Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security Encryption Operating Systems Software Windows

Swiss Researchers Exploit Windows Password Flaw 519

Posted by timothy from the sigh dept.
Bueller_007 writes "CNET is carrying an article about a new (albeit simplistic) method used to hack alphanumeric Windows passwords in a matter of seconds, rather than minutes. To blame is a 'weakness in Microsoft's method of encoding passwords.' According to the authors, the same method, when used on Mac OS X, Unix and Linux boxes, however, could require either 4,096 times more memory or 4,096 times longer." A few more details: Mister.de writes "As an example we have implemented an attack on MS-Windows password hashes. Using 1.4GB of data (two CD-ROMs) we can crack 99.9% of all alphanumerical passwords hashes (2 37 ) in 13.6 seconds whereas it takes 101 seconds with the current approach using distinguished points. We show that the gain could be even much higher depending on the parameters used. This was found at the Cryptography and Security Laboratory of the Swiss Federal Institute of Technology in Lausanne (EPFL)."
This discussion has been archived. No new comments can be posted.

Swiss Researchers Exploit Windows Password Flaw More

Swiss Researchers Exploit Windows Password Flaw

Comments Filter:

  • This is why... (Score:5, Funny)

    by mgcsinc ( 681597 ) on Wednesday July 23, 2003 @11:22AM (#6511613)
    This is why I use Biopassword [slashdot.org] Perhaps their encryption method is just as insecure as microsoft's, but at least there aren't quite so many Swiss researchers trying to crack it...

    • Re:This is why... (Score:3, Interesting)

      by kasperd ( 592156 )
      This is why I use Biopassword Perhaps their encryption method is just as insecure as microsoft's

      I have seen BIOSes that did not encrypt the password at all.

    • Re:This is why... (Score:5, Funny)

      by Charleton Heston ( 584273 ) on Wednesday July 23, 2003 @12:31PM (#6512342) Homepage
      I use plaintext. Granted, some people are working on cracking plaintext, but they are almost always in a 1st grade reading class and I ain't scared of them.
    • 404 File Not Found

      Come on, everybody knows that one.

  • Performance increase (Score:5, Insightful)

    by levik ( 52444 ) on Wednesday July 23, 2003 @11:25AM (#6511649) Homepage
    THis sort of performance increase is only useful for Mission Impossible type movie spies... I mean come on - who can't wait 100 seconds???

    People are really running out of interesting stuff to "research", aren't they...

    • If they ever invent a toilet door with password protection I'm sure those 100 seconds will come in VERY handy in an emergency.

    • Re:Performance increase (Score:5, Insightful)

      by Marx_Mrvelous ( 532372 ) on Wednesday July 23, 2003 @11:33AM (#6511747) Homepage
      You obviously aren't a computer scientist (or a computer hacker). What they got was a power of ten increase (roughly). This is a significant improvement because it is not simply incremental. Look at it this way:
      Let's say it usually took 200 days to crack a password. A company could enforce a 90-day (3 month) requirement to change passwords, and a brute force technique would have roughly a 1-in-2 chance of getting a password in any given 90-day period. Now they increased it by a factor of 10.
      Now it takes 20 days to crack a password. If the company want to keep the same level of password security, users would have to change their passwords every 7 days!

      This is a pretty big issue.

      • Re:Performance increase (Score:5, Insightful)

        by MisterFancypants ( 615129 ) on Wednesday July 23, 2003 @11:39AM (#6511805)
        Yeah but their power of 10 increase isn't globally applicable to many types of encryption breaking, it exists due to a flaw in Microsoft's specific implementation, so really the original poster is right, this isn't big news of any sort.

        I can't imagine it would have made the front page at all if not for the usual "See how insecure Micro$oft is!" Slashdot biases.

      • Re:Performance increase (Score:5, Funny)

        by mikeophile ( 647318 ) on Wednesday July 23, 2003 @12:01PM (#6512034)
        So since this exploit takes an average of 13.6 seconds, do users need to change thair passwords every 4 seconds?

