10 ms·

L0phtcrack 7 will be released as open source

160 points by atlacatl_sv 5y ago

MauranKilom 5y ago
For context: L0phtCrack -> https://en.wikipedia.org/wiki/L0phtCrack https://en.wikipedia.org/wiki/L0phtCrack DilDog -> https://en.wikipedia.org/wiki/Christien_Rioux https://en.wikipedia.org/wiki/Christien_Rioux
- codetrotter 5y ago
  The cDc were a fun gang of people I think. I was too young to know about them when they were at their top but I read about them just a couple of years later. For example, the Wikipedia page about Christen Rioux that you linked cites a news article from '99 which was entertaining to read: https://web.archive.org/web/20071105094322/http://www.networkworld.com/newsletters/sec/0712sec2.html https://web.archive.org/web/20071105094322/http://www.networ... (And also thanks to people like those that run the Internet Archive who make history accessible when original pages bitrot.)
  - marcodiego 5y ago
    Those times, end of the 90's, was basically wild west. Many uneducated people fresh on the internet, netbus just recently available, news users would install anything you ask them... I would call that real hacking but kiddies at the time had a lot of fun creating problems to the new netizens.
- mike_d 5y ago
  Also for background, L0phtcrack was sold Terahash (a company that builds password cracking machines for corporate security teams) in April of last year. Due to the GPU shortage they have been unable to produce products and are in bankruptcy. Terahash defaulted in a payment and the ownership reverted back to L0pht.
- unfocused 5y ago
  Oh wow. I forgot about them! I was just starting out as a teen in the 90s. Went to a couple of 2600 meetings waaay back in the day. That was indeed a wild west scene. I had no idea what I was doing :)
0x0nyandesu 5y ago
And this is how I got expelled from high school for "hacking"
- burnte 5y ago
  Should have worked harder at not getting caught. ;)
  - 0x0nyandesu 5y ago
    Was naive and told them everything at the first sign of trouble thinking they'd let it go cause I was only 16.... Boy was that a great life lesson.
    - handrous 5y ago
      That being honest, forthright, and taking responsibility for mistakes, is usually a terrible idea that will just get you fucked over, when you're not dealing with someone you consider a very close friend, was a truth I took a really long time to accept. I still don't like it. But there you go. I was taught, and internalized, something entirely wrong, turns out.
      - deleted 5y ago
        [deleted]
- 3gg 5y ago
  Two of us at school kind of earned the "hacker" badge. Far from being expelled, the teachers expressed admiration for our work and ability to dig into a completely unrelated area to schoolwork. We never did anything stupid or caused damage. I think the relationship was somewhat based on an implicit statement of mutual trust.
  - shakna 5y ago
    When I got caught at school for this one, the approach was really split. On the one hand, the administration punished me and one of my friends with something like six months of detentions. On the other hand, the IT admin asked us to do it again, but write him up a proper report. Basically gave us the authority to do whatever we wanted, and encouraged us that it could be a career, if we did things the right way. I think that trust and encouragement went a long way to influencing my career path.
walshemj 5y ago
Interesting that the author mentioned John The Ripper" I remember (with a lot of ass covering) using this at British Telecom back in the day - to break into some NT boxes where a customer had lost the passwords. I got a break quickly (they had used a date as the password) - before I went to stage to stage 2 and used the 20 or so development sun boxes we had over night.
- e12e 5y ago
  Quick reminder that PasswordYYYY (eg: Password2021) will pass most "secure" checks (three letter categories, capital, lowercase, numbers). Optionally add a dot or exclamation point - and odds are, in a large organization (assuming you have a list of valid logins) - you'll get a hit..
  - slaymaker1907 5y ago
    Unfortunately a lot of these programs are smart enough to figure this out automatically yet the complexity checkers aren't. I think it would be a good idea in an enterprise environment to have a a few cracking servers try to generate the potential new password for a few seconds since a lot of these passwords are easy to derive.
  - Spooky23 5y ago
    Many companies use 90 day polices as well. So Fall2012! qualifies as a secure password.
neilv 5y ago
Bit of related history about password-cracking tools... A bit before L0pht was founded, one of the open source crackers for Unix passwords was called Crack. https://en.wikipedia.org/wiki/Crack_(password_software) https://en.wikipedia.org/wiki/Crack_(password_software) At the time, SunOS was distributing the encrypted passwords for an organization over the LAN via YP (aka NIS). I worked for a company with lots of Suns and other Unix workstations, and I'd gotten almost all of the non-Suns also configured to use and trust the YP maps. (The goal was to reduce friction to engineering work, and we weren't directly connected to the Internet.) So I ran my site's passwords through Crack one evening, and it easily got many people's passwords. (I don't remember how many SPARCstations I threw at it, but it was probably only a few, less than 100 MIPS total.) Things like running Crack were within the scope of the sysadmin side of my job at time, I dutifully reported the concerning results to the head sysadmin, engineers were asked to change weak passwords, and all was good. Some people who ran Crack at some other companies, however, got in big trouble, when there was ambiguity or misunderstanding, about their authority or intent. Besides all the mischief-or-worse uses of Crack that presumably went on. (Disclosure: One of the net.famous people who got a career footnote by running Crack happened to be an acquaintance for a while, years later; I didn't ask them about what must've been a pretty upsetting event, and I just now read on Wikipedia that their case was expunged in the end.)
- tialaramex 5y ago
  > At the time, SunOS was distributing the encrypted passwords for an organization over the LAN via YP Not encrypted, hashed. Lots of people look at things like this and they erroneously come to the conclusion that the correct fix is to hide the secrets. And that's how you save up more trouble for yourself down the road because sooner or later somebody's going to steal those secrets you were hiding. The right fix is to not use Shared Secret authentication. If I don't know my users passwords in any form, I can't very well have them stolen from me, and so there isn't anything to "crack". I've pasted credentials entries from my toy WebAuthn implementation to HN before, I won't waste space doing that again here, but the point of such systems is that you could publish the credentials by which you authenticate users and not make any difference to their security.
e12e 5y ago
I wonder if it's any better than hashcat? https://github.com/hashcat/hashcat https://github.com/hashcat/hashcat
- bredren 5y ago
  Not sure but it appears l0phtcrack uses Hashcat. https://github.com/L0phtCrack/hashcatdll https://github.com/L0phtCrack/hashcatdll I am not aware of a better underlying cracking tool than Hashcat. The challenge for many organizations is putting together the hardware, and maintaining workflows between staff turnover to make effective use of Hashcat. There is a fair amount of devops and real technique to successful plan design. This is commonly handled through custom scripting and work at the command line. For distributed hashing you now have networking complexity. Throw in that some organizations require this work to be done on site in airgapped rooms and you have a market for fully supported turnkey password cracking IT and frontend workflows. Source: I worked on Forge, a password cracking workflow that leveraged Hashcat for a couple of years.
stirlo 5y ago
Great follow up tweet [0] where he shows built in a trivial to implement license check bypass for people in the scene. From his comments however it seems like it was never uncovered and instead crackers implemented a more complex difficult licensing bypass on pirated versions. [0] https://twitter.com/dildog/status/1421877460782698500 https://twitter.com/dildog/status/1421877460782698500

