5 ms·

C&A does much more than password cracking. It has ARP poisoning capabilities, and it also comes with a trojan (Abel) that can hijack computers remotely over Win

by hendzen 15y ago

C&A does much more than password cracking. It has ARP poisoning capabilities, and it also comes with a trojan (Abel) that can hijack computers remotely over Windows networks. For a free program, it is very powerful. Even the NSA uses it [1]. I think this also means that one-factor authentication will soon be obsolete. Of course we can keep making passwords longer and more complex, but we all know its really the users that are the problem. People have shown time and time again that they will chose bad passwords, and to make matters worse, they will use the same password for every one of their logins. Furthermore, this demo was done with a single card. Any attacker with knowledge and resources could easily link up a ton of graphics cards (or even use AWS GPU instances) giving them the ability to bruteforce most rememberable passwords. I can only imagine the scale of the massive GPU clusters that the NSA & other SIGINT focused intelligence agencies employ. [1] - http://www.washingtonpost.com/wp-srv/photo/postphotos/orb/asection/2006-01-27/4.htm http://www.washingtonpost.com/wp-srv/photo/postphotos/orb/as... (look under latest tool versions)

beaumartinez 15y ago
I'd argue that it's an issue regarding conventional password length (probably stemming from the nomenclature―rather than password, it should be passphrase). I seem to remember an article floating a month ago on strong passwords, and how long, passwords (passphrases) like "fluffy is puffy" are stronger than "s#g789@d/". Better user education (for want of a better word) is necessary as well―something as simple as adding the domain of the site in question to the password increases a user online identity by a significant amount. With Moore's law (and quantum computers on the distant horizon), passwords will get ever-easier to crack―the next logical step are keys and certificates.
- tptacek 15y ago
  State-of-the-art password schemes have addressed the "Moore's Law" problem for over a decade now.

by hendzen 15y ago

beaumartinez 15y ago

I'd argue that it's an issue regarding conventional password length (probably stemming from the nomenclature―rather than password, it should be passphrase). I seem to remember an article floating a month ago on strong passwords, and how long, passwords (passphrases) like "fluffy is puffy" are stronger than "s#g789@d/". Better user education (for want of a better word) is necessary as well―something as simple as adding the domain of the site in question to the password increases a user online identity by a significant amount. With Moore's law (and quantum computers on the distant horizon), passwords will get ever-easier to crack―the next logical step are keys and certificates.

tptacek 15y ago
State-of-the-art password schemes have addressed the "Moore's Law" problem for over a decade now.