Slashdot Mirror
Crack a Password, Save Norwegian History
Christian writes "With the death of the only person who knew the password to an archive held at a museum in Norway, suddenly the data became inaccessible. The result? A nationwide radio appeal asking for "hackers" to volunteer to help solve the problem! The
Norway Post has the story." I wonder if they looked under his keyboard yet..
Mesenger: John is Dead!
Meseum: (in sync) Ahhh, he was a lovely fellow, never bothered a soul... wonderful guy... absolutely great...
Mesenger 2: He was the only one who knew the password to the history archive!
Mesuem: That F&%cker! How dare he die... mother f%#cking asshole!
Messenger 2: Hey... don't kill the messenger!
5. Juni 2002
Hackers respond to password challenge
Hackers have responded in large numbers to an appeal from the director of a culture center and literary museum on the west coast of Norway.
The password to one of their library archive systems is missing.
The museum built in honour of the famous Norwegian linguist Ivar Aasen received a gift of more than 1600 books and documents which had been catalogued and registered in a national data bank, which researchers and interested people may access.
Only trouble was that the expert who had helped the donor with the archiving work had died, and had failed to pass on the password.
In order to get access to the data base, Director Ottar Grepstad appealed on nationwide radio for help to solve the problem.
The response was above expectations, and the director is now busy chosing the expert most likely to solve the problem.
(NRK)
(this loaded very slow, but I got it.)
The truth shall set you free!
I've already cracked it. Got the archives open right here. Let's see:
In the year 1005, the 1337 v1k0rs raided the English coast for raping and pillaging...
I have been thinking about this for a while. If I died suddenly, from the view of the online community, I would just disappear. No one would know to contact them. Most people would forget, or never notice, but some should really be contacted. Now I'm thinking I should make a list and put it on my hard drive to be found, (right next to the prOn) and have instructions on who needs informing.
120 chars of filth!
...this only happens in Norway :)
Norwegian for "password" is "passord".
I wonder if they've tried that already...
--
This is an interesting issue. Any -minimally skilled- IT operator knows he should never tell passes to other people. But, what if this person dies? How can we safely store passwords so that those can be retrieved if "shit happens"? Probably we cannot use encription (you need a pass to decrypt stuff), so what? Probably for most of us, a piece of paper in a safe place at home is enough, hackers *usually* do not break-in to get passwords. But I guess there is people around protecting *really* important data, and they do not trust anyone... what can they do to make passwords "undiscoverable" until "death" or sudden amnesy?
:dikappa
common utilities
1) tar
2) ar
3) grep
4) ps
and not so common
5) rep (well its installed on my system, but I'd never heard of it, further investigation reveals it to be a standalone lisp interpretter from the librep package (see "info librep", I am indeed learning something new every day))
A little info:
The database is from Dbase 4, I don't know how the security is on that format. It contains data about the norwegian linguist Ivar Aasen. For those interested in giving it a try, just search on norwegian pages to find the directors email address (name in another post). He's received quite a few emails already... (No, won't give the address here, pity the one who gets his email published on Slashdot).
Please excuse crappy english, save your grammatic flames.
Are you a grammar Nazi? I'm trying to improve my English; please correct my errors!
Netcraft.com:
The site www.norwaypost.com is running Microsoft-IIS/4.0 on NT4/Windows 98.
Sad, isn't it?
Anyway, two ways to attack this problem: brute force it or be clever and see if this can be done by social engineering. If there are any people that know him well enough they might. Otoh, the way I choose passwords it might be tough even when people know me.
I remember this story about a similar incident a long while back. Somebody encrypted a file using a new algorithm and couldn't believe how fast that went. To verify the speed he then proceeded to encrypt the backup too and forgot _both_ passwords. This was a long time ago and to this day I don't believe it but the moral of the story is: keep an unecrypted version in an off-line, off-site backup medium in a vault for digital media in duplicate.
Karma? What's that again?
If it was american history, it would probably be shorter than the password.
RMN
~~~
I wish I could help, but I do intend to travel to the US at some later time in my life, and I don't want to be arrested for circumventig a protection device or something... Boy, do you americans have stupid laws...
free the mallocs!
