Date: Mon, 9 Jan 2006 01:38:44 +0300 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: breaking the same password stored in different format On Sun, Jan 08, 2006 at 09:49:57AM +1100, atstake atstake wrote: > I have some users who use the same password for samba, imap (cyrus), > pop3, proxy squid in Linux and also for local windows login. Not good. Some of those applications/systems use significantly weaker hashing algorithm than the others. In fact, it is possible that your IMAP/POP3 passwords are stored in plaintext - for poorly designed authentication methods such as APOP and CRAM-MD5 to work - this is something for you to look into. (If your IMAP and POP3 server(s) use /etc/shadow passwords directly, then this does not affect you.) > The passwords have both upper/lower-case characters, numbers and > meta-characters and are >8 characters in length. > > Now, if I run john against /etc/shadow This was not a part of your question, but I'll provide this advice anyway: you should really be using the "unshadow" utility included with John to combine your /etc/passwd and /etc/shadow files. Then run John on the resulting combined file. This may result in more password guesses with John's "single crack" mode. > & break a password in less than > an hour, can I make a safe assumption that the same password that is > used to authenticate users in POP3, IMAP, Samba, Proxy and Windows can > also be compromised in that exact amount of time? Given that they all > have different mechanims as to how they store passwords this should > not be possible or is it? You're right - you can't make such conclusions. However, you can reasonably expect that the same password would be cracked a lot quicker than in one hour (possibly in seconds) if you (or an intruder) would be cracking the weaker LM hashes instead (as used by Samba and Windows). Whatever password hashing method is used in your /etc/shadow (you didn't specify which one it is) is almost certainly the strongest of those used for all services you've mentioned. You can also expect to crack a lot more passwords within an hour (day, week, month - you pick it) if you attack the weaker hash types. In fact, the printable US-ASCII character space can be exhaustively searched against all of your LM hashes within just a few weeks with the current version of John (1.6.40 as of this writing) on a modern CPU, cracking almost all of the passwords. -- Alexander Peslyak <solar at openwall.com> GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598 http://www.openwall.com - bringing security into open computing environments Was I helpful? Please give your feedback here: http://rate.affero.net/solar
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.