Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Insecurity of weak passwords
Options
-
29-01-2004 5:31pm#1Work dragging once again, so I'll jump for access control to something more higher up the security scale, weak passwords.
Take for example the following:
Subject(a) has a hardened operating system implementing every possible security policy and security extension.
Subject(b) has a poorly misconfigured operating system.
Subject(a)'s credentials for login to the highest level is: subjecta::test
Subject(b)'s credentials for login to the highest level is: subjectb::zxxrtt04
We will take into account, both subjects use the same operating system and have the same services running. Both subjects have chosen to encrypt their password using MD5.
Let's consider a p.o.c (proof of concept) is released for a flaw in a given ftpd; for our scenario, we will call it wu-ftp
Our attacker exploits both systems and grabs the respective credential file from both systems. Both files hold the usernames & MD5 encrypted passwords.
Both subjects ignorantly feel confident in the security of the credentials encryption algorithm. In theory, they should both worry, but subject(a), far more than subject(b). I will outline the reason behind this.
Because MD5 hash values can be easily generated, we can compare a wordlist full of MD5 generated hash values (looped), to that of the password. I have scripted an example script in PHP to prove how easy this can be done.
It would be a matter of milliseconds before we cracked the MD5 hash of subject(a) and compromised his otherwise secure system. Subject(b)'s credential file would be a much harder task to crack. "Almost" impossible.
And thus, the reason to choosing strong passwords.0
Comments
-
Originally posted by dlofnep
Subject(a) has a hardened operating system implementing every possible security policy and security extension.
Subject(b) has a poorly misconfigured operating system.
Subject(a)'s credentials for login to the highest level is: subjecta::test
Subject(b)'s credentials for login to the highest level is: subjectb::zxxrtt04
Let's consider a p.o.c (proof of concept) is released for a flaw in a given ftpd; for our scenario, we will call it wu-ftp
Our attacker exploits both systems and grabs the respective credential file from both systems. Both files hold the usernames & MD5 encrypted passwords.
Both subjects ignorantly feel confident in the security of the credentials encryption algorithm. In theory, they should both worry, but subject(a), far more than subject(b). I will outline the reason behind this.
It would be a matter of milliseconds before we cracked the MD5 hash of subject(a) and compromised his otherwise secure system. Subject(b)'s credential file would be a much harder task to crack. "Almost" impossible.
And thus, the reason to choosing strong passwords.
Strong passwords are important but for different reasons than detailed above. If your system allows someone access to the hash file then it is only a matter of time before your password will be cracked.
Surely subject(a) is not doing his job properly if the vulnerability which allows the exploit is there and he still considers his system to be adequately secure. Subject(b) is not doing the job of securing his system so the strength of his password system is nearly irrelevant.
Neither administrator understands security if blanket password changes are not stringently enforced after the hash values for the system have been stolen.
Have I missed the point? Why does this feel like a college exam all of a sudden?0 -
Yes, you have missed the point
The proof of concept was released (0-day), so in theory, both administrators could not of doing anything to prevent it as they both needed to run their ftpd.
The point I was trying to make was that, even though subject(a) had taken security precautions, his lazyness to construct a stronger password would mean that his system was just as compromisable as subject(b) who had no security precautions taken other than a strong password.0 -
-
-
-
Advertisement
-
well, if he doesn't have root, then how can he view the md5 encrypted passwords, surely /etc/passwd is shadowed to /etc/shadow, am i missing the point? you must be root to view /etc/shadow, surely no other group is allowed to.... so you view /etc/shadow and de-shadow it and you have the md5 encrypted passwd file... but you must be root... non?
and you did say services were running, you said the attacker exploits a vuln in the washington university ftp daemon, christ why would anyone run such a thing the first place
0 -
-
-
-
-
Advertisement
-
-
-
Moderators, Recreation & Hobbies Moderators, Science, Health & Environment Moderators, Technology & Internet Moderators Posts: 90,802 Mod ✭✭✭✭
Join Date:Posts: 89042
Unfortunately if you have a corporate networks you are stuck with windows (give them all Gigabit cards and PXE bootOriginally posted by WizZard
This is true, but then again, if you really care about security, why use Windows?
And AFAIK this is fixed in the newer versions of Windows that use NTLMv2 as default, which is not vulnerable to this(?) (Not sure about this) ) and as long as there is one user with 98 you are stuck with the old version.. And M$ have decided to support 98 for another year. 0 -
-
-
Moderators, Recreation & Hobbies Moderators, Science, Health & Environment Moderators, Technology & Internet Moderators Posts: 90,802 Mod ✭✭✭✭ Join Date:Posts: 89042
chronic
could be beaten by a dictionary of Irish words
most password crakers use a-z,A-Z, 1-9 and then some other characters.
Putting a fada on it would have been much better )you do have Irish keyboard setup etc.) eg: Chónaìc.
But since it is made of phonetic bits (what is that word called - syllables) chonaic could be broken by a syllable list (modded to take into account us irish have more different word bits than other english speakers hiberno english ?)
psy - psi - psud - air / eire / ayre / ere etc.
BTW: if you wern't invited to test the passwords you could be done for invasion of privacy since at one stage 80% of passwords were girls forenames. 0 -
-
The security of a system is only as strong as the weakest link.
Problem is that it is difficult to know what the weakest link is.
This is why the idea of "security in layers" is used i.e. using some sort of
redundancy that compliments the existing security.
In this case we're talking about MD5 hashes on password files.
If the "security in layers" approach was used then subject(b) would most likely
require at least 2 things to login.
(authentication being based on one or more of: what you know (e.g. password), have (token), or are (biometric))
So even if the bad guy had his password he couldn't logon to his system.
That's not to say he couldn't access it - since clearly he already has in order to get the password file.
If subject(b) was so security conscious then he would also probably be aware of recent research into vulnerabilities in the MD5 algorithm, or how easy it is to
capture someones password with a keylogger, etc...
Taking the "security in layers" approach a step further, subject(b) would be less worried if he also had effective detection and correction mechanisms as well as prevention e.g. did regular backups, had all his sensitive stuff encrypted, had a good security policy. etc...
Basically, subject(b) should look at the security of his system from the point of view that someone can gain access to it and implement his security accordingly: limiting what the bad guy can do once he has access and ensuring a speedy recovery. If his security countermeasures are preventitive only then some day he'll regret it.
In Subject(a)'s defense maybe he did do his due diligence and concluded that the cost of security outweighed what he was trying to secure? So maybe he wasn't at
all worried 0 -
Crashedmind, it was a rhetorical scenario; the scenario itself was not important
Meanwhile, back at the cave, what I was trying to get across was how easily a crendential can be manipulated into a valid string comparison in which would determine the strength of a given password.0 -
-
Advertisement
-
-
Advertisement