[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20051211162809.GA2521@openwall.com>
Date: Sun, 11 Dec 2005 19:28:09 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: MSSQL/SAP hashes?
Frank,
On Sun, Dec 11, 2005 at 04:48:01PM +0100, Frank Dittrich wrote:
> As a reaction to my first article regarding SAP password security,
> published in August, 2003,
> http://www.it-audit.de/assets/artikel/eigen/SAP-Passwort.pdf,
[...]
> I mentioned a patch to John the Ripper which enables cracking
> SAP passwords for CODVN B and D in my second article, published
> in Octover, 2004:
> http://www.it-audit.de/assets/artikel/eigen/SAP_Passwort_Update.pdf
>
> Unfortunately, both articles are in German.
> I didn't have the time to translate them into English, and I'm
> afraid babelfish doesn't produce useful results.
> I'm also not sure how much of what I wrote in those articles is
> on topic in this mailing list.
Although I don't know German, I had a look at your articles and I'd
appreciate your summarizing your findings on this mailing list. I think
that this is on topic, although a _lengthy_ discussion might not be
since there's no publicly available patch to John the Ripper to support
those hashes.
> I'm, however, not going to publish the patch or mention details
> about the algorithms being used.
> (I'd like to contribute work to John the Ripper, because I
> appreatiate the work done by Solar Designer and others, but I think
> publishing the patch wouldn't be a good idea.
> The reason is that it's very hard, if not impossible, to protect
> SAP password hashes against unauthorized access.
> That's why, publishing the algorithm IMO would have a disastrous
> effect on the security of SAP systems, instead of increasing the
> security by allowing the admin to discover weak passwords.)
Well, if Unix password crackers were not publicly available, most
vendors wouldn't bother implementing shadow passwords. Isn't publishing
the algorithm the only way to persuade SAP to start fixing things?
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
