Letters-Only LM Hash Database

Peter Clark writes "Disk storage has increased tremendously in the past 5 years and the blatant insecurities in the antiquated LM hashing technique have not gone away; though functionality has been added to disable LM hashes, this is not set by default. With some help from Elcomsoft, simple flat files have been created that hold every combination of LM hash for letters only passwords. Jesko has coded a server application which allows you to access this database. Simply telnet to: beginningtoseethelight.no-ip.org on port 2501 and paste in a LM hash. So how does this differ from Rainbow tables? Well this will return a password 100% of the time, using minimal processor power, in approximately less than 0.2 seconds."

Comments

less than 0.2 seconds

[Sediyama]

I think someone is underestimating the /. effect.

Re:Someone explain?

[Doctor Memory]

I suspect it may be the passwd itself but I am not sure since it is not clear.

Of course it's not clear, it's been hashed -- haven't you been following along?

This just in from beginningtoseethelight...

[jmcneill]

Dear Slashdot Readers,

Thank you for letting us know your passwords.

Regards,
The staff of beginningtoseethelight

Light?

[alapalaya]

in the article:

beginningtoseethelight.no-ip.org

the /. fortune:

The light at the end of the tunnel is the headlight of an approaching train.

Am I the only one to see a connection ?

awright!

[sootman]

now we're gonna kick it old-skool and /. a telnet server! woo hoo, just like the old days! our next target: gopher://sunsite.unc.edu

Whew! I'm still safe

[DongleFondle]

I guess I'm still relatively safe though because my admin password is not only 10 characters long, but has capitals, lower case, numbers and symbols in random order.

Its H82sd*e2Tn.

Nobody is ever going to crack that!!!

How long until...

[rewt66]

beginningtoseethelight gets hit with a DMCA lawsuit?

And, yes, I am aware of the irony of posting this on election day in the US...

Holy Ratshit, Batman!

[deacon]

That's why Microsoft's LM hashing algorithm is so cool -- it uppercases your password before hashing. With this algorithm, multicase passwords do nothing to the statistics.

Please, please tell me you are joking.

I am no fan of MicroSoft, but come on, no one would really do something like this.

I figured that my passwords are safe because they are normally the tunes of music..

For example

Taaaah-dum+dum*dum#dum#taaaaah|dum!tum^du m$tum%rumtittytum.

And since I am tone deaf, It's not very likey that someone will hit upon the combination soon.

The usage of the +-@# characters is based on a matrix written in pencil on the side of the monitor.

8^)

Re:modeling unknown passwords

[shrikel]

much less likely password

Yes, much less likely, but people sometimes choose things like that for their passwords anyway. My wife's self-chosen password to her bank account, for example, is 'Nfok3G!~qOmp', and I can tell you that NOBODY is going to guess that one!