Cracking linux password with John the ripper – Screenshots

1.   John the Ripper is a fast password cracker for UNIX/Linux and Mac OS X.. Its primary purpose is to detect weak Unix passwords, though it supports hashes for many other platforms as well. There is an official free version, a community-enhanced version (with many contributed patches but not as much quality assurance), and an inexpensive pro version.John is different from tools like hydra. Hydra does blind bruteforcing by trying username/password combinations on a service daemon like ftp server or telnet server. John however needs the hash first. So the greater challenge for a hacker is to first get the hash that is to be cracked. Now a days hashes are more easily crackable using free rainbow tables available online. Just go to one of the sites, submit the hash and if the hash is made of a common word, then the site would show the word almost instantly. Rainbow tables basically store common words and their hashes in a large database. Larger the database, more the words covered.This post brings out screen shots showing usage of the tools with screenshots step wise....in Kali Linux

2.   In this post I am going to show you, how to use the unshadow command along with john to crack the password of users on a linux system. On linux the username/password details are stored in the following 2 files

/etc/passwd
/etc/shadow

In the screenshot below I create a user by the name of lima and create a short password for testing the tool

The unshadow command will basically combine the data of /etc/passwd and /etc/shadow to create 1 file with username and password details. Usage is quite simple as seen below :

 

Now this new file shall be cracked by john. For the wordlist we shall be using the password list that comes with john on kali linux. It is located at the following path

/usr/share/john/password.lst

 

So the password cracked is "test"

A veri simple yet powerful tool as we see from the screenshots above...

Your passwords can be cracked easily if less then 16 Characters now!!!!

1.    When the IT security big bang of Do's and Don'ts started some years back it was widely advertised to the Cyber masses to keep their respective passwords any thing more then 8 characters with a mix and match of capitals and smalls with special characters...then this was increased to 10 and last heard it was 15...and was told that 15 character password which is not dictionary based will take years and is actually uncrackable...

2.  As recent as 4 days back,a team of 3(your read it rite it's three) hackers has been able to crack more than 14,800 supposedly random passwords from a list of 16,449 by simply brute forcing!!!!

Image courtesy : http://www.buzzquake.com/tag/brute-force-attacks/

3.   In December it was unveiled by Jeremi Gosney, the founder and CEO of Stricture Consulting Group, that a 25-computer cluster can cracks passwords by making 350 billion guesses per second. It can try every possible word in less than six hours to get plain text passwords from lists of hashed passwords...the word of significance is that you do not need high end machines and east-west architecture to build this kind of IT infra...it is simply a cluster of machines processing power...

4.   The general user in the cyber space like you and me have actually no control over which hashing process websites use and therefore remain at the mercy of an algorithm all would invariably be clueless about...so if you are concerned about security and your email id and password which is the key for so many transactions in your routine life.long passwords are the best defense....and not simply long it has to be a mix match of numerics,capitals,smalls and special characters!!!.

5.  All the best to all of us...keep surfing but avoid drowning!!!! :-)Thanks http://thehackernews.com

Keystroke Dynamics Software : We all type UNIQUELY

1.     As on date Passwords are the most common form of identification but at the same time they are also the weakest. Though they are gradually being offered with replacements from the field of bio metrics,picture passwords and OTPs etc...still it will take its time before passwords are a forgotten past..now comes another cool option to identify uniquely....the concept is likely to surprise you if you have not heard of it before!!!!this is known as Keystroke Dynamics.The key points about this are bought out below in brief :

- Know as  Deepnet Security’s TypeSense keystroke dynamics software.

- TypeSense is an authentication solution based on the science of typeprint recognition that uses keystroke dynamics to accurately identify a user by the way they type characters across a keyboard. 

- Keystroke Dynamics technology extracts the distinctive characteristics found in typed sequences of characters, and creates a statistically unique signature from the typing patterns of a person. 

- These distinctive features include the duration for which keys are held and the elapsed time between successive keystrokes. This type of software runs in the background and constantly monitors your key stokes, learns your style, and can detect if your computer’s been hijacked.

- It’s relatively user-friendly and low-cost. 

- It’s mobile and can be used to access your online accounts from anywhere and can be easily integrated in your existing authentication infrastructure.

2.    But as on date the limitation is that typing style can vary greatly depending on whether you are tired, distracted, angry, medicated, or any number of other circumstances. These variations can cause the software to make false positive or negative errors.

3.    At DEFCON : 17, Andrea Barisani and Daniele Bianco demonstrated how to sniff keystrokes using unconventional side channel attacks. Wires in PS/2 keyboards leak information from the data wire into the ground wire which acts like an antenna. The leaked information about the keyboard strokes can be detected on the power outlet, as well as other wires on the same electrical system. By slicing open one of these lines, cutting the ground wire and attaching a probe, the line can be monitored and the signal isolated by filtering out the noise using software such as Scilab. The waves from the oscilloscope and the data can be streamed to the hacker’s computer where additional software is used to extract the victim’s keystroke information.Well..well ..well......there is no end!!!!

4.     Thanks https://www.mafiasecurity.com/access-control/keystroke-dynamics/ and http://www.deepnetsecurity.com/tokens/bio/typesense/

Bredolab grabs Attention

1.    A 27-year-old Armenian man has been charged as being the mastermind behind the Bredolab botnet, a network of millions of compromised computers worldwide.Main features of this trojan botnet are enumerated below for info : 

• Users of computers with viruses from this network will receive a notice of at the time of next login with information on the degree of infection. 
• Bredolab, known for spreading spam and rogue antivirus, is thought by some experts to have infected at least 30 million computers.
• Spread via drive-by attack websites and spam email attachments.
• Infecting machines with a backdoor that downloads additional malware without the victim's knowledge. 
• Sends out spoofed password reset messages to Facebook users in an attempt to spread malware and infect users of the social network.
• Has the power to obtain information on the user's computer including the ability to copy, change or delete files and other information," 
• Pushdo botnet uses Facebook to spread malicious email attachment: A phony message warns users that their Facebook password has been reset.
• Majority of infections are in the U.S. and the U.K. and many Western European countries.
• Discovered by the Dutch High Tech Crime Team in the late summer.
• Capable of infecting 3 million computers a month. The botnet network used servers hired in the Netherlands from a reseller of LeaseWeb, which is the largest hosting provider in the Netherlands, and one of the largest hosts in Europe.
• Able to constantly change its appearance to avoid detection by traditional antivirus signatures. Like other botnets, the Trojan communicated with the command-and-control server using encrypted messages.

Crack 14 Character passwords in Seconds : Objectif Sécurité

1.    There have been articles and forums on the powerful high speed GPU (video card) processors being able to easily provision cracking passwords very apace.A new technology steps here to rule the roast and allow password cracking upto 14 characters in seconds.....this is  called Objectif Sécurité ,by a Swiss security company,which uses rainbow tables on SSD drives.Seemingly it is the hard drive access time and not the processor speed that slows down cracking speed. So using SSD drives can make cracking faster, but just how fast? This technique has a phenominal capacity that could crack passwords at a rate of 300 billion passwords a second, and could decode complex password in under 5.3 seconds.

2.    A real time demo of cracking is available on line at Objectif’s free online XP hash cracker.Just visit the link and see urself by mentioning the hash in the text box.....astoundingly simple....

3. Thanks http://www.objectif-securite.ch/en/products.php