Ken Thompson's Unix Password

Post by SCHiM » Thu, Oct 10, 2019, 12:06 PM UTC

outworlder wrote: post #335

Thrymr wrote: post #229

Earlier quoted context omitted.

30 years ago you could just sniff the passwords on the local subnet because everyone was using telnet and ftp in the clear.

20 years ago you could also sniff passwords for all Windows users in the same subnet as you. Windows used the NTLM scheme which was known to be weak even back then. An AMD K6 running overnight cracked almost all of them at my university's lab, including the Active Directory domain admin.

Post by dual_basis » Thu, Oct 10, 2019, 12:10 PM UTC

lazyasciiart wrote: post #570

ambicapter wrote: post #468

Earlier quoted context omitted.

> In an imaginary perfect criminal justice system, charges/penalties are based on damage done. Hell no. Otherwise you could just set up one gigantic crime by comitting a bunch of small "no damage done" crimes along the way-say, stealing a string of credentials one at a time, but not actually using them until you have all of them together and then you commit your major heist/crime.

Well, the imaginary perfect criminal justice system would probably arrest you right as you had completely committed to causing the damage, instead of afterwards. But it should still be justifying the arrest based on the act that caused damage, not the harmless acts that set you up to be ready to do it.

Post by nguoi » Thu, Oct 10, 2019, 1:41 PM UTC

wjp3 wrote: post #422

iblaine wrote: post #210

This brings back memories of a common exploit w/tftp, such that you could download an unshodowed /etc/passwd file from a remote machine, decrypt it, log into that remote system, collect new hosts from /etc/hosts, then rinse and repeat. Hash rate were pretty slow back then, but the fact that people used passwds straight out of dictionaries helped, so I'm told...

Better yet, open the /etc/passwd and see the root user's password wasn't set... Back in college I ran ToneLoc overnight and would try ftp on the successful hits. One server didn't have root set, so I telnet'ed, when prompted for the password, and I was in. I ran 'who', saw a user logged in. Decided to wall them a message of "You should really set your root password." and logged out. A couple of days later, I got an e…

Post by mettamage » Thu, Oct 10, 2019, 1:55 PM UTC

socceroos wrote: post #597

jakobegger wrote: post #581

Earlier quoted context omitted.

I think that if someone boasts that they've cracked everyones password, reporting them is the right thing to do.

Perhaps the discretionary thing to do in the case where the perpetrator is relatively whitehat is to mention to IT that "it appears common knowledge that all admin passwords are compromised" without exposing their identity.

Post by philpem » Thu, Oct 10, 2019, 2:04 PM UTC

a3n wrote: post #203

lolc wrote: post #147

Earlier quoted context omitted.

Want better password hygiene in the workplace? Encourage rude passwords!

Password rule N+1: "A password must contain at least one word from our list of banned URLs." At a former job I could not go to one of global corp Tata sites, because tata.