Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

Post reply on HN
Print view View original

481–490 of 665 posts

Re: Ken Thompson's Unix Password

#481

Post by milchek »

whalesalad wrote: post #400

I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…

I wish my story was as cool and involved some technical expertise.

In year 10, a friend of mine saw our school network admin type the admin password in (he used his index fingers and typed in each character one at a time like someone with very little typing experience - this was 1998)

Anyway, I used this info to log in as the admin and I promptly deleted all of the student accounts in the school. Students around me immediately started complaining they couldn’t log in or access their assignments.

It was a stupid and immature thing to do.

Guess it’s a good reminder and lesson that you should always be careful who is watching you over your shoulder.

Re: Ken Thompson's Unix Password

#482

Post by [deleted] »

anaphor wrote: post #469
boomlinde wrote: post #349

Earlier quoted context omitted.

A decent email client will display these as a foldable hierarchy, sort of like HN or Reddit's posting interface, just with the body of the posts hidden. With that and full text search it's not so hard. It's the web interfaces that are a bit bulky.

A lot of them will use an algorithm similar to this one https://www.jwz.org/doc/threading.html

[deleted]

Re: Ken Thompson's Unix Password

#483

Post by neotek »

whalesalad wrote: post #400

I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…

Our high school network ran on Novell NetWare, but I wasn't anywhere near smart enough to crack anything so I just wrote a little program in QBASIC that looked like the NetWare login prompt which rejected all login attempts but dumped what was entered into a text file, and left it running on one of the PCs in the computer room. It wasn't even a compiled program, it was just running inside QBASIC's IDE.

Yet it was running for three days before the admin got around to checking the machine, and all he did was try to log in, failed, and rebooted the machine — bringing it back to the real NetWare login screen. I got his password and pretty much everybody else's too, and to this day, more than 20 years later, I still use bits of his admin password from time to time when I'm creating temporary accounts.

Re: Ken Thompson's Unix Password

#484

Post by zerocrates »

tomc1985 wrote: post #462
blackflame7000 wrote: post #446

Earlier quoted context omitted.

Yea historically the SAM file on windows has always been a weak spot because of its NTLM hashing scheme. By breaking passwords larger than 7 letters into multiple sub-password hashes it virtually guaranteed rainbow tables would destroy its security.

Out of curiosity, why did they do this? Was hashing super computationally expensive when NTLM first appeared (NT 3.51 I think?)

The "split into 7s" thing is from LM, which goes back to the OS/2 days... and it uses DES, which operates with 56-bit keys: 7 8-bit characters. Old DES-based crypt() has a similar limit: 8 7-bit characters.

NT hashes use MD4, which wasn't invented until 1990.

Re: Ken Thompson's Unix Password

#485

Post by FroshKiller »

saagarjha wrote: post #316
mywittyname wrote: post #268

Earlier quoted context omitted.

If I had a key logger on your system, I'd just try; 9A4jc@23 Bam. Access granted.

If you had a keylogger, it wouldn't really matter how good your authentication scheme is…

Keyloggers aren’t very useful when authentication uses TOTPs from a hardware token.

Re: Ken Thompson's Unix Password

#486

Post by elahieh »

elahieh wrote: post #474

ZghOT0eRm4U9s is actually the newer one, the older one is from 2.9BSD, through to 4.3BSD https://www.openwall.com/presentations/Passwords12-The-Futur... sq5UDrPlKj1nA Seeing this news, I guessed this one on my second guess (after trying p/q2-q4!) - no brute forcing required! p/k2-k4!

Oops - I have it the wrong way around. 2.9BSD came out after 3BSD.

Re: Ken Thompson's Unix Password

#488

Post by soperj »

minikites wrote: post #436
lordlic wrote: post #429

Earlier quoted context omitted.

I was expelled from university for pulling off the exact same exploit with the "workstation only" feature in Novell. In my case, they put a computer in every dorm room, and every single one of them had a domain-wide administrator account cached in its SAM file. It was inevitable that a student would find it. It's been almost 15 years now but I believe the password was rac3c4r or something trivial like that. I ran Oph…

>I never once used it for evil: never read anyone's email, never viewed anyone's private files, never poked around the academic file shares for test solutions, never tried to steal credit card numbers or social security numbers from the finance office's file share. I don't understand this justification. The system owners can't know that to be true and have to proceed as if the systems are compromised. Would you still…

It was clearly an illusion of safety to begin with if they broke in. At that point you're at least informed, and it didn't cost you anything.

Re: Ken Thompson's Unix Password

#489

Post by lordlic »

zippergz wrote: post #472
lordlic wrote: post #429

Earlier quoted context omitted.

I was expelled from university for pulling off the exact same exploit with the "workstation only" feature in Novell. In my case, they put a computer in every dorm room, and every single one of them had a domain-wide administrator account cached in its SAM file. It was inevitable that a student would find it. It's been almost 15 years now but I believe the password was rac3c4r or something trivial like that. I ran Oph…

Do you know how they ended up finding out about it and catching you?

Yeah. My technical tracks were covered. It was the roommate of one of my friends. He overheard me talking about it and ratted me out.

Re: Ken Thompson's Unix Password

#490

Post by Mirioron »

ambicapter wrote: post #468
loeg wrote: post #452

Earlier quoted context omitted.

Yes, a good defense against a charge of burglary would be not having stolen anything. In an imaginary perfect criminal justice system, charges/penalties are based on damage done. Less damage done is a lesser crime.

> In an imaginary perfect criminal justice system, charges/penalties are based on damage done. Hell no. Otherwise you could just set up one gigantic crime by comitting a bunch of small "no damage done" crimes along the way-say, stealing a string of credentials one at a time, but not actually using them until you have all of them together and then you commit your major heist/crime.

Lesser punishment doesn't mean no punishment. Furthermore, you can always argue that the intent is to commit a major crime.
Post reply on HN