Slashdot Mirror
Ophcrack Says Your Password Is Insecure
javipas writes "An insightful article at Jeff Atwood's Coding Horror reveals the power inside Ophcrack, an Open Source program that is capable of discovering virtually any password in Windows operating systems. The article explains how passwords get stored on Windows using hash functions, and how Ophcrack can generate immense tables of words and letter combinations that are compared to the password we want to obtain. The program is available in Windows, Mac OS and Linux, but be careful: the generated tables that Ophcrack uses are really big, and you should allow up to 15 Gbytes to store these tables."
Ha, I've got these fools beat! I don't even USE a password on my Windows box. I'd like to see you try and crack MY password!
So basically, if I want to find out the passwords on someone else's computer, I have to bring along a high capacity DVD's-worth of data as well? I might as well just pretend I'm their tech support and ask for the password.
Back in the day, getting Windows passwords was as easy as opening a program from a floppy. That's how I got an A in Spanish class when the teacher challenged us to guess what his screensaver password was (the prize was an A for the year - dumb teacher).
"Passwords should never be saved as plaintext"
/etc/passwd, bitch!
Tell that to
Second, if you've computed all possible hash values for all possible character combinations, then it really doesn't matter what your password is, since you only have to have the input hash to the correct hash value. Since an infinite number of character strings map to a finite number of hash values, it is only a matter of building the tables before you can hack any system.
Third, if your only defense against this type of attack is a single password, you're screwed.
Fourth, if you are worried about this sort of attack and you still live with your parents, it's probably not really too critical that you implement heavy-duty, multiple-hardened points on your Gentoo system right now. You'll have plenty of time to implement that sort of security after you finish your current bag of Cheetos.
(blank)
password
password1 That formula will crack 90% of Windows passwords out there. The remaining 10% are what the other 14.999999 GB in the table are for.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
Windows has a security feature it uses when a user attempts to create a 15Gb table called "crashing". This makes it extremely difficult to break in using the tool defined.....
I once took the time (and CPU horsepower) to generate 64GB worth of rainbow tables. I must've done it wrong, though, because it didn't work on anything. I'll happily admit that I was just puttering around, and probably forgot to set some switch somewhere. Fortunately, I had a server that I didn't need for a couple weeks. :)
-Arthur
Cave ne ante ullas catapultas ambules
Can you please post a list of the remaining 1% and their hashes?
When I took grade ten computer class for fun I made my password 115 characters (some sentence and the digits of pi), but once I forgot it the first time and had to retype it. The teacher became frustrated so he made me make it shorter.
"What lies behind us, and what lies before us are tiny matters compared to what lies within us." Ralph Waldo Emerson
Also, If it's windows 98, I can blue screen the thing with a con/con from the command line and hopefully you have the thing set to reboot on BSOD.
If I mod you up, it doesn't necessarily mean I agree with what you've said, sorry.
Or just force authentication against the MIT Kerberos domain..... Your password must be at least 18770 characters and cannot repeat any of your previous 30689 passwords. Please type a different password. Type a password that meets these requirements in both text boxes. Layne
either that or get grandpa to watch over your box with his 12 gauge day and night.
What if Tetris was invented by Nazis?
No, it just makes you very flexible, perhaps double jointed.