      • Company Memo: New security procedures. (Score:5, Funny)

        by barracg8 ( 61682 ) on Wednesday July 23, 2003 @12:16PM (#6512173)
        All,

        As you know we have a company security policy based around frequently changing passwords, in order to keep our Windows network secure.

        Previously, as you are all no doubt aware, you were required to change your Windows passwords once every 90 seconds, since NT passwords can be cracked in 100 seconds flat.

        Due to recent developments in MS password cracking, we will now be requiring all employees to change their passwords once every 10 seconds, to ensure they remain secure.

        We hope this will not detract from productivity, and apologise for any inconvenience it does cause.

        thanks,
        Management

      • You can "let's say" all you want, but it's 100 seconds down to 13.6 seconds. How about explaining the real world significance of that? Seems to me to be like quibbling over how many times we can nuke the world into glass. After the first time, it's just about dick size.

  • Scary stuff... (Score:3, Interesting)

    by Anonymous Coward on Wednesday July 23, 2003 @11:26AM (#6511655)
    M$ passwords hacked within seconds...

    Linux / Mac OSX passwords hacked within an hour too probably...

    Maybe we need something just a little stronger!

    • Re:Scary stuff... (Score:5, Funny)

      by PaizuriTatsujin ( 674475 ) on Wednesday July 23, 2003 @11:41AM (#6511832)
      What we need is no passwords at all and a midget sitting on everyone's desk guarding their computer.

      When that happens I'll feel safe

    • No salt (Score:5, Informative)

      by dpilot ( 134227 ) on Wednesday July 23, 2003 @11:41AM (#6511835) Homepage Journal
      You've made a supposition that MS passwords are marginally weaker than Unix passwords. Read the article, and there's a more basic factor at work.

      >"Windows passwords are not very good," he wrote. "The problem with Windows passwords is that they do not include any random information."

      From what I understand, Unix passwords normally take a little 'salt', a little random information, as well as the user password, and hash that. Microsoft just hashed the user password without the salt. This makes it easier to crack., anything else aside.

      To their credit, you have to be Admin to get to the password hashes, rather like /etc/shadow.
      To their debit, most WinDesktops that I'm aware of end up as glorified single-user machines, and that user is also.... Admin. Finally build a decent security model, and then customers ignore it.

      • Re:No salt (Score:5, Insightful)

        by Anonymous Struct ( 660658 ) on Wednesday July 23, 2003 @11:58AM (#6512007)
        To their debit, most WinDesktops that I'm aware of end up as glorified single-user machines, and that user is also.... Admin. Finally build a decent security model, and then customers ignore it.

        I think the customers only ignore it because they've been bred on Win9x, which sort of casually asked if you felt like typing in a password, but didn't really care one way or the other if you actually did. You can't train people that passwords don't matter for 7 years and then expect them to start caring about security when you finally decide to implement it. So now we have a sea of internet users who don't know or care one whit about security all because they've been taught from the very beginning that all they ever have to do is plug it in, turn it on, and start browsing.

  • Well, (Score:4, Funny)

    by TedTschopp ( 244839 ) on Wednesday July 23, 2003 @11:26AM (#6511660) Homepage
    I sure hope we aren't using Microsoft Technology for anything important like National Security? Cause that would suck!

    Please Advise, I don't know how to think about this story, I'm a Swiss-American.

    Ted

  • Yoddle-Aay-Hee-Hooo (Score:5, Funny)

    by ambisinistral ( 594774 ) <ambisinistral&gmail,com> on Wednesday July 23, 2003 @11:27AM (#6511668) Homepage
    This post isn't by me, it is by some Swiss guy who hacked my /. password to make me look bad.

    • You are truly evil. You IMPLY that Slashdot is running on Borg Technology. Bad form ambisinistral, bad form. That would crush the hearts of all geeks alike. Hell, that would cause mass rioting.

      To Redmond we go! Every one click:

      http://www.microsoft.com/

      C'mon geeks, nerds, and dweebs UNITE. We can Slashdot the Borg and overtake the monopolistic opression we are so tired of battling.

