Crack a Password, Save Norwegian History

Christian writes "With the death of the only person who knew the password to an archive held at a museum in Norway, suddenly the data became inaccessible. The result? A nationwide radio appeal asking for "hackers" to volunteer to help solve the problem! The Norway Post has the story." I wonder if they looked under his keyboard yet..

Comments

Slashdoted Text

[Technician]

5. Juni 2002

Hackers respond to password challenge

Hackers have responded in large numbers to an appeal from the director of a culture center and literary museum on the west coast of Norway.

The password to one of their library archive systems is missing.

The museum built in honour of the famous Norwegian linguist Ivar Aasen received a gift of more than 1600 books and documents which had been catalogued and registered in a national data bank, which researchers and interested people may access.

Only trouble was that the expert who had helped the donor with the archiving work had died, and had failed to pass on the password.

In order to get access to the data base, Director Ottar Grepstad appealed on nationwide radio for help to solve the problem.
The response was above expectations, and the director is now busy chosing the expert most likely to solve the problem.

(NRK)

(this loaded very slow, but I got it.)

Re:Slashdoted Text

[ObviousGuy]

Ottar Grepstad

Heh. The director's got two Unix utilities in his name and he *still* can't hack the system.

I'm sure there's a joke in there somewhere.

Re:Slashdoted Text

[Hiro Antagonist]

*sigh*

If only his name was John Libcrypt...

Don't worry, I've already cracked it

[Henry V .009]

I've already cracked it. Got the archives open right here. Let's see:

In the year 1005, the 1337 v1k0rs raided the English coast for raping and pillaging...

As a Swede, all I can say is...

[weird mehgny]

...this only happens in Norway :)

Re:As a Swede, all I can say is...

[fallacy]

Which are invariably themselves...

Re:As a Swede, all I can say is...

[Anonymous Coward]

...just wait till you get computers, then we'll the laughs will be ours.

Re:As a Swede, all I can say is...

[jahalme]

Yes, and while the swedes and norwegians are attemtping to grok complicated concepts, such as passwords, we finns write our own operating systems. ;)

Re:As a Swede, all I can say is...

[Dr. Cody]

But, when it comes down to it, what could they possibly hope to learn by recovering this archive of Norwegian history? How Norwegian troops threw grenades at the Swedes, and, consequentially, how the Swedes pulled out the pins and threw them back?

so.. how are we supposed to store passwords?

[dikappa]

This is an interesting issue. Any -minimally skilled- IT operator knows he should never tell passes to other people. But, what if this person dies? How can we safely store passwords so that those can be retrieved if "shit happens"? Probably we cannot use encription (you need a pass to decrypt stuff), so what? Probably for most of us, a piece of paper in a safe place at home is enough, hackers *usually* do not break-in to get passwords. But I guess there is people around protecting *really* important data, and they do not trust anyone... what can they do to make passwords "undiscoverable" until "death" or sudden amnesy?

Re:so.. how are we supposed to store passwords?

[Rui del-Negro]

Tattoo the password inside their body. Or inside their pants; IT operators' pants are never removed near / by other people anyway.