160 points by atlacatl_sv 5y ago

For context: L0phtCrack -> https://en.wikipedia.org/wiki/L0phtCrack https://en.wikipedia.org/wiki/L0phtCrack DilDog -> https://en.wikipedia.org/wiki/Christien_Rioux https://en.wikipedia.org/wiki/Christien_Rioux

codetrotter 5y ago
The cDc were a fun gang of people I think. I was too young to know about them when they were at their top but I read about them just a couple of years later. For example, the Wikipedia page about Christen Rioux that you linked cites a news article from '99 which was entertaining to read: https://web.archive.org/web/20071105094322/http://www.networkworld.com/newsletters/sec/0712sec2.html https://web.archive.org/web/20071105094322/http://www.networ... (And also thanks to people like those that run the Internet Archive who make history accessible when original pages bitrot.)
- marcodiego 5y ago
  Those times, end of the 90's, was basically wild west. Many uneducated people fresh on the internet, netbus just recently available, news users would install anything you ask them... I would call that real hacking but kiddies at the time had a lot of fun creating problems to the new netizens.
mike_d 5y ago
Also for background, L0phtcrack was sold Terahash (a company that builds password cracking machines for corporate security teams) in April of last year. Due to the GPU shortage they have been unable to produce products and are in bankruptcy. Terahash defaulted in a payment and the ownership reverted back to L0pht.
unfocused 5y ago
Oh wow. I forgot about them! I was just starting out as a teen in the 90s. Went to a couple of 2600 meetings waaay back in the day. That was indeed a wild west scene. I had no idea what I was doing :)

0x0nyandesu 5y ago

And this is how I got expelled from high school for "hacking"

burnte 5y ago
Should have worked harder at not getting caught. ;)
- 0x0nyandesu 5y ago
  Was naive and told them everything at the first sign of trouble thinking they'd let it go cause I was only 16.... Boy was that a great life lesson.
  - handrous 5y ago
    That being honest, forthright, and taking responsibility for mistakes, is usually a terrible idea that will just get you fucked over, when you're not dealing with someone you consider a very close friend, was a truth I took a really long time to accept. I still don't like it. But there you go. I was taught, and internalized, something entirely wrong, turns out.
    - deleted 5y ago
      [deleted]
3gg 5y ago
Two of us at school kind of earned the "hacker" badge. Far from being expelled, the teachers expressed admiration for our work and ability to dig into a completely unrelated area to schoolwork. We never did anything stupid or caused damage. I think the relationship was somewhat based on an implicit statement of mutual trust.
- shakna 5y ago
  When I got caught at school for this one, the approach was really split. On the one hand, the administration punished me and one of my friends with something like six months of detentions. On the other hand, the IT admin asked us to do it again, but write him up a proper report. Basically gave us the authority to do whatever we wanted, and encouraged us that it could be a career, if we did things the right way. I think that trust and encouragement went a long way to influencing my career path.