  • One problem (Score:5, Informative)

    by felix9x ( 562120 ) on Wednesday July 23, 2003 @11:30AM (#6511696) Homepage
    LanMan is not used on win2000 and winXP machines.

    NThash dont know, probably not.

    This hack is obsolte

    • Re:One problem (Score:3, Informative)

      by truthsearch ( 249536 )
      LanMan is still supported on Win2000 and maybe WinXP for backwards campatability (I assume to network with older system like Win98).

      Just because it's called NThas doesn't mean it died with NT. LanMan was used until early releases of NT. The Win2000 bootup screen says "Built with NT technology". Whatever that means it implies lots of shared code. Since NThas was introduced with NT its unlikely they just drop it, especially since it was an improvement and they didn't care to fix this one major weakness a

    • Re:One problem (Score:5, Informative)

      by Shell!U4$ ( 690310 ) on Wednesday July 23, 2003 @12:10PM (#6512118)
      Actually,

      The LANMAN hashes are still used in Win2k. They are enabled and kept in the ActiveDirectory by default.

      If your a 100% Win2k or higher shop, you can disable the LANMAN hashes and use NTLM 2 hashes exclusively.

      Microsoft is willing to tell you how, if you look here [microsoft.com], along with some details about the whole subject.

      Hello, my name is Shakey Weaselteat and this is a song about a whale ...

    • Re:One problem (Score:5, Informative)

      by Torne ( 78524 ) <torne@wolfpuppy.org.uk> on Wednesday July 23, 2003 @12:22PM (#6512249)
      This crack breaks both LanMan and NTLM hashes. NTLMv2 is not affected.

      NTLMv2 was introduced in Windows 2000 and is still not the default; Windows Server 2003 Enterprise defaults to 'Send NTLM only', which will stop LanMan attacks, but not prevent NTLM attacks. It will also not ALLOW NTLMv2 to be used, even if the client supports it. I.E. the only secure authentication system which is available is disabled by default.

      Yes, all the MS security practise documents will tell you to set it to NTLMv2 only (which requires upgrading all clients to Windows 2000 or above).. but it's still not the *default*. Enabling NTLMv2 does not break backward compatibility (only disabling v1 does), so I'm not sure how they justify this decision =)

      Torne

  • Of course the Swiss were able to hack it... (Score:5, Funny)

    by JDRipper ( 610930 ) on Wednesday July 23, 2003 @11:30AM (#6511701)
    They've got those great knives after all.

  • I don't understand (Score:5, Insightful)

    by Trelane, the Squire ( 608266 ) on Wednesday July 23, 2003 @11:31AM (#6511703)
    While an attacker would need administrator rights to a system to grab the file that contains the password hashes, the file is still valuable, said David Dittrich, a senior security researcher at University of Washington.
    if a hacker had administrator rights, wouldn't it already be game over? On the other hand, a 20 gb hack isn't extremely portable

    • Re:I don't understand (Score:5, Insightful)

      by Quietust ( 205670 ) on Wednesday July 23, 2003 @11:45AM (#6511878) Homepage
      if a hacker had administrator rights, wouldn't it already be game over? On the other hand, a 20 gb hack isn't extremely portable
      Not quite - admin rights would only give access to whatever was on that particular machine (and stuff on the network), while the passwords of everyone who used that system would be considerably more valuable.

    • Re:I don't understand (Score:5, Informative)

      by truthsearch ( 249536 ) on Wednesday July 23, 2003 @11:46AM (#6511889) Homepage Journal
      The game's over with admin rights to every workstation. With this scenerio, once you're admin on one computer of the network, it's quick to get every other password on the network, such as domain admins. On Unix, Linux, and Mac OS X, if you're admin and have the hash entries you can't use them to crack into other computers on the same network because of the random bits added to each hash.

