297
"TIP: You can use special characters..." "Wait, no, not those, they would break our software." (i.ibb.co)
submitted 3 days ago by to c/softwaregore@lemmy.world
63 comments fedilink hide all child comments
 

https://konto.zssk.sk/zk/new#step1

Also, it only seems to show "Strong password" if any of these characters is used: !@#$%^&*, and not other special characters.

you are viewing a single comment's thread
view the rest of the comments
[–] 17 points 3 days ago* (12 children)

Can I take the opportunity to ask a question?

I work at multinational EU company, we run windows/office for the enduser. There are many parallel systems, some running linux or whatever but that’s besides the point

But there was this audit, performed by an external company, at request of the holding (mother company) that revealed unsafe passwords that contained company name in it. According to the auditors that’s a big no no

My question is: how tf do they even find out that the passwords have some specific string in it? Is it not being salted? That would surprise as our IT/network management team is very capable, and relies on windows tools that should be safe to begin

Just how?

  • permalink
  • fedilink
  • source
  • hideshow 12 child comments
    •
  • [–] 13 points 3 days ago* (3 children)

    My guesses would be that either:

    • They conducted an employee survey where someone admitted the company name being a substring of a password they use.
    • They used some rudimentary bruteforce methods which matched salted registers or logins (say "Company name123456".)
    • Instead they meant that it is possible to create passwords with the company name in it, but transmitted it poorly.
    • Some of the passwords are unsalted.
    • The passwords are logged somewhere else.

    It goes without saying that if they found a vulnerability with the hashing or salting, it should be highlighted on its own, and in any case it wouldn't do damage to ask them directly.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 4 points 2 days ago

    Thanks, it’s probably a combination of the above or even all of them

    And like another user shared, they may just be idiots

    I just wanted to confirm, there must be plain text databases, they got access to, maybe from some of the less secure systems, on the shop floor or wherever that may have unsecured protocols (they’re inside the corporate network, not directly connected to the internet)

    But I’m going with idiots

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 2 days ago (3 children)

    They could have cracked the password hashes, most likely collected NetNTLMv2 hashes, using a generated list of weak passwords using the company name + a possible ruleset with hashcat.

    Some audits still do it against all NTLM hashes stored on the AD DC, but it fell a bit out of fashion because most orgs don't feel comfortable giving out that data for a pentest.

    NetNTLMv2 and NTLM hashes are also still notoriously easy to run dictionary and combo bruteforce attacks on with GPUs.

    You can see the benchmark for an RTX 5090 here: https://gist.github.com/Chick3nman/09bac0775e6393468c2925c1e1363d5c

    It can do a whopping 340.1 GH/s for NTLM and 16017.9 MH/s for NetNTLMv2

    Compare that to a Linux's default yescrypt which didn't even have official support in hashcat until this year because the hashrate would be a measly 70-200 H/s.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 1 day ago (2 children)

    How feasible is it to attack argon2id with that method?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 1 day ago* (1 child)

    argon2id is one of those newer algorithms created specifically to make cracking infeasible and protect against certain side channel attacks.

    An example performance from an Nvidia 90HX for LUKS is:

    Hash-Mode 34100 (LUKS v2 argon2 + SHA-256 + AES) [Iterations: 16]

    Speed.#01........: 9 H/s (53.28ms) @ Accel:8 Loops:1 Thr:32 Vec:1

    So correctly implemented, basically impossible lol.

    Hashcat also added recent support for argon2id standalone and keepassxc db, so I'll see if I can run my own benchmark just to see what it shows.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 days ago*

    Is there using Windows active directory tools than there is no way an auditor can have any possible idea what anyone has set their password to. Of course they might have simply asked the question and maybe some people would dumb enough to provide the answer but there's no way they can technologically find out.

    The only thing I can think of is that active directory will sync the password to other systems so if those are the systems were insecure perhaps that way you could access the data? I'm not really sure how AD handles SSO

  • permalink
  • fedilink
  • source
  • parent