7 ms·

Awesome, just watched this two nights ago. fun to think even in 1992 it was still acceptable to show someone cracking a password by whittling down the passwords

Awesome, just watched this two nights ago. fun to think even in 1992 it was still acceptable to show someone cracking a password by whittling down the passwords one character at a time. To their credit at least it was a bit better than war games, where it just locks in one character at a time. Where this one could maybe construe that it started with some hash of the pin stored on the machine and accessible via the card reader in reverse..., and they were maybe factoring it. Still an awesome scene and by far my favorite james cameron movie.

efdee 6y ago
I remember once writing an IRC script for Microsoft's IrcX implementation that unmasked a masked IP, literally one character at a time. Sometimes these things are by design. :-)
viceroyalbean 6y ago
To be fair, some side channel attacks do allow locking in one character at a time. For example, if a password is evaluated by looking at the string character by character and breaking once an incorrect character is found you might be able to use the response timing to figure out how many correct characters you have.
- heywire 6y ago
  I remember this being one of the fun levels in the Stripe Capture-the-Flag contest they ran a few years back. Still got my t-shirt :)
  - dividuum 6y ago
    Yep. Level 6 in the first one :-) IIRC their challenge machines were under quite a bit of load and I had difficulties getting the proper solution. If anyone is interested for some reason, here's my writeup including their code and my exploit: https://github.com/dividuum/stripe-ctf https://github.com/dividuum/stripe-ctf
jleahy 6y ago
I once wrote a piece of software that cracked passwords for Windows 9x network shares. It looked just like the movies, it would crack one letter of the password at a time, each letter would cycle through the possibilities and then lock in, before it would move onto the next character. Those with a good memory of exploits will recall the exploit that was used. So it's not necessarily fictional, sometimes it does work like that. I wasn't alive in the 80s, but I would guess that such things were very common back then (but obviously are non-existent now).
- 10x-dev 6y ago
  I used L0phtcrack for that. Fun times over dial-up! Sometimes I miss how easy things were. Passwords in type=hidden fields. Basic auth over http. Dumb hubs sending packets to everyone on the network. C$ shared drives on the Internet and, of course, Sub7.
  - jleahy 6y ago
    Ah Sub7... a single tear runs down my cheek
bhauer 6y ago
My favorite feature of that scene in Wargames is that when Joshua/WOPR gets down to two or one digit remaining, there is still time to have suspenseful dialog. This in spite of the fact that there would only be 100 or 10 remaining permutations to test with so few digits remaining, and the animation shows several dozen being tested per second. Nevertheless, Joshua seems to keep trying the wrong last couple digits to give the humans some more time to act.
10x-dev 6y ago
Terminator 2 and Turbo Pascal were my 2 favorite things during teen years! I have actually rewatched Terminator 2 about 50 times - every day after school. My parents started getting worried at some point. I still remember a good chunk of the dialogue. My parents sent me to my grandmother's during summer break, but they also allowed me to take my 386. I wrote DOS games in Turbo Pascal the entire time, and only saw my grandparents at mealtime. Then I got a talking to because of the monstrous electric bill a 386 running 24/7 racked up. These days I use Android Studio, which could really take some notes from TPX.EXE.

efdee 6y ago

I remember once writing an IRC script for Microsoft's IrcX implementation that unmasked a masked IP, literally one character at a time. Sometimes these things are by design. :-)

viceroyalbean 6y ago

To be fair, some side channel attacks do allow locking in one character at a time. For example, if a password is evaluated by looking at the string character by character and breaking once an incorrect character is found you might be able to use the response timing to figure out how many correct characters you have.

heywire 6y ago
I remember this being one of the fun levels in the Stripe Capture-the-Flag contest they ran a few years back. Still got my t-shirt :)
- dividuum 6y ago
  Yep. Level 6 in the first one :-) IIRC their challenge machines were under quite a bit of load and I had difficulties getting the proper solution. If anyone is interested for some reason, here's my writeup including their code and my exploit: https://github.com/dividuum/stripe-ctf https://github.com/dividuum/stripe-ctf

jleahy 6y ago

I once wrote a piece of software that cracked passwords for Windows 9x network shares. It looked just like the movies, it would crack one letter of the password at a time, each letter would cycle through the possibilities and then lock in, before it would move onto the next character. Those with a good memory of exploits will recall the exploit that was used. So it's not necessarily fictional, sometimes it does work like that. I wasn't alive in the 80s, but I would guess that such things were very common back then (but obviously are non-existent now).

10x-dev 6y ago
I used L0phtcrack for that. Fun times over dial-up! Sometimes I miss how easy things were. Passwords in type=hidden fields. Basic auth over http. Dumb hubs sending packets to everyone on the network. C$ shared drives on the Internet and, of course, Sub7.
- jleahy 6y ago
  Ah Sub7... a single tear runs down my cheek

bhauer 6y ago

My favorite feature of that scene in Wargames is that when Joshua/WOPR gets down to two or one digit remaining, there is still time to have suspenseful dialog. This in spite of the fact that there would only be 100 or 10 remaining permutations to test with so few digits remaining, and the animation shows several dozen being tested per second. Nevertheless, Joshua seems to keep trying the wrong last couple digits to give the humans some more time to act.

10x-dev 6y ago

Terminator 2 and Turbo Pascal were my 2 favorite things during teen years! I have actually rewatched Terminator 2 about 50 times - every day after school. My parents started getting worried at some point. I still remember a good chunk of the dialogue. My parents sent me to my grandmother's during summer break, but they also allowed me to take my 386. I wrote DOS games in Turbo Pascal the entire time, and only saw my grandparents at mealtime. Then I got a talking to because of the monstrous electric bill a 386 running 24/7 racked up. These days I use Android Studio, which could really take some notes from TPX.EXE.