3 ms·

do attackers wait to use passwords months after they've compromised those passwords? or, do they give themselves other ways to maintain their access so that no

do attackers wait to use passwords months after they've compromised those passwords? or, do they give themselves other ways to maintain their access so that no passwords stand in their way from that point on? it's the latter, not the former. once you're compromised, passwords, changed or not, are no longer an obstacle at all. password rotation does not increase security.

crazygringo 6y ago
Really depends on the level of access the password gives you. If you're infiltrating a company, most people's accounts certainly don't give you the level of access required to bypass the need for passwords entirely. You'd have to be specifically hacking a sysadmin's account or something. There are very many different levels of "compromised" and they're not all the same. That being said, I agree with the overall premise that password rotation is outdated.
grepthisab 6y ago
Hi, attacker here, I usually use the password immediately but it really depends on the level of user as to whether I can ensure that password changes won't affect me going forward. If you're a normal user, changing the password is helpful. Root? Forget about it.
numpad0 6y ago
> do attackers wait to use passwords months Unix-like OS in 80s-90s truncated passwords to 8 bytes, hashed in MD5 and stored them to regular file `/etc/passwd`. And in those era it was estimated to take six months to few centuries to brute force a password, therefore it was recommended to maximally complicate the password within 8 letters in length, and change it every one half the brute forcing time, or three months. Supposedly everything made sense in that timeframe in that context.
- cesarb 6y ago
  > Unix-like OS in 80s-90s truncated passwords to 8 bytes, hashed in MD5 and stored them to regular file `/etc/passwd`. In the era when password hashes were still readable to everyone in /etc/passwd (this was later fixed by storing the passwords instead in a shadow file called /etc/shadow which can only be read by root), it was not MD5, but "crypt" (a DES variant). AFAIK, the MD5 and newer password hashing schemes don't truncate the password to 8 bytes, only traditional "crypt" did that.
- jodrellblank 6y ago
  A 1979 UNIX /etc/passwd file surfaced a couple of years ago (it's on Github[1]) and people tried to brute force the passwords; Brian Kernighan's was the weakest. Ken Thomson's took "more than four days on an AMD Radeon RX Vega64 system running hashcat ( a password cracking tool) at about 930MH/s (Million Hashes per second)" and was the last to fall. https://inbox.vuxu.org/tuhs/87bluxpqy0.fsf@vuxu.org/ https://inbox.vuxu.org/tuhs/87bluxpqy0.fsf@vuxu.org/ https://fossbytes.com/unix-co-founder-ken-thompsons-bsd-password-cracked/ https://fossbytes.com/unix-co-founder-ken-thompsons-bsd-pass... [1] https://github.com/dspinellis/unix-history-repo/tree/BSD-3-Snapshot-Development/etc https://github.com/dspinellis/unix-history-repo/tree/BSD-3-S...
SamuelAdams 6y ago
I once read a book where an attacker accessed a live system with a set of compromised credentials, then found some "disabled" accounts from retired staff, re-enabled them, then simply used the retired accounts for routine access. Sventek was one of those, I think.
- teddyh 6y ago
  https://en.wikipedia.org/wiki/The_Cuckoo%27s_Egg_(book) https://en.wikipedia.org/wiki/The_Cuckoo%27s_Egg_(book)

crazygringo 6y ago

Really depends on the level of access the password gives you. If you're infiltrating a company, most people's accounts certainly don't give you the level of access required to bypass the need for passwords entirely. You'd have to be specifically hacking a sysadmin's account or something. There are very many different levels of "compromised" and they're not all the same. That being said, I agree with the overall premise that password rotation is outdated.

grepthisab 6y ago

Hi, attacker here, I usually use the password immediately but it really depends on the level of user as to whether I can ensure that password changes won't affect me going forward. If you're a normal user, changing the password is helpful. Root? Forget about it.

numpad0 6y ago

> do attackers wait to use passwords months Unix-like OS in 80s-90s truncated passwords to 8 bytes, hashed in MD5 and stored them to regular file `/etc/passwd`. And in those era it was estimated to take six months to few centuries to brute force a password, therefore it was recommended to maximally complicate the password within 8 letters in length, and change it every one half the brute forcing time, or three months. Supposedly everything made sense in that timeframe in that context.

cesarb 6y ago
> Unix-like OS in 80s-90s truncated passwords to 8 bytes, hashed in MD5 and stored them to regular file `/etc/passwd`. In the era when password hashes were still readable to everyone in /etc/passwd (this was later fixed by storing the passwords instead in a shadow file called /etc/shadow which can only be read by root), it was not MD5, but "crypt" (a DES variant). AFAIK, the MD5 and newer password hashing schemes don't truncate the password to 8 bytes, only traditional "crypt" did that.
jodrellblank 6y ago
A 1979 UNIX /etc/passwd file surfaced a couple of years ago (it's on Github[1]) and people tried to brute force the passwords; Brian Kernighan's was the weakest. Ken Thomson's took "more than four days on an AMD Radeon RX Vega64 system running hashcat ( a password cracking tool) at about 930MH/s (Million Hashes per second)" and was the last to fall. https://inbox.vuxu.org/tuhs/87bluxpqy0.fsf@vuxu.org/ https://inbox.vuxu.org/tuhs/87bluxpqy0.fsf@vuxu.org/ https://fossbytes.com/unix-co-founder-ken-thompsons-bsd-password-cracked/ https://fossbytes.com/unix-co-founder-ken-thompsons-bsd-pass... [1] https://github.com/dspinellis/unix-history-repo/tree/BSD-3-Snapshot-Development/etc https://github.com/dspinellis/unix-history-repo/tree/BSD-3-S...

SamuelAdams 6y ago

I once read a book where an attacker accessed a live system with a set of compromised credentials, then found some "disabled" accounts from retired staff, re-enabled them, then simply used the retired accounts for routine access. Sventek was one of those, I think.

teddyh 6y ago
https://en.wikipedia.org/wiki/The_Cuckoo%27s_Egg_(book) https://en.wikipedia.org/wiki/The_Cuckoo%27s_Egg_(book)