Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!sharkey!cfctech!teemc!ka3ovk!drilex!axiom!linus!chance!ccel
From: ccel@chance.uucp (CCEL)
Newsgroups: comp.unix.questions
Subject: Re: passwds and crypt(3)...
Message-ID: <85604@linus.UUCP>
Date: 5 Jan 90 14:29:03 GMT
References: <21913@adm.BRL.MIL> <1990Jan2.222052.915@athena.mit.edu> <1990Jan3.103141.9903@gdt.bath.ac.uk>
Sender: news@linus.UUCP
Reply-To: rtidd@mwunix.mitre.org
Organization: MITRE-McLean Software Engineering Laboratory
Lines: 28

In article <1990Jan3.103141.9903@gdt.bath.ac.uk> exspes@gdr.bath.ac.uk (P E Smee) writes:
>In article <1990Jan2.222052.915@athena.mit.edu> jik@athena.mit.edu (Jonathan I. Kamens) writes:

>>What the program does it take each word in the password dictionary and
>>encrypt it using the seed in the /etc/passwd file.  Then, it checks if
>>the encrypted string which is returned is the same as your encrypted
>>password string, and if it is, it has found your password!
>
>Unstated, but implicit, is the fact that it is even worse if the perpetrator
>just wants to break *some* password(s), not necessarily yours.  Having
>encrypted a 'trial' password once, it can then be checked against all
>encrypted passwords in /etc/passwd to see if it gets any hits.

Funny you should mention this, my roommate ran a program that does
just this on our college's Ultrix machine (i'll leave out the names).
Just as a test, he wanted to find all the users whose passwords were
the same as their login names. He "cracked" about 35 passwords on the
first pass, including about 25 faculty accounts (kind of disturbing
that CS faculty members would be so careless with their passwords).
The University ended up charging him about $2800.00, something about
misuse of computer time...




Randy Tidd
rtidd@mwsun@mitre.org
#define DISCLAIM TRUE