Penetration Testing mailing list archives
Re: Secure Password Policy?
From: bf <illuminatus.master () gmail com>
Date: Fri, 20 Jan 2006 22:52:37 -0500
I'm going to keep this short as it could easily become several pages long... use google for more information on a specific subject. In addition to the previous posts by others consider the following. The vulnerability lies in the use of the default NT/NTLM hashes for authentication in windows active directory. In addition to what are normally considered "best practices" for windows passwords you need to use windows active directory group policy to force NTLMv2 challange/response only. NT/NTLM password hashes up to 14 charachters are easily cracked (typically less than 2 hours with a 85% success rate with the files I typically use) by using something like rainbow tables or Ophcrack. If you don't believe me go ahead and download pwdump3 and Ophcrack with the "big" table. Dump the hashes from your Win32 DC into a txt file and feed it into Ophcrack, go to lunch, come back and view your passwords. In short, deny NT/NTLM and force NTLMv2 or use passwords over 14 charachters in addition to best practices and you should be "ok". Google for terms like "disable ntlm hash" and you'll find more information. btw: you need to prevent your Win32 DC's from storing the NT/NTLM hashes locally (duh), microsoft technet provides info on which registry keys to edit to make this happen. enjoy your weekend. bf On 1/19/06, Sulaiman, Wilmar <wsulaiman () siddharta co id> wrote:
Dear all, I noticed that "best practice" for Minimum password length policy is either 6 or 8 characters. I guess SANS institute considered a weak password if it is less than 8 characters. I would like to know where they derived the number (6 and 8 characters). Is there any documentation to backup it up why the best practice for minimum password length is set to 6? Wilmar Sulaiman Risk Advisory Services KPMG Siddharta Siddharta & Widjaja 32nd Floor, GKBI Building 28, Jl. Jend. Sudirman Jakarta 10210, Indonesia J : +62 (0) 21 574 2333 Fax : +62 (0) 21 574 1777 ********************************************************************** The information in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this e-mail by anyone else is unauthorized. If you have received this communication in error, please address with the subject heading "Received in error," send to postmaster () siddharta co id, then delete the e-mail and destroy any copies of it. If you are not the intended recipient, any disclosure, copying, distribution or any action taken in reliance on it, is prohibited and may be unlawful. Any opinions or advice contained in this e-mail are subject to the terms and conditions expressed in the governing Siddharta Siddharta & Widjaja/PT Siddharta Consulting client engagement letter. Opinions, conclusions and other information in this e-mail and any attachments that do not relate to the official business of the firm are neither given nor endorsed by it. Siddharta Siddharta & Widjaja/PT Siddharta Consulting cannot guarantee that e-mail communications are secure or error-free, as information could be intercepted, corrupted, amended, lost, destroyed, arrive late or incomplete, or contain viruses. Siddharta Siddharta & Widjaja - Registered Public Accountants, registered in Indonesia, is a member firm of KPMG International. PT Siddharta Consulting, a limited liability company registered in Indonesia, is a member firm of KPMG International. KPMG International is a Swiss cooperative of which all KPMG firms are members. KPMG International provides no professional services to clients. Each member firm is a separate and independent legal entity and each describes itself as such. This footnote also confirms that this e-mail message has been swept by MIMEsweeper for the presence of computer viruses. See www.mimesweeper.com for more information. ********************************************************************** ------------------------------------------------------------------------------ Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 -------------------------------------------------------------------------------
------------------------------------------------------------------------------ Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 -------------------------------------------------------------------------------
Current thread:
- Re: Secure Password Policy?, (continued)
- Re: Secure Password Policy? Alexander Klimov (Jan 19)
- Re: Secure Password Policy? Tim (Jan 21)
- Re: Secure Password Policy? Tim (Jan 21)
- "Ping scan" through Google Petr . Kazil (Jan 22)
- Re: "Ping scan" through Google -- Perl version for *NIX Peter Hille (Jan 22)
- Re: "Ping scan" through Google Robert Wesley McGrew (Jan 22)
- Re: "Ping scan" through Google pagvac (Jan 23)
- Re: Secure Password Policy? Tim (Jan 21)
- Re: Secure Password Policy? Neil (Jan 20)
- Re: Secure Password Policy? David M. Zendzian (Jan 22)
- Re: Secure Password Policy? Brian Anderson (Jan 22)
- Re: Secure Password Policy? bf (Jan 21)
- Re: Secure Password Policy? bf (Jan 21)
- RE: Secure Password Policy? Mark Atherton (Jan 19)
- Re: Secure Password Policy? intel96 (Jan 22)
- Re: Secure Password Policy? DMORROW5 (Jan 19)
- RE: Secure Password Policy? Jarmon, Don R (Jan 19)
- Re: Secure Password Policy? Sean Earp (Jan 22)
- FW: Secure Password Policy? Mike Harlan (Jan 20)
- Re: FW: Secure Password Policy? Rurouni Alucard Kawarami Himura (Jan 22)
- RE: FW: Secure Password Policy? Erin Carroll (Jan 23)
- Re: Secure Password Policy? Thor (Hammer of God) (Jan 23)
- Re: FW: Secure Password Policy? Rurouni Alucard Kawarami Himura (Jan 22)
(Thread continues...)
- Re: Secure Password Policy? Alexander Klimov (Jan 19)