nuovo metodo di cracking password windows

Interessante, ma dubito implementabile "praticamente" se non con ingenti
investimenti.

Sarebbe curioso pensare a un sistema di cracking di questo tipo ma "distribuito" .

======
*NEW METHOD TO CRACK PASSWORD ENCRYPTION FASTER

An improved cryptanalytic method reduces the time to crack most Microsoft
Windows alphanumeric passwords from 101 seconds to 13.6 seconds. This
method (http://lasecwww.epfl.ch/php_code/publications/search.php?ref=Oech03) uses
large amounts of memory--in this case, 1.4 GB--to speed its cracking of keys.

Devised by Philippe Oechslin, a lecturer in network security at the Swiss
Federal Institute of Technology in Lausanne, the improved method builds on
a time-memory trade-off invented by Martin Hellman and enhanced by Ronald
Rivest. The basic idea is to precalculate the encrypted version (or hash)
of passwords--in this case, alphanumeric-only passwords.

"Storing all of them would make the cracking instantaneous, since you
would just look the hash up," notes Oechslin. "You would need terabytes of
memory however." Instead, only a particular subset of passwords is
generated and stored. This gives a tremendous head start in cracking
passwords, and the more memory that is available, the faster the method
works.

Oechslin has developed a way to make this method more efficient by
eliminating calculations, resulting in a tremendous improvement
improvement. Windows isn't unique in being vulnerable to this attack: any
system that encrypts passwords without using random information would also
be susceptible.

This attack doesn't pose any practical threat, since only an administrator
would be able to get the necessary hashes and users can resist this attack
by using passwords that contain more than just letters and numbers.
Administrators can also mitigate the attack by disabling the LanManager hash.

======


--

Fabio Pietrosanti ( naif )
E-mail: fabio@xxxxxxxxxxxxxx - naif@xxxxxxxxxxxxx - fpietrosanti@xxxxxxx
PGP Key available on my homepage: http://fabio.pietrosanti.it/
--
And you will learn to be paranoid and cynical...
--

________________________________________________________
http://www.sikurezza.org - Italian Security Mailing List