Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sun, 30 Apr 2006 01:22:44 +0400
From: Solar Designer <>
Subject: Re:  I can't see the passwords - beginner's question - sorry

I wrote:
> >Please note that NTLM hashes are not nearly as weak as LM ones are

On Sat, Apr 29, 2006 at 12:45:47PM -0500, Dennis Olvany wrote:
> This is good to know. I never realized lm and ntlm were discreet 
> entities. I thought they were one and the same. I've seen much 
> likely-erroneous commentary based on the misunderstanding of this 
> distinction. How does ntlm compare to other hashes ...

Both LM and NTLM hashes are a lot weaker than Unix password hashes.
However, LM hashes are also a lot weaker than NTLM ones - if we compare
these two.

> with reference to over-the-wire security?

I'm not sure what you mean by this - active attacks performed against a
Windows system remotely (that is, with no ability to execute code on the
target system yet) or passive attacks capturing hashes off the wire.

For remote password guessing attacks, the only difference between LM and
NTLM hashes would be that LM ones are case-insensitive.  For hashes
captured off the wire, the difference is the same as it is for hashes
you would obtain locally.

I don't know whether a Windows system administrator has any control over
what hashes a service authenticates against.  I also don't know in what
cases and with what protocols these hashes are transmitted over the wire.

Your question would be better addressed to someone who is actually
familiar with Windows (in)security.

Alexander Peslyak <solar at>
GPG key ID: B35D3598  fp: 6429 0D7E F130 C13E C929  6447 73C3 A290 B35D 3598 - bringing security into open computing environments

Was I helpful?  Please give your feedback here:

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