W dniu 2014-03-18 07:19, Jose Munoz pisze:
Gents,
Someone can comment on it, I received an email from an Open System college
arguing that mainframe is very weak...please help me to answer it:
"
oclHashcat v1.20 support added to crack RACF (IBM mainframe) hashes with 1
Billion (Giga) Hashes/second on a single stock clocked hd6990 graphics
card: http://pastebin.com/Cqdhe3kR
I didn't expect IBM's Mainframe password hashing to be so weak :(
In comparison, the SHA512 hash is cracked at 0.217 BH/s (GH/s) on the same
graphics card: http://hashcat.net/oclhashcat/
If you don't know what's oclHashcat, it's a program that cracks password
hashes using graphics cards (GPUs). The link above shows how many
algorithms are supported and a sample of the speed that some are cracked at
depending on the GPU setup.
"
It's perfectly knownthat one can guess RACF password using brute force
method. It only matter of time, computing power per engine, number of of
engines (*).
Last, but definitely not least: attacker has to have your RACF db.
So, the prevention is easy; at least easy to say: you have to protect
your RACF db (and all copies/backups).
So, what changed with the tools you mentioned? Another world record?
BTW: IBM announced new password encryption method in future releases.
(*) Linear scalability is good assumption for reasonably smallnumber of
engines, for tens of thousands negines things can be more complicated.
--
Radoslaw Skorupka
Lodz, Poland
---
Tre tej wiadomoci moe zawiera informacje prawnie chronione Banku
przeznaczone wycznie do uytku subowego adresata. Odbiorc moe by jedynie
jej adresat z wyczeniem dostpu osób trzecich. Jeeli nie jeste adresatem
niniejszej wiadomoci lub pracownikiem upowanionym do jej przekazania
adresatowi, informujemy, e jej rozpowszechnianie, kopiowanie, rozprowadzanie
lub inne dziaanie o podobnym charakterze jest prawnie zabronione i moe by
karalne. Jeeli otrzymae t wiadomo omykowo, prosimy niezwocznie
zawiadomi nadawc wysyajc odpowied oraz trwale usun t wiadomo
wczajc w to wszelkie jej kopie wydrukowane lub zapisane na dysku.
This e-mail may contain legally privileged information of the Bank and is
intended solely for business use of the addressee. This e-mail may only be
received by the addressee and may not be disclosed to any third parties. If you
are not the intended addressee of this e-mail or the employee authorized to
forward it to the addressee, be advised that any dissemination, copying,
distribution or any other similar activity is legally prohibited and may be
punishable. If you received this e-mail by mistake please advise the sender
immediately by using the reply facility in your e-mail software and delete
permanently this e-mail including any copies of it either printed or saved to
hard drive.
mBank S.A. z siedzib w Warszawie, ul. Senatorska 18, 00-950 Warszawa, www.mBank.pl, e-mail: [email protected]
Sd Rejonowy dla m. st. Warszawy XII Wydzia Gospodarczy Krajowego Rejestru Sdowego, nr rejestru przedsibiorców KRS 0000025237, NIP: 526-021-50-88. Wedug stanu na dzie 01.01.2014 r. kapita zakadowy mBanku S.A. (w caoci wpacony) wynosi 168.696.052 zote.
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