    • Re:I don't understand (Score:4, Interesting)

      by whorfin ( 686885 ) on Wednesday July 23, 2003 @11:58AM (#6512002)
      The beauty is, consider these email virii applications of this...
      - Somebody reads an email with a simplified hack based on this embedded within it (don't need the whole dataset, you just reduce your hit rate)
      - They unwittingly send back the machine info and an admim-level password to the hacker. (where I work, all 'owners' have admin rights on their system).
      - From this, they can get admil-level access permanently, as well as a chance to download the full crack via a backdoor and get the network admin password, and from there, the whole network.
    • As with many file based cracks, it is at very least debatable over the need for Administrator access on the box itself. One method that I used to see in the L0phtCrack days was to boot the machine using a black box distribution on a floppy (compressed minimal *nix kernel with ntfs support) then grab the .sam file from the hard drive itself. From there, you can take your time cracking the Administrator password, and then with that access you can remotely dump the registry database on the server from any box

  • Is this really news worthy? (Score:4, Insightful)

    by mjmalone ( 677326 ) on Wednesday July 23, 2003 @11:31AM (#6511705) Homepage
    This is hardly a news. These weaknesses have all been known for years, and the use of dictionary attacks against passwords is very common.

    Bruce Schneier talks about all of these attacks and weaknesses in his book "Applied Cryptography" which was published years ago.

    • Actually... (Score:3, Informative)

      by tomzyk ( 158497 )
      From what I got out of the article, it's NOT a "dictionary attack" - where common words are [brute-force] used to obtain access; rather, it's a brute-force attack where they compare the original password string to the encrypted string.

      In this case, the "dictionary" consists of, not just a list of words, but a list of strings and their encrypted companions.

      But you're still right: not really news worthy.

      "This is not a new vulnerability," he said. "It is only the first time that it has been worked in so muc

  • Nothing new (Score:5, Informative)

    by raffe ( 28595 ) on Wednesday July 23, 2003 @11:31AM (#6511708) Journal
    "We [cryptonomicon.net] fear, however, that the titles of these articles are a little sensational. While it is true that the LANMAN and NTHash windows password techniques have issues, the paper that kicked off this whole hub-bub [PDF] describes a refinement of an existing attack, not a new attack. We wanted to remind our readers that adequate password security is a good idea, whether your windows systems are being attacked with an adversary with an old copy of L0phtCrack, or with Philippe Oechslin's new system."

    Read it all here [cryptonomicon.net]

  • I hope someone hacks my passwords at work (Score:5, Funny)

    by gorjusborg ( 603799 ) on Wednesday July 23, 2003 @11:33AM (#6511739) Journal
    I hope someone hacks my passwords at work and deletes this stinking code I'm debugging.

    Oh, and the backups too. Just point your password crackers to ...

  • Only works with NTMLv1, NTLM v2 not effected. (Score:5, Informative)

    by figleaf ( 672550 ) on Wednesday July 23, 2003 @11:35AM (#6511766) Homepage
    This only works with NTML v1. Not with NTML v2.

    In order to prevent this
    Using secpol.mmc,
    in you security pocilies set the LAN manager authentication level to 'NTLMv2 response only refuse LM & NTLM'

    The passwords are only crackable if you have Win 9x machines in your doamin.

    If you have Windows 2000/2003 domain without Win 9x machines then you passwords cannot be recovered.

    Admins can prevent Windows 9x machines from logging in to the network.

    This is reason enough to migrate to Windows XP.
    • With regards to upgrading, I've come to the conclusion that even though MS says they want to improve security in their products having flaws is a great way to force people to upgrade.

      I'ill give NT4 as an example which is EOL'd. You're a company who has managed to get your NT4 server rock solid. A new security flaw comes out and since NT4 is EOL'd MS says no security patch for you, upgrade to Win2K.

      Of course if you was a complete conspiracy theorist you could say even MS would leak holes in their old prod

  • If You RTA (Score:5, Informative)

    by deadlinegrunt ( 520160 ) on Wednesday July 23, 2003 @11:36AM (#6511777) Homepage Journal
    You'll notice the line:

    Users can protect themselves against the attack by adding nonalphanumeric characters to a password. The inclusion of symbols other than alphanumeric characters adds complexity to the process of breaking passwords--and that means the code cracker needs more time or more memory or both.

