Re: ADS Password Storage Protection
- From: Neil <neil@xxxxxxxxxx>
- Date: Mon, 07 Aug 2006 00:20:22 +0530
On 7/26/2006 11:46 PM, eric.baechle@xxxxxxx wrote:
I think everyone is on the same page about the mathematical complexity of passwords either coming from length or from additional character ranges.
But how does one begin to crack a password? One would first need the password hash. Where are the password hashes stored? How are the accessed? Once you have the answer to those questions, then you may decide that a 4-character simple password is good enough. Because if an attacker can crack your password hash, they had or HAVE access to your password hash, which means they've got system rights to your Domain Controllers! What's the bigger problem?
Sincerely,
Eric B.
That's not necessarily true. It sounds like you're assuming pwdump-ing
here.
Perhaps they grabbed the hash by getting physical access to a computer
that has your hash cached (eg. steal your laptop, mount the hdd on
another computer, grab the sam file, extract the domain admin hash).
Or perhaps they grabbed it in transit (eg. sniffed the hash on the way
to the domain controller).
Either way, they have the hash without the access...until they crack it.
And a 4 char hash, even with 4 character sets, would take very little
time to break.
-Neil.
---------------------------------------------------------------------------
This list is sponsored by: Norwich University
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.
http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------
- Prev by Date: dd vs windows...
- Next by Date: RE: ADS Password Storage Protection
- Previous by thread: dd vs windows...
- Next by thread: RE: ADS Password Storage Protection
- Index(es):
Relevant Pages
|
|
