Security Basics mailing list archives
Re: Password Cracking
From: tman () ollopa com
Date: Thu, 16 Sep 2004 03:57:04 -0000 (GMT)
I create two accounts today. Test1 with the password noted below ( k;!p-__f, ) and Test2 with the password 4U_'Tis_a_long_password. LC4 cracked Test1 in 4h17m39s. It has not yet cracked Test2. I suspect that it will take almost 3 weeks ( LC4 is saying it will take 19d20h... ). Past experience tells me that it will crack it. So, knowing that every password can be broken ( its just a matter of time ) I'm now an advocate of one time passwords ( like RSA SecurID ). I had been an advocate of PKI but having seen the the use of keyboard loggers to compromise an enterprise's PKI infrastructure, I'm now off that bandwagon. T
Hi Fabio, With enough time you can crack all passwords, regardless of what they are. I won't argue that in 24h, you probably wouldn't be able to crack something like k;!p-__f, but hey, I've added those three to my custom passwd lists. :-) Also, I make a general rule of generating custom passwds at least once a week to add to various lists, it just makes it easier. xyberpix On Wed, 2004-09-15 at 18:44, Fabio Miranda Hamburger wrote:To me I've always had great success with LC4 and John, it all depends what platform I'm on at the time though, and what dictionary lists I have loaded at the time as well, so far I haven't found a passwd thatIhaven't been able to crack, yet!You use easy to guess passwords based on letters and numbers. The dicctionary and GECOS generated passwords are weak. If you can crack all the passwords that host doesnt have a password policy. Have you cracked passwords like: k;!p-__f "d%g..H# ^ f!)I.. You can make the passwords > 8 digits so you cant really crack all the passwords. fabio.-- For Security and Open Source news: http://xyberpix.demon.co.uk
--------------------------------------------------------------------------- Computer Forensics Training at the InfoSec Institute. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse so that it never happens again. http://www.infosecinstitute.com/courses/computer_forensics_training.html ----------------------------------------------------------------------------
Current thread:
- RE: Password Cracking Simon Zuckerbraun (Sep 07)
- <Possible follow-ups>
- RE: Password Cracking Andrew Shore (Sep 08)
- RE: Password Cracking Prasanna M (Sep 08)
- Re: Password Cracking Alan Worstell (Sep 09)
- RE: Password Cracking Barrie Dempster (Sep 09)
- Re: Password Cracking Simon Taplin (Sep 13)
- Re: Password Cracking xyberpix (Sep 15)
- Re: Password Cracking Fabio Miranda Hamburger (Sep 15)
- Re: Password Cracking xyberpix (Sep 15)
- Re: Password Cracking tman (Sep 16)
- Re: Password Cracking GuidoZ (Sep 16)
- Re: Password Cracking K. K. Mookhey (Sep 18)
- Re: Password Cracking Anirudhya Mitra (Sep 27)
- Re: Password Cracking GuidoZ (Sep 27)
- Re: Password Cracking GuidoZ (Sep 27)
- Re: Password Cracking Über GuidoZ (Sep 13)