Re: cracking - Re: See what a weak password will get ya?
On Thu, 22 Jul 2004, s. keeling wrote: Incoming from Alvin Oga: - and hopefully, they don't have the passwd file from /etc/shadow to compare against Agreed. Once they're in, all bets are off. best to assume they are already in and sniffing .. 24x7 and work knowing they can pick up info from their hidden special directory - if you write a single a into /tmp/a.txt the other 511 bytes is available for a secret filesystem ( lots of unused disk space available for hiding ( that regular tools will never find these constantly changing ( hidden files Why bother to crack if you can sniff? but they and anybody can sniff ??? and yes ... 10x easier to sniff and maybe even get lucky and get the passwd to all their machines at work too - sniff your boxes at the colo ... ( lots of wrong masks being set, to be able to sniff other ( machines - sorta illegal to sniff ?? - sniff the wireless connection ... 1/2 the wireless network is not encrypted, so hopefyully, they are least using ssh for all data transfers ( good for tricking a few people to hang around longer ( to see what they're sniffing on an unencrypted wep traffic - kimet + ethereal .. see your neighbor's data c ya alvin -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
cracking - Re: See what a weak password will get ya?
On Thu, 22 Jul 2004, s. keeling wrote: I disagree. A cracking program is going to attempt to match permutations of dictionary words. This will not add much more time to ... how fast can a cracking system go thru dictionary words that are mispelled with various digits and special char - changing o to 0 ( and equivalents ) wont slow down the crackers - brute force cracking will take 60**8 permutations (1.7x10**14) :-) ( a-z A-Z 0-9 30special chars ) - a small number of permutations by math standards - but NOT all character positions will be special random characters which than simplifies the possible permutations if you can think of these modified passwd, a good cracking program should already be checking for it too :-) -- a trick question ... how does the cracker know that they hit the right passwd ?? - they cant be logging into your box for each try - your box should be denying remote access after 3-5 failed login attempts - and hopefully, they don't have the passwd file from /etc/shadow to compare against However, if you haven't moved to RSA based longer passwords, that's effectively x[([EMAIL PROTECTED]) (which isn't bad, but you may be typing more than is recognized). Stock passwords are eight chars. The rest are ignored. it seem like some systems uses more than 8char pwd and others ignore the balance .. c ya alvin -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: cracking - Re: See what a weak password will get ya?
Incoming from Alvin Oga: - and hopefully, they don't have the passwd file from /etc/shadow to compare against Agreed. Once they're in, all bets are off. Why bother to crack if you can sniff? -- Any technology distinguishable from magic is insufficiently advanced. (*) http://www.spots.ab.ca/~keeling - - -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
