Slashdot Mirror
L0phtCrack (v6) Rises Again
FyreWyr writes "L0phtCrack — now 12 years old — used to be a security 'tool of choice' for black hats, pen-testers, and security auditors alike — that is, until it was sold by L0pht to @stake, then Symantec, to be released and subsequently dropped as LC 5. As an IT security consultant, I used this tool to regularly expose vulnerabilities or recover data when there were few other options available. Eventually, I let it go as tech evolved away. Now, after being returned to its original developers, version 6 was released this week with fresh features: support for 64-bit multiprocessors, (current) Unix and Windows operating systems, and a number of other features, including enhanced handling of NTLM password hashes and support for rainbow tables. Interested parties, especially consultants, will find this shiny new version sports a hefty price tag. It raises doubts in my mind whether it can effectively compete with open source alternatives that go by similar names, but as I found earlier versions so useful, its re-emergence seems worth the mention."
interesting... the download site seems to be unavailable right now. =)
l0phtcrack is the worst, and I mean the worst piece of software ever made by anyone, ever. As a side note, this is possibly the best tasting piss I have ever frostied.
Password security seems pointless when password recovery systems are even less secure.
L0phtCrack 6 Professional - $295.00
L0phtCrack 6 Administrator - $595.00
L0phtCrack 6 Consultant - $1195.00
I can build my own from scratch and existing resources for cheaper with the same feature set.
Thanks but not thanks.
This just seems like a cracker tool - to gain passwords. Or am I missing something (since Symantec owns it I probably am)?.
"Maybe this world is another planet's hell"
Aldous Huxley
Putting the "no" in innovation, again.
Let's face it: Anything that symantec touches turns into worthless and junk.
Symantec is like the Anti-Midas of technology.
They touched Norton and poof, a great tool was turned into the worst nightmare of all times.
Now they are releasing the ultimate hackers' tool under their umbrella.
If i was anything like ParMaster, i would run as fast as i could and as far as away from it.
"Doing what i can, with what i have." ~ Burt Gummer
When the submitter referenced "open source alternatives that go by similar names", he was referring to ophcrack. Similar features are also available from Cain and Abel, and John the Ripper.
I maintain a list of top password crackers and sniffers as part of my SecTools.Org site.
While the submitter is correct that they have much more competition now, I still wish to congratulate the former L0pht guys on the new release!
True to that. They slaughtered my favorite windows firewall sygate :(
https://www.speakservers.com/
Loph who?...
What cracks?
12 years? That's pretty old stuff. Who needs it?
Does it work on iPhone?
Can I crack my XBox with it?
Really people, I bet that 90% of slashdotters are still wondering what is L0phtCrack and how can you eat it.
I waited for 10 minutes. No replies. Mute reaction.
L0phtCrack, and their creators, the "L0pht Heavy Industries" group, were once shinning stars inside the Hacker community. Now who remembers them? There are not even scriptkiddies around, all society is a scripkiddy.
L0pht people also created the "tool that never got its true name" - "netcat", which can only be found in most *nix systems as "nc". Pretty great tool, just two weeks ago I used it, once again, for more than 11 years.
Hail to you guys, happy to see you around.
And Hail to the Cow!
L0phtCrack 6 Professional - $295.00
L0phtCrack 6 Administrator - $595.00
L0phtCrack 6 Consultant - $1195.00
Sigh. Do you...do... IT? It seems like a "cracker tool" to you? What the hell are you, the FBI raiding Steve Jackson games 15 years ago because you're too inept to understand the difference between a concept and using it criminally?
You understand that even tools put to ill use by criminals have legitimate purposes right? Or are you in the ban sporks because they can be used in spork crimes camp? </flame> You deserved that.
L0phtcrack--cracks--passwords. There's nothing inherently wrong with that. Valid reasons include:
* lack of backups and a need to recover an existing password
* testing employee passwords for compliance with policy and strength requirements with authorization
* being paid to pen-test a system
* Just freakin' wanting to run it at home to see how fast such tools 'really work'
* Discovering passwords used on a compromised system (it may help reveal passwords used in encrypted files with naive rootkits)
* General Proof of concept against poor password implementations--early versions of l0phcrack hit some systems a lot faster than others as I recall
Can we stop with this namby crap that the tool is somehow used and written by 'bad people' is 'bad' itself?