Use HTML and make sure the posting mode is set to "Plain text" or "HTML formatted":
<A HREF="http://slashdot.org/">this is a link</A>
...becomes
this is a link
RMN
~~~
A simple program... something to send that important email, decrypt the data that you honestly don't have to safeguard anymore, etc. A program to take action when you haven't proven (password | biometric | whatever...) your continued existance on a pre-arranged schedule.
And wouldn't you know it, one exists!
I caught this discussion at Ars Technica last month. It refers to a cool-sounding program called "Dead Man's Switch (DMS)", which caught the attention of the New York Times.
Just a few issues...
- Don't go on vacation for a longer period of time than you have the 'bot set for
- What happens when you actually do pass on to the great unknown, don't manage to pay your bills, and your (ISP | power company | shell host) kills your service?
- Or, more simply, what if your next of kin just tag the 'ol power switch?
Oh well... no person (or thing!) is perfect. Norway is keenly aware of this right now.(see either link, "If you're reading this, I'm dead!" type goofs have happened!)
"...America's great minds of today, teaching America's great minds of tomorrow. Poor bastards." -- A Beautiful Min
After seeing the interest in for example the RC5-56 challenge and others, it is a fact that there is a huge amount of people interested in participating in things like this. Maybe a distributed computing project, willing and open to take any (non criminal) tasks would not be that bad idea afterall. If there would be volunteers for building the crunching code using API provided, it would be possible to run projects with quite short lifecycle. I don't see SETI and RC5-56 and similar projects very interesting anymore. The task should be clear, reasonable and the estimated brute forcing time should be reasonable (like in 3 months maximum.) A dozen of little tasks per year, might prove more interesting.
:) and in this case probably no distributed brute forcing is needed - just the plain old crackerjack should do. :) .
Anyway, in this particular case, and 99% of others, the password is "IAmGod"
Crack a password, save history.
Get a cable modem, go to jail. [slashdot.org].
What kind of crazy backwards world are we living in?
Ladies and Gentlemen of slashdot it does not make sense. If Chewbacca lives on Endor you must acquit.
Twice in recent years I've had the unhappy task of attempting to recover password protected personal files created by friends who have died. In each case the files contained financial information that the next of kin needed.
While password security is undoubtedly a good thing, it goes a bit beyond its remit if it locks out the wrong people. In most jobs I've had it has been common practice to keep hardcopies of passwords in sealed and signed envelopes placed in safes. While this is probably overkill for home users it's worth considering doing something like this for your family or friends and letting them know about it. Especially if you're someone I know. I really, really don't want to have to go through this again.
I would be a paid subscriber if Taco and Hemos weren't such cunts
...if the European version of the DMCA is passed, this would be an illegal act, likely to get the participant thrown in jail. Just to generalize, if the system is used commercially as a copy protection scheme by anyone, it would immediately fall under the category of "circumventing a copy protection device" by "cracking" it.
Of course, I am sure those in charge would happily my exceptions to this rule when it suits them. Still, this could be a great opportunity to speak out against such legislature.
Why bother.
When they do crack the files, they'll just find his grocery lists.
Mod Karma -1: I sed bad wurds. If I cep my mouf shut, I wud be at riyses.
Well? What's the URL so we can all try it? They gotta trust me, I'm swedish! ;-)
A-ha! I knew that was you Mr. Ashcroft!!
I've put the contact details of who should take over the stuff I run (and the required passwords) in my testament. The only hassle is updating it regularly.
They are lucky that this unfortunate employee was not using biometrics to protect the archive.
This is actually a pretty serious issue with any kind of system where only one person has the password.
The ISP I once working for nearly went out of business several years back because the only tech with high level access was in a serious car accident and out of action for a month or so.
Its all very well not writing down passwords, and saying that nothing is going to happen to you, but in the real world, people get ill, run over, fall down etc. - In large companies its more then likely not a problem, but in a small company that has only one tech person doing everything, people need to make sure there is a plan of action for if that person becomes unreachable for any reason.
I saw the light at the end of the tunnel... But it was just someone with a flashlight bringing more work.
"But Your Honor, I had to load all that pirated software on my machine. Norweigan history was at stake!"
------
Today's Top Deals
The National Centre of the New Norwegian Language and Culture
The New Norwegian Language
Ivar Aasen
Roses are #FF0000, violets are #0000FF, all my base are belong to you
But I bet he had a dog, it just died during his Viking funeral and can't tell us it's name any more.
If dogs name does not work use "Override".