    For those that don't realize considering the following for example:

    # characters/Upper Case Only
    8 /208,827,064,576
    # characters/Upper, Lower, Numbers & Symbols
    8 /6,634,204,312,890,620

    This post is more for the types that really don't consider their password selection...

  • This week only (Score:4, Funny)

    by Ptahian ( 113302 ) on Wednesday July 23, 2003 @11:37AM (#6511785)
    I smell a sale coming!

    New New NEW. Lower Prices! Krazy Bill is just GIVING these away. Come on down. He's Krazy Krazy KRAZY to license this software with these terms! Get yours TODAY!

  • What The...? (Score:4, Funny)

    by tds67 ( 670584 ) on Wednesday July 23, 2003 @11:38AM (#6511794)
    Why do I keep getting ads for watches and chocolate now?

  • They *exploit* a Windows password flaw? (Score:4, Funny)

    by YetAnotherName ( 168064 ) on Wednesday July 23, 2003 @11:38AM (#6511800) Homepage
    Sensational headline, don't you think Timothy? Swiss Researchers [i]exploited[/i] a password flaw?

    I guess you could argue they [i]exploited[/i] it in order to publish their research results, as much as a planetary scientist exploits images of Mars to publish a new theory on subsurface water.

  • So? (Score:5, Insightful)

    by ioErr ( 691174 ) on Wednesday July 23, 2003 @11:39AM (#6511808)
    13.6 seconds or 101 seconds doesn't make much difference, now does it? The real problem is still getting administrator access to the target computer in the first place.

  • With distributed computing, why bother? (Score:5, Insightful)

    by jeeves99 ( 187755 ) * on Wednesday July 23, 2003 @11:40AM (#6511812)
    Cracking becomes easier if you have access to a distributed network. Parse the table into managable chunks and throw it out to 100 computers. While the time taken to crack the password might not scale down in a linear fashion [ie: time/(N computers)], it will most definately drop the crack time down to less than an hour for those computers with 12bit salts (4906*.6min= 41 hr, 41hr/100comps= 25 minutes).

    Even if the 12 bit salt for mac/linux/etc was increased in size, a scale up in the number of computers used would defeat this added protection. The trend in the comp world seems to be more connectivity between large numbers of computers. All it takes is one disgruntled folding@Home grad student out at stanford to break even the most stringent password.

    It seems that increasing the size of the salt would prevent the average script kiddie from breaking your password, but does nothing to alleviate the threat distributed computing presents. So what other options are there?

  • I've always taken Microsoft security... (Score:4, Funny)

    by wfberg ( 24378 ) on Wednesday July 23, 2003 @11:40AM (#6511816)
    with a grain of salt.

    rimshot

  • I for one welcome our new Swiss Overlords!!! (Score:5, Funny)

    by Picass0 ( 147474 ) on Wednesday July 23, 2003 @11:43AM (#6511852) Homepage Journal
    13.6 seconds! Aren't swiss watches wunderful?

  • Wow, less memory? (Score:5, Funny)

    by Nanite ( 220404 ) on Wednesday July 23, 2003 @11:45AM (#6511875)
    Windows uses less memory to do this trick than Linux. Who knew Windows was so efficient at handling memory when being hacked?

    Nanite

  • Welcome to the 90s (Score:5, Informative)

    by jeeptj ( 463368 ) on Wednesday July 23, 2003 @11:47AM (#6511894)
    This authN method is 8 or 9 years old. You can disable the NT hash by using either a password length of more than 14 chars or by using a simple registry value on Windows 2000 SP2 systems or higher. This KB [microsoft.com] explains how. Any good sys admin should have the LM hash disabled on all Windows machines by default anyways and set strong passwords which contains more than simple letters and numbers.

    Mindless Microsoft bashing at it's best!

