L0phtCrack (v6) Rises Again

FyreWyr writes "L0phtCrack — now 12 years old — used to be a security 'tool of choice' for black hats, pen-testers, and security auditors alike — that is, until it was sold by L0pht to @stake, then Symantec, to be released and subsequently dropped as LC 5. As an IT security consultant, I used this tool to regularly expose vulnerabilities or recover data when there were few other options available. Eventually, I let it go as tech evolved away. Now, after being returned to its original developers, version 6 was released this week with fresh features: support for 64-bit multiprocessors, (current) Unix and Windows operating systems, and a number of other features, including enhanced handling of NTLM password hashes and support for rainbow tables. Interested parties, especially consultants, will find this shiny new version sports a hefty price tag. It raises doubts in my mind whether it can effectively compete with open source alternatives that go by similar names, but as I found earlier versions so useful, its re-emergence seems worth the mention."

Comments

Who remembers it?

[Ektanoor]

Loph who?...
What cracks?
12 years? That's pretty old stuff. Who needs it?
Does it work on iPhone?
Can I crack my XBox with it?

Really people, I bet that 90% of slashdotters are still wondering what is L0phtCrack and how can you eat it.
I waited for 10 minutes. No replies. Mute reaction.

L0phtCrack, and their creators, the "L0pht Heavy Industries" group, were once shinning stars inside the Hacker community. Now who remembers them? There are not even scriptkiddies around, all society is a scripkiddy.

L0pht people also created the "tool that never got its true name" - "netcat", which can only be found in most *nix systems as "nc". Pretty great tool, just two weeks ago I used it, once again, for more than 11 years.

Hail to you guys, happy to see you around.

And Hail to the Cow!

Re:Who remembers it?

[Ektanoor]

On which of the languages I know?
Sorry, but sincerly, it is pretty hard to remember the grammar of some 9 languages I know. And I am not taking into account programming.

More. It is pain to take into account the grammar of each language, if you are reading almost simoultaneously three or four languages.

Yes, it's a handicap I cannot stick into a specific grammar. But I can read on several languages and write, in a possible comprehensible manner, on them.

Now I know several jerks who are too sticked to grammar, make a whole fuss out of it and are only able to create a complete nonsense out of a text. If I note that I had these cases on juridical documents, which decided will someone go to the gallows or not... I do prefer my horrible grammar.

ModDown offtopic but I get pretty mad when people try to teach grammar not by the error but by playing smarties.

Re:Am I missing something??

[Bert64]

I doubt a cracker would use this, most of the features listed seem to appeal to non technical management types...
Crackers (and for that matter more technical people other than crackers) are more likely to use john the ripper, which runs on more platforms, supports more cipher types, supports clustering etc.

Incidentally, the talk about "pre computed dictionary files" is a ridiculous idea, you turn a small dictionary, say 100 words, into a huge file consisting of 100 * * , and you end up storing thousands of hashes for salts not being used in the passwords you're trying to crack..
Yes sure, some password types are not salted, but these types are also generally very weak and a modern cpu may be able to compute them faster than it can spool from disk.

Any GPU Support?

[Anonymous Coward]

What would make a real killer for cracking would be a combination of Cain and Abel + GPU Support. Imagine having a ten/hundred fold increase in hashes per second from utilizing a Nvidia / ATI card.

You do have other programs for this kind of work, but the price tag I've seen so far would make my stomach turn.

Re:Am I missing something??

[Anonymous Coward]

That's more or less what it is but it was used to find password vulnerabilities back in the day created by various mixed Windows (LANMAN passwords on an old NT network were insta-cracked so it was nice to know who was connecting with win16 OSes so you could go stab then in the face and take their machines away) versions back in the day. Also used to be good to unlock your build server when the operator went to Russia for a month and locked everyone out of it. There were many legit uses of it but it is or at least was a password recovery tool.

These days I'm guessing there are better alternatives that haven't been on hiatus for 12 years and that are free and open source but in its day it was a wonderful tool.

Re:I'd be careful

[jesseck]

I've had a directory in my computer I used to organize network security tools, and I had to disable Symantec from scanning it. Every scan, Ophcrack and Cain & Able would pop as a threat. There were a other tools, too. I just expect this behavior out of an AV program. As for the trojan alert, we know that there is malicious software that can capture passwords. So, this was probably a hit from the heuristics of the program- a similar signature. Hell, if I was writing malicious software, and I needed a way to crack weak passwords, would I worry about "licensing" or using open source software?

who needs to crack windows passwords anymore???

[Anonymous Coward]

http://oss.coresecurity.com/projects/pshtoolkit.htm

'nuff said

Re:I'd be careful

[deets101]

First, I hope you're kidding.
Second, This raises an interesting question for me. When Symantec owned it did their AV product(s) detect this as malware? That would be a fun call to their tech support.