There are easier ways -- FTK Imager lite does not ...

2010-03-09T00:07:20.826-08:00

There are easier ways -- FTK Imager lite does not (as yet, anyway) trigger AV, and does not do anything too unpleasant to the system it runs on.

I'd like to add that password security should not be about about what passwords individual users set. Leaving last line of defense in the hands of users is just not done.

Instead it should be about the authentication situation where those passwords are used. How fast can a password-guessing attack be done? For how long can an attacker do such an attack before he's discovered? And, of course, how many guesses would it take to find a password under those conditions. Increasing password strength (i.e. how long it takes to guess the password) is not necessarily the most efficient countermeasure.

Even a very liberal lockout policy (say, after 20 failed attempts per hour), puts a very effective stop to prolonged password guessing without inconveniencing users or support desk. Add to that logging failed authentication attempts in general, and analyzing the general situation,and even slow-motion attacks can be discovered.

In that kind of situation, passwords only need to withstand a much smaller number of guessing attempts until the attack is discovered and controlled.

In other words, the effort is probably better spent improving the full authentication situation that only passwords.

In general, that is -- in this case, you may already have those things controlled to the point where passwords are the next step.

@Miha To gather the master list of password hashes...

2010-03-08T14:00:19.043-08:00

@Miha
To gather the master list of password hashes I had a system administrator run the fgdump utility on a domain controller. This can be a bit tricky because anti-virus software will alert on the file. So first we have to temporarily disable real time protection, then run fgdump.

Also when running fgdump, we had to turn off the feature whereby it tries to disable antivirus (which we've already disabled). I believe that is the -a option, but I'm not positive right now.

Could you describe in some greater detail how (fro...

2010-03-08T02:38:10.332-08:00

Could you describe in some greater detail how (from where exactly) did you get the original fgdump list?

Comments on Black Fist Security: Password cracking revisited

There are easier ways -- FTK Imager lite does not ...

@Miha To gather the master list of password hashes...

Could you describe in some greater detail how (fro...