the password record further includes a cryptographic function identifier of a cryptographic function;
extracting the cryptographic function identifier from the password record;
selecting the cryptographic function from a plurality of cryptographic functions based on the extracted cryptographic function identifier;
generating a second digest value by processing the selected cryptographic function with a value selected from a dictionary list as an input;
comparing the generated second digest value to the extracted first digest value;
determining that a password associated with the password record is weak in response to the generated second digest value matching the extracted first digest value;
generating another digest value by processing the selected cryptographic function with a second value selected from the dictionary list as an input, in response to the generated second digest value not matching the extracted first digest value, wherein the dictionary list includes another value; and
determining that the password associated with the password record is not weak in response to the generated another digest value not matching the extracted first digest value, and wherein the dictionary list does not include another value.
2 . The method of claim 1 , further comprising:
generating the second digest value by processing the cryptographic function further with a salt value, wherein the password record further includes the salt value.
3 . The method of claim 1 , wherein the cryptographic function is a hash function.
4 . The method of claim 3 , wherein the hash function is any one of: secure hash algorithm (SHA) 1 (SHA-1), SHA-2, SHA-3, BLAKE2, and BLAKE3.
5 . The method of claim 1 , further comprising:
inspecting the workload to detect the password record.
6 . The method of claim 1 , wherein the workload is any one of: a virtual machine, a container, and a serverless function.
7 . The method of claim 1 , wherein the dictionary list includes a plurality of alphanumeric values.
8 . The method of claim 1 , further comprising: storing the extracted first digest value in a temporary memory.
9 . The method of claim 1 , further comprising:
generating an alert to indicate that a weak password is detected, in response to the generated second digest value matching the extracted first digest value.
10 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for detecting weak passwords in a workload deployed in a cloud computing environment, the process comprising:
extracting a first digest value from a password record, the password record stored in the workload deployed in the cloud computing environment, wherein the password record further includes a cryptographic function identifier of a cryptographic function;
extracting the cryptographic function identifier from the password record;
selecting the cryptographic function from a plurality of cryptographic functions based on the extracted cryptographic function identifier;
generating a second digest value by processing the selected cryptographic function with a value selected from a dictionary list as an input;
comparing the generated second digest value to the extracted first digest value;
determining that a password associated with the password record is weak in response to the generated second digest value matching the extracted first digest value;
generating another digest value by processing the selected cryptographic function with a second value selected from the dictionary list as an input, in response to the generated second digest value not matching the extracted first digest value, wherein the dictionary list includes another value; and
determining that the password associated with the password record is not weak in response to the generated another digest value not matching the extracted first digest value, and wherein the dictionary list does not include another value.
11 . A system for detecting weak passwords in a workload deployed in a cloud computing environment, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
extract a first digest value from a password record, the password record stored in the workload deployed in the cloud computing environment, wherein the password record further includes a cryptographic function identifier of a cryptographic function;
extract the cryptographic function identifier from the password record;
select the cryptographic function from a plurality of cryptographic functions based on the extracted cryptographic function identifier;
generate a second digest value by processing the selected cryptographic function with a value selected from a dictionary list as an input;
compare the generated second digest value to the extracted first digest value;
determine that a password associated with the password record is weak in response to the generated second digest value matching the extracted first digest value;
generate another digest value by processing the selected cryptographic function with a second value selected from the dictionary list as an input, in response to the generated second digest value not matching the extracted first digest value, wherein the dictionary list includes another value; and
determine that the password associated with the password record is not weak in response to the generated another digest value not matching the extracted first digest value, and wherein the dictionary list does not include another value.
12 . The system of claim 11 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:
generate the second digest value by processing the cryptographic function further with a salt value, wherein the password record further includes the salt value.
13 . The system of claim 11 , wherein the cryptographic function is a hash function.
14 . The system of claim 13 , wherein the hash function is any one of: secure hash algorithm (SHA) 1 (SHA-1), SHA-2, SHA-3, BLAKE2, and BLAKE3.
15 . The system of claim 11 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:
inspect the workload to detect the password record.
16 . The system of claim 11 , wherein the workload is any one of: a virtual machine, a container, and a serverless function.
17 . The system of claim 11 , wherein the dictionary list includes a plurality of alphanumeric values.
18 . The system of claim 11 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:
store the extracted first digest value in a temporary memory.
19 . The system of claim 11 , wherein the memory contains further instructions that, when executed by the processing circuitry, further configure the system to:
generate an alert to indicate that a weak password is detected, in response to the generated second digest value matching the extracted digest value.