Eve Fairbanks says I drive a hybrid!LOL
Guess who's become the latest poster child for password escrow?
It's supposed to be completely automatic, but actually you have to press this button.
...with explicit instructions to ignore the porn, anti-company propaganda, and other contraband they find in your accounts ;)
I can see it now... "Hacker saves museum database, is charged under DCMA"
Of course, then the RIAA would sue them, just because they can.
Dark Nexus
"Sanity is calming, but madness is more interesting."
What's norwegian for "password"?
blahblah Lameness filter is itself lame... ironic...
Just wait till some crappy band steals your nic.
Did they try "1,2,3,4,5"?
"That's the combination for my luggage!"
I really hate signatures, but go to my website.
Days ago, Ottar Grepstad, director of the culture center and literary museum on the west coast of Norway, was busy selecting his expert of choice to hack a password known only by a dead man. It has been revealed that only minutes after his public appeal for a skiller hax0r to recover this password, his archive was ow3nd by Kevin Mitnick. The notorious hacker released information found in the archive that seems to indicate that Britney Spears was concieved by using frozen sperm from non other than Mike Tyson himself. The egg donor was only referred to in the archive as "Camilla" and it is suspected she is the same woman that Prince Charles is dating.
I'll rant a bit (it's Slashdot, after all) trying to figure out a way to avoid this in the first place:
My first instinct is the really low-tech alternative: hire a lawyer to deal with your confidential information when you die. Just like any other "unsolved business" with your state, your passwords,etc. would be given to someone you deem capable of dealing with the issue...
But almost no one prepares for death that way either, so what are the technical alternatives?
- A cron job of sorts? Would depend on the server running indefinitely until some stipulated date when it would release the information... if it used some distributed system, it could avoid the vulnerabilities that come to mind at first sight. But a system that requires you to identify yourself and register would require almost as much preparation as the lawyer, and an anonymous system would be too open to abuse (heck, the first too).
- Some kind of "degrading cryptography"?
It may seem like defeating the purpose of cryptography in the first place, but assume that we don't want to keep the information secret forever, just for some years... not only do we not care if the information is revealed then, we DEMAND it is revealed at a particular point in time.
Is there some way to encrypt data such that it can demonstrably be decrypted only after X amount of time?
I imagine it would be extremely hard to figure out something like that, but maybe someone already has. I can only think of three approaches to not-depend on processor power, both perhaps impossible:
i) A method that collects information from some constant (data is reliable and at a constant rate) source of information (solar flares?) and needs to collect X amount of information before decrypting the key and revealing it.
The problem is that in order to ensure this information will make the decryption possible you have to be able to anticipate it. Then anyone can simulate the information at an accelerated pace and get to the key...
Maybe if we can use the key to select which information to process, and use a source of massive amounts of data, we can make unfeasible to accurately simulate all the data. But that would be trusting our current technical limitations to hold, wouldn't it? Unless we can prove simulating the source is an NP problem...
ii) Having a system that creates a unique algorithm for the key that needs to be run for X time in order to "degrade" to the key. The idea would be to escape the dependence on external information of the first problem. But even if it's possible, we would need to depend on an external source for a trusted "beacon" or "ticker" that tells how much time has passed.
iii) Perhaps the only sensible solution (and the last I thought of, obviously): Would it be useful to have digitally signed time measurement on the Internet? An atomic clock owned some trusted government or international entity that officially tells you "today is time X"?
You encrypt the key to be decrypted only when a message digitally signed by agency Y confirms a certain date has been reached. When agency Y makes the message "today is time X" public on the Internet, your boss gives that message to the system and the system pops out the password you need. "time X" and "agency Y" could (and would) be made public to all interested parties, but unless "agency Y" cheats, no one can do much about it.
This could also provide an automated means to publish confidential material whose confidentiality has an expiration date. Declassification would then not require too much work on the part of agencies that have no great interest in declassifying in the first place: once the time is reached, the keys are available and people can decrypt it.
Freedom is the freedom to say 2+2=4, everything else follows...
Castanza, you killed my mother.
This is not troll, I am a human and make funny jokes, haha.
trustno1
lol. literally. caught me off guard. we used that for a domain admin pwd at a former employer during one rotation period.
Intelligent Life on Earth
I knew we shouldn't have let thore Norsemen have their own king and all. This is what happens; they lose passwords left and right.
