Date: Sun, 11 Dec 2005 19:28:09 +0300 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: MSSQL/SAP hashes? Frank, On Sun, Dec 11, 2005 at 04:48:01PM +0100, Frank Dittrich wrote: > As a reaction to my first article regarding SAP password security, > published in August, 2003, > http://www.it-audit.de/assets/artikel/eigen/SAP-Passwort.pdf, [...] > I mentioned a patch to John the Ripper which enables cracking > SAP passwords for CODVN B and D in my second article, published > in Octover, 2004: > http://www.it-audit.de/assets/artikel/eigen/SAP_Passwort_Update.pdf > > Unfortunately, both articles are in German. > I didn't have the time to translate them into English, and I'm > afraid babelfish doesn't produce useful results. > I'm also not sure how much of what I wrote in those articles is > on topic in this mailing list. Although I don't know German, I had a look at your articles and I'd appreciate your summarizing your findings on this mailing list. I think that this is on topic, although a _lengthy_ discussion might not be since there's no publicly available patch to John the Ripper to support those hashes. > I'm, however, not going to publish the patch or mention details > about the algorithms being used. > (I'd like to contribute work to John the Ripper, because I > appreatiate the work done by Solar Designer and others, but I think > publishing the patch wouldn't be a good idea. > The reason is that it's very hard, if not impossible, to protect > SAP password hashes against unauthorized access. > That's why, publishing the algorithm IMO would have a disastrous > effect on the security of SAP systems, instead of increasing the > security by allowing the admin to discover weak passwords.) Well, if Unix password crackers were not publicly available, most vendors wouldn't bother implementing shadow passwords. Isn't publishing the algorithm the only way to persuade SAP to start fixing things? -- Alexander Peslyak <solar at openwall.com> GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598 http://www.openwall.com - bringing security into open computing environments
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.