  • Hack obsolete on curent Windows servers (Score:5, Informative)

    by prisoner-of-enigma ( 535770 ) on Wednesday July 23, 2003 @11:48AM (#6511903) Homepage
    You can (and should) disable NTLM authentication if you're running Windows 2000 or 2003. This is very easy to do and makes any server immune to this type of hashing attack. It's even listed in Microsoft's Best Practices documentation for administrating their servers. It might cause problems with older Win9x clients, but there are updates to these clients that allow them to get along without NTLM.

    If you're running Active Directory in Native Mode, NTLM is easily kicked to the curb. However, NT4 machines remain vulnerable to this hack. Yet another reason to just get off of NT.

  • Incorrect Information In The Article (Score:5, Informative)

    by Jerk City Troll ( 661616 ) on Wednesday July 23, 2003 @11:50AM (#6511921) Homepage

    The article makes a statement that I think is untrue:

    While an attacker would need administrator rights to a system to grab the file that contains the password hashes, the file is still valuable, said David Dittrich, a senior security researcher at University of Washington.

    Using a tool like Cain & Able [www.oxid.it], it is possible to get access to this information without having administrative rights.

    You can also dump the hashes using Cain & Able's password cracking tool. It is really quite trivial to do.

    By the way, you can easily acquire the passwords of the last five users who logged into an NT system. They are stored in LSA "secrets", an area of memory which is easy to dump. Cain & Able does this for you.

    Have fun.

  • The point of the article is not just Windows... (Score:3, Interesting)

    by HaloZero ( 610207 ) <protodeka&gmail,com> on Wednesday July 23, 2003 @11:56AM (#6511977) Homepage
    ...password phr4c|
    The point of the article is to show off a faster, new time-memory trade-off technique, not to just down-play Windows security. The manner in which Window's password security is built simply provided an error-free sandbox for this method to be tested, and exemplified.

    Don't feed the trolls.

  • Only 4096 more time on Unix ? (Score:5, Insightful)

    by chrysalis ( 50680 ) on Wednesday July 23, 2003 @12:06PM (#6512087) Homepage
    I strongly disagree. Maybe this 4096 times applies to the traditional single DES crypt. But execept for some rare compatibilities issues with old systems or for dumb people that create Apache .htpasswd files with it, nobody uses single DES any more for years.

    Passwords hashed with MD5 and Blowfish don't have the 8 character limitation. There are still some people who like to assign users passwords like "*9_p7Z9ox" even though their system doesn't use single DES any more. This is just plenty stupid. Not only it's a hell to remember for the end user, but it's damn fast to brute force when hashes are precomputed as described in this article.

    A normal password like a real sentence (ex: "I'd like to have sex with Sandra") is not only way more easy to remember, it's also orders of magnitudes harder to brute force.

    • Re:Only 4096 more time on Unix ? (Score:5, Interesting)

      by pclminion ( 145572 ) on Wednesday July 23, 2003 @12:41PM (#6512424)
      I think they might be assuming a 12-bit salt added to the hash. This would make the hash dictionary 4096 times larger, since they would have to compute the hash of each password 4096 times (for each possible 12-bit salt value).

      If this is the case, it implies that Windows password hashes do not use salts. Now, I'm not claiming that salting makes the process secure (it doesn't), but it does make it orders of magnitude more intensive to compute a complete hash dictionary. At the expense of 12 bits per password (hell, use more if you want!) it seems worth it to use salts.

  • UNIX uses 64 bits salt (Score:5, Interesting)

    by phkamp ( 524380 ) on Wednesday July 23, 2003 @12:58PM (#6512575) Homepage
    The MD5 based password scrambler I wrote for FreeBSD in 1994 uses a 64 bit salt, and has subsequently been adopted by NetBSD, OpenBSD, Cisco GLIBC and pressumbably MAC OSX.

    There is no immediate future for a table driven attack on this algorithm (Which can be recognized by the '$1$...' prefix.

    HP-UX, Solaris and AIX, however still use the old 12 bit salted DES derived passwords.

  • Why this doesn't matter AT ALL (Score:3, Insightful)

    by psamuels ( 64397 ) on Wednesday July 23, 2003 @01:04PM (#6512635) Homepage

    This isn't a security problem.