Besides, I'm sure that the password is just a misspelt danish word. I mean, c'mon, if you can't pronounce danish properly, don't go and call it something else, like Swedish or Norwegian...
Blearf. Blearf, I say.
This sort of thing works both ways and the powers that be aren't going to learn that if you come to their rescue. They'll eventually figure out the password, but if you let them do it on their own, and you tell them why you aren't going to assist them then maybe, just maybe, they'll learn a lesson. Something about doing to others as you would have them do to you.
Prevent email address forgery. Publish SPF records for y
The following info would help:
Combine that with the dictionary, mix well, apply cracking script and, most likely, open sesame.
As Richard Feynman used to say about safes, 99.9% of what keeps people from getting in is the perception of security, not real security. This from a guy who used to sneak in & out of Los Alamos at will during the Manhattan project.
The only tool you've got against psychosis is experience.
Depends on your view of important.
Those who forget the past are doomed to repeat it -- George Santayana
Yeah, I had a sig once; I got bored of it.
I'd say to ask Jon Johannsen, but then the MPAA would just use it to prove that he's an Evil Terrorist Hacker(tm).
Fascism starts when the efficiency of the government becomes more important than the rights of the people.
Ok you lost the password. There are other ways of getting back to the data and changing it then hacking the computer and compromizing security.
/etc/passwd and whipe out the * in the root password
1 You Take the Harddrive out of the PC/Workstation.
2 Put it on an other working PC/Workstation that you do have a password for.
3 Mount the drive.
4 Go in that drive
5 Put the hard drive back in the old computer.
6 boot it up.
7 loogin as root no password asked
8 change the root password
This is much simpler then having a person try to hack a password. in case if it is a good one could take a really long time to crack. Unless of course the guy who knew the password is the only guy in the country that knew how to move a harddrive.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
See...this would be all fine as long as he kept the password locked away in his will so that in the event of his death.... you get the picture...
Carpe Canem - Seize the Dog
(blinks) Isn't that sort of like "The Germans, not including The French" ?
No. To a European, "America" == North and South America, including Canada, Mexico, USA, Peru, French Guiana, etc.
I love it when a European tells me that an average American is so badly schooled that the average European better knows their American history. After asking them who Malcolm Little is, which they never know, and after patiently listening to how some hollywood movie has history all wrong (what a shocker, that), I usually give them an example of classy European geography like this, and send them on their way.
1) Who is Malcolm Little?
2) It's a matter of perspective, a European considers all of North and South America to be "America", Americans and Canadians consider the USA to be "America".
It's like in Canada, somebody from BC would tell you that the "west" is BC and Alberta, somebody from Alberta will tell you it's BC, Alberta, and maybe Saskatchewan. And somebody from SK will tell you that the "East" is Ontario and Quebec, where somebody from Ontario or Quebec will tell you that they're "Central" Canada, when technically they are not, the centre is in Manitoba.
God save our Queen, and Heaven bless The Maple Leaf Forever!
... some sort combination of Windows, IE, Access, VB Script and IIS, I'm sure they wouldn't have to go public with the annoncement and just hack their way into it. I think that sysadmins should consider insecure data storage in the future in the case of their death.
Distributed.net
We get a client, we'll have the password in a couple days. No sweat.
-- "Government is the great fiction through which everybody endeavors to live at the expense of everybody else."
But have they tried "bork-bork-bork" yet?
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
INT: Courtroom, Day
Assistant DA: "The DNA evidence is indisputable!"
Defense Attorney Han Solo: "I object!"
Judge: "What grounds?"
Defense Attorney Chewbacca: "RAWWWWR" (Smashes table over Assistant DA)
Judge: "Let me suggest a new strategy...Let the wookie win."
"Bugger this, I want a better world." - Jenny Sparks
Password, procudures, etc... are *written* down and immediately put in a file which someone in the legal department then puts into your company's secure storage vaults (be they onsite or offsite).
--- I do not moderate.
If someone was interested in this data, they should have covered this kind of situation under a risk management plan. Hindsight being 20/20 and all that, they did not, and someone is now holding the bag. Because there is a file that is known to contain the data they want, they hold out hope that it will be salvageable.
