[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 24 Aug 2010 19:16:47 -0400 (EDT)
From: brad@...ystems.com
To: john-users@...ts.openwall.com
Subject: Re: Defcon18 "Crack Me If You Can" Complete Pot File
<snip>
> From some recent data, an Active Directory has 40000 accounts in it. The
> 2nd, 4th and 9th most common password revolve around the 3-letter months
> prepended to a string. All in all, over 5000 of the 40000 passwords have
> a month as part of the password. (Approx 12.5 %). To discount the
> fact that over 12% of the cracked hashes can be cracked with the
> following rules, is illogical:
>
> [List.Rules:KoreLogicRulesMonthsFullPreface]
> [List.Rules:KoreLogicRulesAddShortMonthsEverywhere]
> [List.Rules:KoreLogicRulesPrepend4LetterMonths]
I've seen that sort of thing as well, but only in places that have
password policies that force frequent changes (4 to 12 times per year).
Humans will devise all sorts of simple tricks to meet the policy
requirements and *still* use easily remembered passwords. Policies that
require a change every 30 days and upper, lower, numbers and special chars
that are at least 8 chars long... make for passwords such as this:
iLUVu_Jan1
iLUVu_Feb2
iLUVu_Mar3
...
<snip>
> We need to adapt our methods/tools/wordlists _NOW_ in order to
> crack these passwords. We cannot live in a cave, and assume our
> rules do not need to be changed/adapted. After doing pentests
> for 10 years, this has already been proven to me to not be beneficial.
I agree, but often wonder when some of the big vendors will catch up. I
won't mention names, but unsalted MD4? I guess the vendor has too many
external dependencies to switch now, but even in the latest version of
their OS, you still find these. Talk about living in a cave.
> This was the goal of the DEFCON contest. To get people to realize
> this fact. I do not know if the goal was reached or not. Because we
> are _still_ getting complaints about the patterns we used,
Real world patterns (I think) would have had some numeric only passwords.
I don't mean this as a criticism, only stating what I have seen. These are
common in Active Directory environments that have had complexity added
after running for a few years without complexity requirements. Most of the
time, the old accounts with the weaker passwords are still there, but the
accounts are disabled.
<snip>
> We _hope_ to do the contest again next year. And, if you think we are
> going to use
> the same old tired patterns that haven't changed in 10 years, then you
> are wrong.
> We hope to continue to push users to evolve in their
> techniques/rules/wordlists/
> hardware/scripts/formats/etc.
Thanks for the contest, I hope you do it again next year too. It was lots
of fun and beneficial.
Brad
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