RMN
~~~

Re:so.. how are we supposed to store passwords?

[sydb]

Do you really want to see your bank manager every time you change any one of your passwords?

You do change them, right?

Or every time you get a password for a new service?

A better idea would be to keep the password to your private key in that bank safe, which decrypts your personal password file that you update regularly.

Re:so.. how are we supposed to store passwords?

[GigsVT]

The probability of a sysadmin dying is not large

On the contrary, it's 100%. It's not a question of if, it's of when.

Re:so.. how are we supposed to store passwords?

[cowbutt]

Any -minimally skilled- IT operator knows he should never tell passes to other people. But, what if this person dies? How can we safely store passwords so that those can be retrieved if "shit happens"?

Google for "secret sharing" and you'll find plenty of references. Essentially, the secret (i.e. the password) is converted into a value that intercepts an axis of a n-dimensional graph. m points in n-dimensional space are then generated such that they lie in a straight line on a single plane. You can then distribute the values of the m points safe in the knowledge that you need at least n of them in order to calculate the point of interception of the secret.

AFAIK, this is how things like launch codes for nukes are stored and distributed (to counter the twin threats of elimination of keyholders preventing nukes from being launched, and to prevent a single rogue keyholder launching without appropriate authorisation).

Apologies to the maths/crypto purists out there if my description is fuzzy, over-simplified, or plain wrong, but it's been a while... ;-)

Better explanations can be found on RSA's site and in Ross Anderson's book "Security Engineering"

--

Re:so.. how are we supposed to store passwords?

[dangermouse]

You do change them, right?

Hell no.

That is the single most hare-brained bit of common security "wisdom" in the world.

Years ago, I picked a password that's random as hell and was very difficult to remember. No password cracker-- dictionary *or* brute force-- has broken it yet. I use this password on about ten systems.

If I changed those passwords on a regular basis, I'd have to come up with something easier to remember to make up for the decreased learning time. That would likely make my password less secure.

I keep running into admins who-- by hook or by crook-- make their users change passwords periodically. The result? Passwords on Post-It notes; passwords that are the names of pets or wives or firstborn children; sets of passwords that are absurdly simple and that get cycled through.

If they had just let the users keep their original passwords and run a cracker against the shadow file to turn up the overly simple ones, their systems would be a lot more secure. But somebody told them changing passwords frequently was a good idea, and by god their users are going to change passwords frequently.

Re:so.. how are we supposed to store passwords?

[dcigary]

Whenever I go on vacation, I keep what I call my "Hit By A Bus" document on the system. It's password encrypted and I give that to whomever I deem necessary. It contains passwords, procedures, etc of everything that I do. Then, after returning, I change as many passwords as I can...

Simple, easy.

Re:so.. how are we supposed to store passwords?

[edp]

Er, I'm not sure what you're getting at. For example, any set of points (in a space of more than two dimensions) that "lie in a straight line" are necessarily also in a plane and are in fact in infinitely many planes.

Shamir's secret sharing is easy to describe: Any polynomial of degree k-1 can be completely figured out from k points on it but not from k-1 points. So to share a secret among any number of people so that any k of them can figure out the secret and any k-1 of them cannot, you make up a polynomial whose value at x=0 is the secret and you tell each person the value of the polynomial at other points (at x=1, x=2,...).

For example, any 2 points define a line (a polynomial of degree 1). If you tell me where the line is at x=1 and x=2, I can figure out where the line is at x=0. But if you only tell me where the line is at x=1, I haven't got a clue where it is at x=0, because it could still be anywhere. If you gave a million people different values for x=1, x=2,... x=1000000, no one of them would know the value of the line at x=0, but any two of them could figure it out.

Re:so.. how are we supposed to store passwords?

[gregfortune]

Sounds like a good way to get into bed too. The only way for the "bad guys" to get your password is to send a really hot girl over to your house. Ya know, this is probably the last hope for most ./ readers.

I see 5:

[Confuse Ed]

common utilities

1) tar
2) ar
3) grep
4) ps

and not so common
5) rep (well its installed on my system, but I'd never heard of it, further investigation reveals it to be a standalone lisp interpretter from the librep package (see "info librep", I am indeed learning something new every day))

More info

[Man Eating Duck]

A little info:

The database is from Dbase 4, I don't know how the security is on that format. It contains data about the norwegian linguist Ivar Aasen. For those interested in giving it a try, just search on norwegian pages to find the directors email address (name in another post). He's received quite a few emails already... (No, won't give the address here, pity the one who gets his email published on Slashdot).

Please excuse crappy english, save your grammatic flames.

Sorry, can't help...

[juliao]

I wish I could help, but I do intend to travel to the US at some later time in my life, and I don't want to be arrested for circumventig a protection device or something... Boy, do you americans have stupid laws...

What's needed is a "dead man's 'bot"

[Raetsel]

A simple program... something to send that important email, decrypt the data that you honestly don't have to safeguard anymore, etc. A program to take action when you haven't proven (password | biometric | whatever...) your continued existance on a pre-arranged schedule.

And wouldn't you know it, one exists!

I caught this discussion at Ars Technica last month. It refers to a cool-sounding program called "Dead Man's Switch (DMS)", which caught the attention of the New York Times.

Just a few issues...