:-)
In reality, this situation is almost the same as if a fire had destroyed the building along with the data, or even as if the person responsible for the data intended for it to die with him. There is a chance, however large or small, that the data will be recovered, but from a business perspective, an appropriate response would be to consider it a loss, start collecting the data again, and learn from the experience. Retrieving the data from the encrypted file is an interesting exercise, but one with uncertain results. Push the file into an academic circle and hope for the best.
In this case, having the file is misleading a management decision, because it appears as if they still have the data. In reality, they do not, unless an unlikely contingency occurs where someone can retrieve it. Since nobody seems to be able to put a delivery date on that retrieval, or even state the degree of cetrainty with which it can be retrieved, the correct business decision would probably be to consider it lost.
I'm guessing it's a loss not covered by their insurance.
This is a harsh assessment of the situation, and I'm only making it because I'm not the one with the data that needs to be recovered
Another thing I notice is that the party responsible for the data seems interested in limiting the number of people who will get the opportunity to try to crack this, as opposed to just posting the thing to the world as a challenge, perhaps with a reward to the first person to break it. Remember the King Arthur legend -- Arthur wasn't authorized to try for Excalibur!
The details in the article are sketchy. The title of the Slashdot article seems to be pretty misleading. The file in question doesn't contin the historical documents themselves, but an index to them?
I'm sorry to hear that a researcher has died in Norway.
-fb Everything not expressly forbidden is now mandatory.
UN Peacekeepers were sent in to Scandinavia today to avert the escalation of an increasingly bitter round of invective between representatives of the area's countries. Tensions began to abate, however, as the traditional taunting gave way to the relatively modern sport of "USA-Bashing."
Milo
Trollem mirabilem hanc subnotationis exigiutas non caperet
1) Malcolm Little == Malcolm X
And if you didn't know, why didn't you go hit google or something?
2) No, most everybody who says America, no matter where they're from, usually mean folks from the USA. Most Europeans actually like Canadians (and probably South Americans and Mexicans too).
Heh. I actually have some Canadian friends that tried to argue that they're "Americans" too, and us folks from the U.S.A. shouldn't try to hijack the continent. I brought up the fact that the continent is North America, and they are North Americans, but just "Americans" is usually reserved for the USA because what else would we be called (ok, lets leave off the slurs and slanders a'ight?)?
"Citizen of the United States of America"?
"USAian"?
"United Statesian"?
Gimmie a break!
OK, so thousands (maybe millions) of pages of text may be lost to some guy who was a control freak and decided to compress and encrypt a database[0], but the short term benefits of this are not entirely being used. Anti-DMCA and Anti-Euro-DMCA, showing the world that 'hackers' (White, Black, Grey, Blue, etc...) are not the evil bane of existance of the Internet.
Granted, I'm not a fan of Norgys, particularly due to an IRC channel I'm on that has had to ban *.no because of constant "A/S/L?" and mass-msg "Hi, I am a cute girl from Norway, do you want to cyber?" messages... but the point being... there -is- the chance that the Norgys did something -GOOD- for once. What if this is a spoof, hoax, trick... a Library/Institution that decided that people do actually need hackers in the world to work on all those stupid problems that otherwise would go unaddressed because people are stupid and lazy.
Erm... maybe... then again, maybe not, and well - that's giving Norgys a lot of credit...
0. However to the best of my knowledge, dBase passwords are very easy to break
I cannot confirm nor deny the allegation or allegations you may or may not have just made
Then it would be alot easier to get the password.
Too bad the Lone Gunmen aren't available.
Or do you hire a clerk to rebuild the database by looking through the books? At some point, that probably wins, at least to the extent that the indexing is mostly gruntwork rather than creative thought. That doesn't mean it's not worth posting the file to the web and asking for volunteers to hack it, which would be a fine idea.
A long long time ago, on an IBM System34 far far away, somebody out in the shop wanted to turn off his welder by flipping circuit breakers, and found the computer room before he found the welder, and the 34's quaint little operating system wasn't designed for that sort of thing; the open file which represented six or seven hours of typing by our accounting clerk got truncated to its last good state. I spent about 5 hours on the phone with IBM tech support doing the hexedit on the disk drive to find the right pointers and patch it so we could recover the file. If it had taken much longer, we'd have been better off retyping the thing.... But of course, sometimes you only know that in hindsight.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Ah auh ahhh.. You didn't say the magic word..
Ah auh ahhh..
Ah auh ahhh...