walshemj 5y ago

Interesting that the author mentioned John The Ripper" I remember (with a lot of ass covering) using this at British Telecom back in the day - to break into some NT boxes where a customer had lost the passwords. I got a break quickly (they had used a date as the password) - before I went to stage to stage 2 and used the 20 or so development sun boxes we had over night.

e12e 5y ago
Quick reminder that PasswordYYYY (eg: Password2021) will pass most "secure" checks (three letter categories, capital, lowercase, numbers). Optionally add a dot or exclamation point - and odds are, in a large organization (assuming you have a list of valid logins) - you'll get a hit..
- slaymaker1907 5y ago
  Unfortunately a lot of these programs are smart enough to figure this out automatically yet the complexity checkers aren't. I think it would be a good idea in an enterprise environment to have a a few cracking servers try to generate the potential new password for a few seconds since a lot of these passwords are easy to derive.
- Spooky23 5y ago
  Many companies use 90 day polices as well. So Fall2012! qualifies as a secure password.

neilv 5y ago

Bit of related history about password-cracking tools... A bit before L0pht was founded, one of the open source crackers for Unix passwords was called Crack. https://en.wikipedia.org/wiki/Crack_(password_software) https://en.wikipedia.org/wiki/Crack_(password_software) At the time, SunOS was distributing the encrypted passwords for an organization over the LAN via YP (aka NIS). I worked for a company with lots of Suns and other Unix workstations, and I'd gotten almost all of the non-Suns also configured to use and trust the YP maps. (The goal was to reduce friction to engineering work, and we weren't directly connected to the Internet.) So I ran my site's passwords through Crack one evening, and it easily got many people's passwords. (I don't remember how many SPARCstations I threw at it, but it was probably only a few, less than 100 MIPS total.) Things like running Crack were within the scope of the sysadmin side of my job at time, I dutifully reported the concerning results to the head sysadmin, engineers were asked to change weak passwords, and all was good. Some people who ran Crack at some other companies, however, got in big trouble, when there was ambiguity or misunderstanding, about their authority or intent. Besides all the mischief-or-worse uses of Crack that presumably went on. (Disclosure: One of the net.famous people who got a career footnote by running Crack happened to be an acquaintance for a while, years later; I didn't ask them about what must've been a pretty upsetting event, and I just now read on Wikipedia that their case was expunged in the end.)

tialaramex 5y ago
> At the time, SunOS was distributing the encrypted passwords for an organization over the LAN via YP Not encrypted, hashed. Lots of people look at things like this and they erroneously come to the conclusion that the correct fix is to hide the secrets. And that's how you save up more trouble for yourself down the road because sooner or later somebody's going to steal those secrets you were hiding. The right fix is to not use Shared Secret authentication. If I don't know my users passwords in any form, I can't very well have them stolen from me, and so there isn't anything to "crack". I've pasted credentials entries from my toy WebAuthn implementation to HN before, I won't waste space doing that again here, but the point of such systems is that you could publish the credentials by which you authenticate users and not make any difference to their security.

e12e 5y ago

I wonder if it's any better than hashcat? https://github.com/hashcat/hashcat https://github.com/hashcat/hashcat

bredren 5y ago
Not sure but it appears l0phtcrack uses Hashcat. https://github.com/L0phtCrack/hashcatdll https://github.com/L0phtCrack/hashcatdll I am not aware of a better underlying cracking tool than Hashcat. The challenge for many organizations is putting together the hardware, and maintaining workflows between staff turnover to make effective use of Hashcat. There is a fair amount of devops and real technique to successful plan design. This is commonly handled through custom scripting and work at the command line. For distributed hashing you now have networking complexity. Throw in that some organizations require this work to be done on site in airgapped rooms and you have a market for fully supported turnkey password cracking IT and frontend workflows. Source: I worked on Forge, a password cracking workflow that leveraged Hashcat for a couple of years.

stirlo 5y ago

Great follow up tweet [0] where he shows built in a trivial to implement license check bypass for people in the scene. From his comments however it seems like it was never uncovered and instead crackers implemented a more complex difficult licensing bypass on pirated versions. [0] https://twitter.com/dildog/status/1421877460782698500 https://twitter.com/dildog/status/1421877460782698500