Default Passwords

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • xor
    not
    • Aug 2007
    • 1347

    #1

    Default Passwords

    What does Robert Moore's' admission in Information Week say about the state of IT security and upper managements commitment to it.

    "It's so easy. It's so easy a caveman can do it," Moore told Information Week, laughing. "When you've got that many computers at your fingertips, you'd be surprised how many are insecure."

    xor

    http://www.informationweek.com/news/...leID=202101781
    7
    That management is willing to take the security hits and is not vested in IT Security.
    28.57%
    2
    That there are too few security professionals out there to do the job.
    0%
    0
    That there are not enough resources alloted to IT Security.
    57.14%
    4
    All of the above.
    14.29%
    1
    None of above
    28.57%
    2
    XOR Shut up & Die Painfully
    14.29%
    1

    The poll is expired.

    Just because you can doesn't mean you should. This applies to making babies, hacking, and youtube videos.
  • Thorn
    Easy Bake Oven Iron Chef
    • Sep 2002
    • 1819

    #2
    Re: Default Passwords

    Originally posted by xor
    What does Robert Moore's' admission in Information Week say about the state of IT security and upper managements commitment to it.

    "It's so easy. It's so easy a caveman can do it," Moore told Information Week, laughing. "When you've got that many computers at your fingertips, you'd be surprised how many are insecure."

    xor

    http://www.informationweek.com/news/...leID=202101781
    This is nothing new. People just don't want to take the time or effort to actually think about security. Changing passwords from the default? Gosh, you have think up the new password. You have to type 8 or more characters. You have to type them twice! Shear madness! OH MY GAWD, THINK OF THE CHILDREN!

    As to the SANS's Alan Paller said, while a forced password change on the device power-up might help with a default password issue, it doesn't change the fact that people are really lazy about security. Last week I had a company admin complain to me that having email passwords was "useless" and served no real purpose. As a result of the mail server program requiring a minimum 8-character password, this person uses "password" as a default and doesn't require that users change it. When I explained a quick scenario where a disgruntled employee could easily log in as someone else and cause all sort of havoc by merely sending bitch letters and threats between employees, this admin claimed that it was very unlikely that such a thing would every happen anywhere, never mind at their company.
    Thorn
    "If you can't be a good example, then you'll just have to be a horrible warning." - Catherine Aird

    Comment

    • xor
      not
      • Aug 2007
      • 1347

      #3
      Re: Default Passwords

      I got two messages from the interview/article.

      1. That organizations especially large ones need a better way to manage passwords for a lot of different devices. I think a well protected database of router and switch passwords where authorized people could access them is a lot better than default passwords. Also router manufacturers need a way to reset the password without disturbing the configuration.

      2. Users need to be taught ways to come up with strong passwords that actually can be remembered, or switch to biometrics. Password generators work, but the sequence of numbers don't relate in anyway to the users lives. So they end up getting written in a phone, under the keyboard or some where a determined or not so determined person could access.

      A method that I suggest to end users requires you taking a familiar word, and a familiar number and transposing digits and letters. This way if forgotten the user can figure it out by simply playing with the combinations of a familiar word and number. It at least starts someone on the path to strong passwords. Though this mite not be acceptable for top secret or secret level work it takes into account that as people get older that their not as able to remember complex series of numbers and letters that change every 14 - 30 days. I recommend anywhere from 8 - 16 characters minimum.

      Recently I has to use John the Ripper Pro 1.7.2 to crack a Unix password file for the root password; passwd. It took 6 days, brute force, for an 8 character password. John was running on a Dual 1.8GHz Power MAC G5. The password was a strong password consisting of random letters and numbers.

      xor

      "I don't need to remember my own phone number, I can just look it up in the phone book."; Albert Einstein. He would have written his password under the keyboard no doubt.
      Last edited by xor; September 29, 2007, 12:03.
      Just because you can doesn't mean you should. This applies to making babies, hacking, and youtube videos.

      Comment

      • Chris
        Great Satan of the East
        • Oct 2001
        • 2866

        #4
        Re: Default Passwords

        Originally posted by xor

        Recently I has to use John the Ripper Pro 1.7.2 to crack a Unix password file for the root password; passwd. It took 6 days, brute force, for an 8 character password. John was running on a Dual 1.8GHz Power MAC G5. The password was a strong password consisting of random letters and numbers.

        xor
        While I agree with your overall premise in your post, I do think it should be pointed out that 6 days is NOTHING to an attacker. root in 6 days== teh gud
        perl -e 'print pack(c5, (41*2), sqrt(7056), (unpack(c,H)-2), oct(115), 10)'

        Comment

        • DaKahuna
          Dirty Ol' Man
          • Apr 2006
          • 664

          #5
          Re: Default Passwords

          I tell users to write down their complicated passwords and put the piece of paper in their wallets next to their money.
          DaKahuna
          ___________________
          Will Hack for Bandwidth

          Comment

          Working...