[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 29 Mar 2012 04:38:57 +0400
From: Solar Designer <solar@...nwall.com>
To: john-dev@...ts.openwall.com
Subject: Re: GSoC non-hash office documents
Hi Mike,
On Wed, Mar 28, 2012 at 11:23:48AM -0600, Mike Wing wrote:
> I'm rather interested in working on some of the non-hashes for GSoC.
> Specifically
> the Office ones that popped up recently. Just doing a rudimentary search,
> the MS office format (up to 2003) using XOR and RC4 appears to be fairly
> compromised and exploitable as outlined in this paper
> http://eprint.iacr.org/2005/007.pdf. And this has been further developed by
> a french researcher (here:
> http://www.esiea-recherche.eu/data/filiol_pacsec.pdf). I would like to work
> on bringing these features to JtR.
How would these fit in with JtR, in terms of reuse of existing code,
user interface, documentation, etc? I think that they won't. So far,
JtR has been primarily a tool to generate candidate passwords (including
in some smart ways) and to test those against various thing (including
in efficient ways). So that's what within scope for Office documents as
well. Other kinds of attacks on Office documents (or whatever) are
currently out of scope. I imagine that at some point in distant future
we might choose to bundle all sorts of things with/in JtR, but there's
little technical reason to do that. It would be like moving from
developing a consistent program to maintaining a distribution of various
tools grouped only by purpose. Maybe it'd make sense for "marketing"
eventually - making JtR more of a Swiss army knife than it currently is -
but for now we have plenty of tasks more closely related to JtR's
current code base and functionality, so we'd rather focus on further
advances in that area. I also touched on this general topic here:
http://www.openwall.com/lists/john-dev/2012/03/24/2
As you can see, Dhiru has already started work on having JtR test
candidate passwords against Office documents - a task that is within
scope for JtR development currently. Please feel free to compete with
him (work on the same thing in parallel and try to make your
implementation better in whatever ways - source code quality, speed,
anything). Alternatively, please feel free to coordinate with him, so
that the two of you work on the task together. Finally, please feel
free to pick another sub-task instead - e.g., there's demand to be able
to crack Mac OS X keychains and FileVault with JtR, but no code for that
has been contributed so far and I'm not aware of anyone seriously
working on it at the moment. (Other tools exist for the purpose,
though, and code reuse from them is possible if licenses permit.)
Thanks,
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