• Don't go on vacation for a longer period of time than you have the 'bot set for
  (see either link, "If you're reading this, I'm dead!" type goofs have happened!)

• What happens when you actually do pass on to the great unknown, don't manage to pay your bills, and your (ISP | power company | shell host) kills your service?

• Or, more simply, what if your next of kin just tag the 'ol power switch?

Oh well... no person (or thing!) is perfect. Norway is keenly aware of this right now.

Re:this dosn't make sense.

[hyoo]

Crack a password, save history.
Get a cable modem, go to jail. [slashdot.org].

What kind of crazy backwards world are we living in?


Ladies and Gentlemen of slashdot it does not make sense. If Chewbacca lives on Endor you must acquit.

Public access?

[ciryon]

Well? What's the URL so we can all try it? They gotta trust me, I'm swedish! ;-)

Raises a serious point

[ClickNMix]

This is actually a pretty serious issue with any kind of system where only one person has the password.

The ISP I once working for nearly went out of business several years back because the only tech with high level access was in a serious car accident and out of action for a month or so.

Its all very well not writing down passwords, and saying that nothing is going to happen to you, but in the real world, people get ill, run over, fall down etc. - In large companies its more then likely not a problem, but in a small company that has only one tech person doing everything, people need to make sure there is a plan of action for if that person becomes unreachable for any reason.

Information on Aasen, the Aasen museum and nynorsk

[say]

Here is some information gathered from the Ivar Aasen museum.

The National Centre of the New Norwegian Language and Culture

• Opened June 2000, as a centre for adventure and information on language and cultural matters.
• Designed by the architect Sverre Fehn, who has received the most outstanding international awards of architecture. Mr Fehn has also designed the Norwegian Glacier Museum at Fjærland.
• The most modern and sophisticated building in Norway, and a traditional Norwegian country courtyard with four old buildings.
• Presents a modern exhibition on language throughout the world (you may even find your own language there), the New Norwegian language, Norwegian culture, and an Ivar Aasen Museum, using modern electronic facilities as well as traditional, elegant presentation.
• All information in the exhibitions will be in Norwegian and English.
• An in-door concert hall with 110 seats; an outdoor amphitheatre with 300 seats.
• Concerts, readings, theatre, library, art gallery, conferences, the annual New
• Norwegian Festival of Literature and Music.
• In our cafeteria with 50 seats, we plan to serve traditional food and sophisticated new dishes created especially for the Ivar Aasen Centre by some of the best Norwegian cooks.
• A place for surprises, a nice meal, relaxing walks on easy paths into the nearby woods with glimpses of the Norwegian fjords.

The New Norwegian Language

• Norwegian consists of two written languages, Norwegian Bokmål (Dano-Norwegian) and Norwegian Nynorsk (New Norwegian), which are mutually understandable, but based on very different historical traditions.
• A long union with Denmark (1380-1814) made Danish the only written language for all Norwegians, but in the dialects the old Norwegian language lived on as an oral language.
• About 1850 Ivar Aasen published a dictionary and a grammar which set the standards for a new written language, The New Norwegian, as a common denominator for the dialects. Improving the cultural and social status of the lower classes; this language played a major role in the development of democracy in Norway.
• Today, New Norwegian is the main language of 20 % of the inhabitants, mainly in rural districts. Although it is a lesser used language than Dano-Norwegian in general, it is the main language of Western Norway and is used daily in mass media, at schools, churches and in public administration all over the country. 25 % of the Norwegian newspapers are published in New Norwegian, and some of the major theatres and publishing houses use only this language.
• Some of the best authors write in New Norwegian, e.g. Jon Fosse, whose plays were performed in 14 European countries in the 1990's.

Ivar Aasen

• Born at Aasen, close to the Hovden airport, as a son of a poor farmer in 1813. Died in Oslo 1896 as a highly respected intellectual, also abroad. Poet, linguist and founder of the New Norwegian language.
• Collected words and expressions from the living dialects by walking throughout most of Norway, altogether about 5000 km - more than 3100 miles.
• Knew more about Norwegian customs, traditions and everyday life in the 19th century than anyone else.
• Even today, some of his poems and songs are among the most popular.
• An eager botanist; his collection of 500 flowers and plants is in a very good condition.
• His linguistic methods are today used in several countries in both Africa and Asia.

And in other news....

[Ooblek]

Days ago, Ottar Grepstad, director of the culture center and literary museum on the west coast of Norway, was busy selecting his expert of choice to hack a password known only by a dead man. It has been revealed that only minutes after his public appeal for a skiller hax0r to recover this password, his archive was ow3nd by Kevin Mitnick. The notorious hacker released information found in the archive that seems to indicate that Britney Spears was concieved by using frozen sperm from non other than Mike Tyson himself. The egg donor was only referred to in the archive as "Camilla" and it is suspected she is the same woman that Prince Charles is dating.

Info desired to crack the password...

[gdyas]

The following info would help:

• All the names of his family & friends.
  
• All the birth/death/anniversary/etc dates he'd know, especially children or parents.
  
• Prominent words or phrases displayed in his office.
  
• A selection of words germane to his profession.
  

Combine that with the dictionary, mix well, apply cracking script and, most likely, open sesame.

As Richard Feynman used to say about safes, 99.9% of what keeps people from getting in is the perception of security, not real security. This from a guy who used to sneak in & out of Los Alamos at will during the Manhattan project.