[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20060108223844.GA27568@openwall.com>
Date: Mon, 9 Jan 2006 01:38:44 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: breaking the same password stored in different format
On Sun, Jan 08, 2006 at 09:49:57AM +1100, atstake atstake wrote:
> I have some users who use the same password for samba, imap (cyrus),
> pop3, proxy squid in Linux and also for local windows login.
Not good. Some of those applications/systems use significantly weaker
hashing algorithm than the others. In fact, it is possible that your
IMAP/POP3 passwords are stored in plaintext - for poorly designed
authentication methods such as APOP and CRAM-MD5 to work - this is
something for you to look into. (If your IMAP and POP3 server(s) use
/etc/shadow passwords directly, then this does not affect you.)
> The passwords have both upper/lower-case characters, numbers and
> meta-characters and are >8 characters in length.
>
> Now, if I run john against /etc/shadow
This was not a part of your question, but I'll provide this advice
anyway: you should really be using the "unshadow" utility included with
John to combine your /etc/passwd and /etc/shadow files. Then run John
on the resulting combined file. This may result in more password
guesses with John's "single crack" mode.
> & break a password in less than
> an hour, can I make a safe assumption that the same password that is
> used to authenticate users in POP3, IMAP, Samba, Proxy and Windows can
> also be compromised in that exact amount of time? Given that they all
> have different mechanims as to how they store passwords this should
> not be possible or is it?
You're right - you can't make such conclusions. However, you can
reasonably expect that the same password would be cracked a lot quicker
than in one hour (possibly in seconds) if you (or an intruder) would be
cracking the weaker LM hashes instead (as used by Samba and Windows).
Whatever password hashing method is used in your /etc/shadow (you didn't
specify which one it is) is almost certainly the strongest of those used
for all services you've mentioned.
You can also expect to crack a lot more passwords within an hour (day,
week, month - you pick it) if you attack the weaker hash types. In
fact, the printable US-ASCII character space can be exhaustively
searched against all of your LM hashes within just a few weeks with the
current version of John (1.6.40 as of this writing) on a modern CPU,
cracking almost all of the passwords.
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments
Was I helpful? Please give your feedback here: http://rate.affero.net/solar
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
