FC: Cracking Microsoft Windows passwords in five seconds

[Declan McCullagh <declan () well com>]

---

X-Sender: @ (Unverified)
Message-Id: <p04330184bb439797011d@[10.0.1.4]>
From: Monty Solomon <monty () roscom com>
Subject: Cracking windows passwords in 5 seconds
Content-Type: text/plain; charset="us-ascii"

http://www.securityfocus.com/archive/1/330004


Date: 22 Jul 2003 20:37:19 -0000
From: <bugtraq () oechslin net>
Subject: Cracking windows passwords in 5 seconds

As opposed to unix, windows password hashes can be calculated in advance
because no salt or other random information si involved. This makes so
called time-memory trade-off attacks possible. This vulnerability is not
new but we think that we have the first tool to exploit this.

At LASEC (lasecwww.epfl.ch) we have developed an advanced time-memory
trade-off method. It is based on original work which was done in 1980 but
has never been applied to windows passwords. It works by calculating all
possible hashes in advance and storing some of them in an organized
table. The more information you keep in the table, the faster the
cracking will be.

We have implemented an online demo of this method which cracks
alphanumerical passwords in 5 seconds average (see
http://lasecpc13.epfl.ch/ntcrack). With the help of 0.95GB of data we can
find the password after an average of 4 million hash operation. A brute
force cracker would need to calculate an average of 50% of all hashes,
which amounts to about 40 billion hases for alphanumerical passwords
(lanman hash).

More info about the method can be found at in a paper at
http://lasecwww.epfl.ch/php_code/publications/search.php?ref=Oech03.

  Philippe Oechslin




-------------------------------------------------------------------------
POLITECH -- Declan McCullagh's politics and technology mailing list
You may redistribute this message freely if you include this notice.
-------------------------------------------------------------------------
To subscribe to Politech: http://www.politechbot.com/info/subscribe.html
This message is archived at http://www.politechbot.com/
Declan McCullagh's photographs are at http://www.mccullagh.org/
Like Politech? Make a donation here: http://www.politechbot.com/donate/
-------------------------------------------------------------------------