Re: Password "security" - was"Passwords with Lan Manager (LM) under Windows" and "Whitespace in passwords"

["Thor (Hammer of God)" <thor () hammerofgod com>]

Just a side note-- if you are using the password-on-boot feature, make sure 
you take that into account when considering unattended power-cycles, 
restarts, power failures, or other reboot events that may occur when no 
personnel are on site to enter the password.  That's an easy to DOS yourself 
if you are not thinking about it.  That's why the key-on-floppy is available 
(make sure your BIOS is not set to boot from floppy first) but if your main 
concern is lost or stolen resources, that may not really help you that much 
unless you keep the floppy out of the unit, thus re-introducing the 
self-imposed DOS issue again.

(Note that if any of the systems are (heaven forbid) NT4, that Microsoft has 
a hotfix for SYSKEY'd SAMs to fix keystream re-use in the SAM encryption 
that makes offline cracking easier.  KB248183.)

You really need to weigh the risks of an unattended reboot DOSing you or 
that of a box being "lost or stolen."  I can't see how a box could get lost, 
but if it's stolen, you'll be resetting all the passwords anyway... Which 
way to go is really up to how much of a propensity each given even is likely 
to occur...

t


----- Original Message ----- 
From: "Dufresne, Pierre" <PIERRE.DUFRESNE () MESS GOUV QC CA>
To: <pen-test () securityfocus com>
Sent: Tuesday, September 27, 2005 11:57 AM
Subject: RE: Password "security" - was"Passwords with Lan Manager (LM) under 
Windows" and "Whitespace in passwords"


> I hope everybody following this thread is aware that whether any version 
> of
> a cracking tool can crack or not non-printable characters is irrelevant. 
> If
> it can't, the authors could probably patch their tool very fast.
>
> As someone mentioned earlier, the game is now: how do you protect the 
> hashes
> when a computer is lost or stolen?
>
> I work in a Windows environment. The only immediate measure I can think of
> is the use of SYSKEY with a password prompt.
> Could anyone provide me with other simple solution?  Thanks
>
>
> Note to moderator: may be it would be better to start a new thread with a
> subject like "hashes protection in Windows"
> Thanks
>
> Pierre
>
> > Hi Dave,
> >
> > Lepton's Crack can, for sure. I dunno if the version with non-printable
> > characters is 20040914 or 20040916 (the later is not online, I'm afraid, I
> > have it on a CD somewhere).
> > Just had a look at the CHANGES file:>
> >
> > 20040914/
> > - Added support for any ASCII character (ie. also non-printable) in
> >   the charset and regex definition, via \0(octal), \x(hex),
> > \(decimal)
> >
> > Do a Google search for
> >
> > password cracker "non printable" characters
> >
> > And have fun collating the results.
> > Cheers,
> >
> > Miguel
> >
> >
> > -----Original Message-----
> > From: dave kleiman [mailto:dave () isecureu com]
> > Sent: 26 September 2005 15:00
> > To: 'Miguel Dilaj'
> > Cc: pen-test () securityfocus com
> > .Subject: RE: Password "security" - was"Passwords with Lan Manager (LM)
> under
> > Windows" and "Whitespace in passwords"
> >
> >
> > > Regarding "Whitespace in passwords", and as some people already
> > > mentioned, modern password cracking software (both commercial and
> > > free) can find non-printable chars, so space or ALT-whatever are going
> > > to be found anyway. Rainbow tables now tend to include space, but I
> > > still haven't heard of anyone producing a table for 0x00-0xff
> > > (0x0000-0xffff if you use extended unicode chars ;-)
> > > Applications CAN be broken by using strange characters, so YMMV.
> >
> >
> > Can you provide a list of those that have that ability, I will gladly test
> > them.
> >
> > The most popular ones cannot i.e. L0pht, Cain etc. See:
> > http://www.securityfocus.com/archive/88/312263
> >
> >
> > Dave
>
>
> ------------------------------------------------------------------------------
> Audit your website security with Acunetix Web Vulnerability Scanner:
>
> Hackers are concentrating their efforts on attacking applications on your
> website. Up to 75% of cyber attacks are launched on shopping carts, forms,
> login pages, dynamic content etc. Firewalls, SSL and locked-down servers 
> are
> futile against web application hacking. Check your website for 
> vulnerabilities
> to SQL injection, Cross site scripting and other web attacks before 
> hackers do!
> Download Trial at:
>
> http://www.securityfocus.com/sponsor/pen-test_050831
> -------------------------------------------------------------------------------


------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner: 

Hackers are concentrating their efforts on attacking applications on your 
website. Up to 75% of cyber attacks are launched on shopping carts, forms, 
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are 
futile against web application hacking. Check your website for vulnerabilities 
to SQL injection, Cross site scripting and other web attacks before hackers do! 
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------