Date: Tue, 24 Aug 2010 19:16:47 -0400 (EDT) From: brad@...ystems.com To: john-users@...ts.openwall.com Subject: Re: Defcon18 "Crack Me If You Can" Complete Pot File <snip> > From some recent data, an Active Directory has 40000 accounts in it. The > 2nd, 4th and 9th most common password revolve around the 3-letter months > prepended to a string. All in all, over 5000 of the 40000 passwords have > a month as part of the password. (Approx 12.5 %). To discount the > fact that over 12% of the cracked hashes can be cracked with the > following rules, is illogical: > > [List.Rules:KoreLogicRulesMonthsFullPreface] > [List.Rules:KoreLogicRulesAddShortMonthsEverywhere] > [List.Rules:KoreLogicRulesPrepend4LetterMonths] I've seen that sort of thing as well, but only in places that have password policies that force frequent changes (4 to 12 times per year). Humans will devise all sorts of simple tricks to meet the policy requirements and *still* use easily remembered passwords. Policies that require a change every 30 days and upper, lower, numbers and special chars that are at least 8 chars long... make for passwords such as this: iLUVu_Jan1 iLUVu_Feb2 iLUVu_Mar3 ... <snip> > We need to adapt our methods/tools/wordlists _NOW_ in order to > crack these passwords. We cannot live in a cave, and assume our > rules do not need to be changed/adapted. After doing pentests > for 10 years, this has already been proven to me to not be beneficial. I agree, but often wonder when some of the big vendors will catch up. I won't mention names, but unsalted MD4? I guess the vendor has too many external dependencies to switch now, but even in the latest version of their OS, you still find these. Talk about living in a cave. > This was the goal of the DEFCON contest. To get people to realize > this fact. I do not know if the goal was reached or not. Because we > are _still_ getting complaints about the patterns we used, Real world patterns (I think) would have had some numeric only passwords. I don't mean this as a criticism, only stating what I have seen. These are common in Active Directory environments that have had complexity added after running for a few years without complexity requirements. Most of the time, the old accounts with the weaker passwords are still there, but the accounts are disabled. <snip> > We _hope_ to do the contest again next year. And, if you think we are > going to use > the same old tired patterns that haven't changed in 10 years, then you > are wrong. > We hope to continue to push users to evolve in their > techniques/rules/wordlists/ > hardware/scripts/formats/etc. Thanks for the contest, I hope you do it again next year too. It was lots of fun and beneficial. Brad
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.