    Windows password hashes (both the LanManager hash described here and the newer NT hash) are never sent "in the clear" over a network, or accessible to non-admins.

    Why? Because they are plaintext-equivalent. Most NT network protocols treat the hash itself as a shared secret and do not make any attempt to verify that you know the actual password.

    Yes, that's right. You already don't need to know the user's unencrypted password - except possibly for changing it (I can't remember offhand whether the various password-change calls require proof of knowledge of the old password - but I don't think they do either). Once an attacker gets the hashes out of your SAM, the game is already up, even if he can't decrypt them.

    Given this fact, I sometimes wonder why Microsoft even bothered to try making NTLM a secure hash. BASE64 would have done pretty much the same job.

    Move along, nothing to see here. Your passwords are just as secure, or as insecure, as they ever were.

  • Not really that much of an issue... (Score:3, Interesting)

    by MoogMan ( 442253 ) on Wednesday July 23, 2003 @01:20PM (#6512767)
    ...in 13.6 seconds whereas it takes 101 seconds with the current approach using distinguished points.

    To be honest, this isnt as much of a scare as most people would think. A person willing to crack a password in ~13.6 seconds would no doubt be willing to take the extra minute regardless.

    Plus you need Administrator privelages to get the hash file anyways, so you'd be able to access anything needed locally anyways.

    Finally, crackers wouldnt be able to escalate to these privelages in the first place (hey, they wouldnt have any access on the system), so there really isnt anything for anyone to be concerned.

  • Symbols in the password (Score:3, Informative)

    by Nintendork ( 411169 ) on Wednesday July 23, 2003 @01:31PM (#6512890) Homepage
    If there are symbols in the password, techniques such as this don't work. Most security professionals recommend that password be at least 8 characters and contain random characters including upper and lower case letters, numbers, and symbols. A good example would be 8e#^D2(h

    After a dozen or so times typing it in, you actually start to remember it. For those wondering, that password is something I just made up. I don't actually use it. =P~

    -Lucas

  • Either Or (Score:3, Funny)

    by telstar ( 236404 ) on Wednesday July 23, 2003 @01:36PM (#6512952)
    "According to the authors, the same method, when used on Mac OS X, Unix and Linux boxes, however, could require either 4,096 times more memory or 4,096 times longer."
    • Do we get to choose?

  • What is not made clear... (Score:3, Informative)

    by CommieLib ( 468883 ) on Wednesday July 23, 2003 @02:00PM (#6513164) Homepage
    Is that adequate passwords make this hack impossible. It relies on a "lookup table" (read, pregenerated dictionary attack results). If your password ain't in it, it ain't happening. Look, chances are, you speak at least few phrases of a foreign language. Dictionary attacks generally use English words; choose a couple of foreign words and numbers for your password, and all this crap goes away.

    If you don't choose a decent password, then, well, your password will take five minutes to crack rather than 13.6 seconds. Feel better?
    • Unless of course that lookup table contains not just dictionary words, but all alphanumeric combinations. Which I'm pretty sure is what they are doing. In any case, if your password is not in their list, they have certainly narrowed things down a lot.

  • Oh no! What about my PWLs! (Score:3, Funny)

    by dmccarty ( 152630 ) on Wednesday July 23, 2003 @03:09PM (#6513787)
    Come on, this is just a bunch of anti-American FUD by the Swiss. It's widely known that the .pwl encryption method is the safest in the world!

  • Mindless Self Promotion (Score:3, Interesting)

    by Valar ( 167606 ) on Wednesday July 23, 2003 @04:40PM (#6514911)
    This is pretty much what my pet project (parasite, it's in my sig) does, except it does it for crypt and md5. I'm not really sure what windows uses. The main problem I have right now is actually with GCC under cygwin. It seems to choke sometimeson the large static arrays I use to speed things up. Works fine on everything else though.

Slashdot Top Deals

"May your future be limited only by your dreams." -- Christa McAuliffe

Close