A rainbow table attack is a type of password attack used to crack password hashes stored in databases or other storage systems. Attackers use premade rainbow tables filled with plaintext passwords and their corresponding hash values to quickly find a matching plaintext password for a given hash value.
The key advantage of this method is that it demands intense computational resources and time but only during the hashing process. Once the hash values are generated, this method does not require much computing power or time when compared to brute-force attacks, which require tremendous processing power throughout the password attack process.
Rainbow table attacks exploit passwords that are stored using weak hashing algorithms (for example, the MD5 hashing algorithm). Hashed passwords can also be obtained from a leaked database that are often available to download from torrents or dark web forums. This provides attackers with a set of hashes to compare against the premade rainbow tables.
A real-world example of a rainbow table attack is the Ubuntu Forums attack in 2013. In this security incident, the attackers were able to gain unauthorized access to the Ubuntu Forums database, which contained the usernames, email addresses, and the hashed passwords of two million users. The attackers exploited an SQL injection vulnerability in the vBulletin (forum management software) used by Ubuntu Forums during the time of attack.
The passwords stored in the database were hashed using the MD5 hashing algorithm, which was quick but also susceptible to rainbow table attacks as the hashes generated by this algorithm could be decrypted using a dedicated MD5 rainbow table.
After the attack, the admins at Ubuntu Forums sent emails to all the forum users informing them about the attack and the compromise of their forum passwords. The forum users were advised not only to change their forum passwords but also to update the passwords on any other websites where they may have reused the same password (to prevent a potential credential stuffing attack).
Although they sound similar, rainbow table attacks and dictionary attacks couldn't be more different in the realm of password cracking methods, from the method of gaining access to the resources required for execution.
| Rainbow table attack | Dictionary attack |
|---|---|
| Method of gaining access | |
| This method gains access by using a premade list of password hash values. | This method uses a premade list of potential passwords. |
| Speed | |
| Slower | Faster |
| Success rate | |
| Similar to the dictionary attack, this password cracking method has a higher success rate if the password is a weak one. It requires significant time to crack a stronger password and, even in that case, the success rate is ambiguous. | This method has a higher success rate if the password is a weak one and may not work if the password is complex. |
| Resources required for execution | |
| This method requires greater computing power and time for creating the table. However, it requires significantly less during the execution. | Dictionary attacks require less computing power and time. |
ManageEngine ADSelfService Plus offers adaptive MFA with 20 different authentication factors, helping you keep rainbow table attacks at bay. MFA can be deployed to enhance security across a variety of applications and systems, whether on-premises or in the cloud.
The Password Policy Enforcer allows administrators to set standards that enforce rules regarding special characters, length limits, character repetition, and patterns. You can even upload a password dictionary and block users from choosing a password that is present in the dictionary. This promotes a more resilient line of defense.
A rainbow table is used in a password attack method called a rainbow table attack. Attackers use rainbow tables to accelerate the process of reverse engineering hashed passwords by pre-computing pairs of unhashed passwords and their corresponding hash values.
No, a rainbow table cannot crack any password. Rainbow table attacks do not work with passwords that have been hashed using modern hashing algorithms such as bcrypt or Argon2.
Rainbow tables are large, often ranging from several gigabytes to terabytes in size.
Philippe Oechslin introduced the concept of rainbow tables in 2003 through his research paper titled Making a Faster Cryptanalytic Time-Memory Trade-Off.