>As our way of thanking you for your positive contributions to Slashdot, you are eligible to disable advertising.
It's funny because:
- The vast majority of my "contributions" are anonymous troll posts.
- I had ads disabled to begin with. Eat it, capitalists!
What would make a real killer for cracking would be a combination of Cain and Abel + GPU Support. Imagine having a ten/hundred fold increase in hashes per second from utilizing a Nvidia / ATI card.
You do have other programs for this kind of work, but the price tag I've seen so far would make my stomach turn.
Right, because if there's one thing that computers are horrible at, it's searching for things really, really quickly. Thanks for the useful post!
To be fair, Midas' touch didn't really work out too well either...
There needs to be a -1 Missed the Point mod. He was saying there are various legit reasons to do password recovery and you respond with a mixed list of how you think security consulting should work and why you wouldn't run L0pht and why there are better tools than L0pht. The funny thing is I don't really disagree with any of your rants but his list was valid as well and you simply took a weird side path to argue some points that apparently have been irritating you lately
Perhaps the reason your clients don't listen is because despite technical competence your communication skills needs some work. Try listening to their complaints and problem and trying to respond to them and convincing them rather than just preaching loudly and sounding like Chicken Little. Every company I've worked at in the past 20 years has adopted strong (or at least medium) password policies at some point. The reason IT gets a bad name (other than the fact we fail to deliver ALOT) is that we have bad attitudes about the skills of others and we don't listen to those that are actually paying for our services we just preach and get upset when they don't immediately take our advice. Being right and knowledgeable is important but being convincing and influential is even more important if you actually want to get something done.
Let's face it: Anything that symantec touches turns into worthless and junk.
Symantec is like the Anti-Midas of technology.
They touched Norton and poof, a great tool was turned into the worst nightmare of all times.
Now they are releasing the ultimate hackers' tool under their umbrella.
If i was anything like ParMaster, i would run as fast as i could and as far as away from it.
Don't mod this as "funny." Mod it as "insightful." It's not a joke -- Symantec makes some of the worst products in the industry, and turns otherwise good products into terrible products.
I had a copy of l0phtcrack on my disk that I downloaded years ago from their site, and was left gathering dust on a forgotten corner of my hard drive. Recently a full drive scan by an antivirus (AVG?) identified it has having a trojan. It could be a false positive, but it seems more likely to really be a trojan that had been deliberately planted there. Consider yourselves warned.
If my doctor ever told me "you really need to do X", I would do it. If I thought I knew more about medicine than he does, then I wouldn't pay him to practice medicine on me. So it doesn't make any sense to pay good money for his help if I am not going to comply with his recommendations. Yeah, I could get a second opinion and all of that, but I wouldn't do that without a good reason and I'm trying to keep this analogy simple.
When somebody goes to a doctor and says "doc, it hurts when I do this" and the doctor examines you and says "well, you have Y disease", people generally would not look that doctor in the eye and say "no I don't," at least not without providing some very good reasons why they disagree. That's because doctors, lawyers, and other traditional professionals are generally recognized and respected as the trained experts that they are. This is not the case with IT. IT often has to deal with uncooperative users who don't recognize when they are out of their element. I can't really prove this, but I think I can safely say that IT deals with uncooperative clients far more than any other highly trained professional. Whether anyone likes this or not, that will definitely sour relations.
I see the practicality of it, but I disagree in principle with your comment about the importance of being convincing and influential. That's because I don't subscribe to this idea that you should have to have an uphill battle with someone in order to help them. They should either want and appreciate your help or they should deal with their own problems. I shouldn't need movie-star charisma and a silver tongue to convince people to do something that is clearly in their best interests. All I should need to do is point out how much better it would be if they took a few steps and their own desire for a better or more problem-free experience should take care of the rest.
