Re: Hacked Passwords


"silas" <kiai_viper@xxxxxxxxxxx> wrote in message
news:%23QQ2k4P6GHA.4568@xxxxxxxxxxxxxxxxxxxxxxx
I am a pen tester. Believe me, anything under 15 characters is already
cracked. The reason behind that is that when Windows stores passwords that
are 15 characters or larger, there is a flaw and it will store the hash as
a null hash starting with the AAD3 characters.

It doesn't have to be that way. Windows can and should be configured not to
store the older LM Hash format. I believe the computers you crack that way
are cracked more because they were not configured securely. Keep in mind
also that if you are brute forcing the weaker LM Hash-stored password
hashes, it is because you already gained admin privileges on the box via
another vulnerability. But I agree that length is more important than
complexity, and that complexity rules can cause users to write down their
passwords on pieces of paper.


.

Relevant Pages

  • Re: Decrypt
    ... that you store the encrypted passwords on the server. ... In fact, don't just hash the passwords, but combine the password ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Is it necessary to store the entire MD5, etc. hash for validation?
    ... >I want to store the last 10 passwords used on a legacy database that, ... but I don't have room to store 10x128+ bytes. ... I think you are mistaken about the size of the output of hash functions, ... passphrase hashes if you use SHA-256, ...
    (sci.crypt)
  • Re: secure storage in Active Directory
    ... AD does not store user account passwords - it stores a hash of ... > I understand that the Active Directory stores user data and passwords. ... > How does it store these securely within its internal structure? ... they store the password hash. ...
    (microsoft.public.security)
  • Re: secure storage in Active Directory
    ... AD does not store user account passwords - it stores a hash of ... > I understand that the Active Directory stores user data and passwords. ... > How does it store these securely within its internal structure? ... they store the password hash. ...
    (microsoft.public.win2000.security)
  • Re: couple of questions on MD5 hashing
    ... > How many characters do you need in a password to generate more passwords ... By prefixes of a hash I ... but I think you are asking: How many characters do I need in a message to be able to generate more than ...
    (comp.programming)