Re: Passwords & Passphrases

[Matthew Gracie <graciem () CANISIUS EDU>]

Steven Alexander wrote:

> First, even if an attacker gains access to a system due to some other
> weakness, weak passwords may allow him to keep access, escalate his
> privileges or to gain access to another system within the same
> organization.

Hear hear. Too often I see people on lists like Bugtraq saying that a
vulnerability isn't important because its a local privilege escalation,
not something that can be remotely exploited. But when you combine a
local escalation with a weak user password, you've got a remote root
exploit that the sysadmin team may have assigned a lower priority to
take care of.

--Matt

--
Matt Gracie                         (716) 888-2403
Information Security Administrator  graciem () canisius edu
Canisius College ITS                425531N / 0785109W
http://www2.canisius.edu/~graciem/graciem_public_key.gpg