It's hard because those users are (typically) also your customers. In business, that means you often cannot be completely up-front and honest with them if it is going to offend them. That still doesn't make it right that they hire you for your expertise and then routinely ignore that expertise when you try to use it to improve their experience. It really doesn't make it right when they scream at you because they have problems that would have been completely avoided had they followed your advice. Sure, as a professional dealing with customers you are expected to handle that gracefully, but it's a burden that most other professions don't have to shoulder to such a degree and I think that's often not recognized or appreciated.
It is a miracle that curiosity survives formal education. - Einstein
... especially considering the recently announced cyber-security initiatives, not to mention all of the DOD stuff going on.
We are building an entire ARMY of script kiddies who will need such tools. ;) And guess who's paying for them?
http://oss.coresecurity.com/projects/pshtoolkit.htm
'nuff said
There is a difference between posting about what is wrong in a dicsussion with tech folks on a site such as /. or zdnet (which are both made up of technology workers and professional and/or amateur journalists) and communicating with customers. The approach and tone for each is and should be different as the education level, expectations, and requirements of each audience is different. Here I do not need to sugar-coat my comments or opinions of given product choices.
With customers sometimes the medicine needs to be dosed with a spoonful of sugar. I'm sorry you cannot grasp that distinction, however in this case I do not feel any need to apologise if this particular post offends you, since having nothing worthwhile to say you went directly for an ad-hominem attack. Therefore, I will assume you are a Symantec shill - either an employee, distributor, or associated with an advertising firm for them.
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
They did it to sygate too? Hmmm...I recall they bought the defunct AtGuard firewall and neutered it into their "Internet Security" program...I remember the first (and maybe the second) iteration still had the exact same statistical screen at AtGuard.
AtGuard was the best.
Is this still useful against modern implementations of active directory? I thought it used either kerberos or an improved version of NTLM these days.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
Yeah, I'll pay that just as soon as my hack of Bank of America puts another $100 million in my Swiss bank account.
Fucking morons. The only way anyone's going to pay that kind of money is if he's literally hacking Bank of America.
Talk about people with an exaggerated sense of their importance in the world.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
whoever gets the first clean cracked version, email me.
Should take about thirty seconds.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
...and to Axent.
there is not a professional accreditation for IT....
You might want to read TFA, so you have some idea what you are talking about. L0phtcrack is not owned by Symantec, and has been re-acquired by the original developers. It is in the article. Really. Don't let the clueless mods fool you. Your post was not only completely lacking in insight, it is just plain and flat wrong.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Haha, that's the exact problem right there. IT thinks they are computer "doctors", when in fact they are the computer "janitors".
Seriously, anyone who's worked in IT longer than a year or so should know that at least 50% of their colleagues are incompetent bullshitters, and IT as a whole is the tail who thinks they wag the dog.
Oh, so now you are saying that symantec HAS the midas touch and that it produces Excellent Norton Utiilities and Anti-Virus...?
"Doing what i can, with what i have." ~ Burt Gummer
A windows-only binary?
The world has changed since then...
Also:
> Attention Overseas Customers
(etc)
What do overseas customers have to do with USA law?
Ok, so where is the torrent of the real release, where your download isn't also tracked.
---- Booth was a patriot ----
They haven't killed that off, yet. We will see what happens now that they own Altiris and have pretty much merged it with that division, but so far it wasn't destroyed by the acquisition of norton.
---- Booth was a patriot ----
Oh, so now you are saying that the world is flat and the Earth revolves around the sun?
..." in front of them too!
See. I can make things up and put "Oh, so now you are saying
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
For Windows my personal favorite was PGP Firewall - it was one of the most powerful firewall solutions I've ever come across for Windows. It was later aquired by McAfee and much like Norton they completely butchered it. Another good firewall was NeoWatch combined with NeoTrace, pretty entertaining and very capable (although it didn't firewall applications).
Touche, my friend.
I was trying out the old, well-worn Republican way of attacking opponents.
"Doing what i can, with what i have." ~ Burt Gummer
May I remind you Veritas is now (since 2005) part of Symantec.
Symantec is much more than just consumer anti virus and personal firewalls.
NeoTrace! Yeah, that was a wicked program. It doesn't work anymore, does it?
You say "was" your favorite...does that mean it's not available anymore?