Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was thinking last night after reading an article about pen testing and security audits, why would you get a list of all the passwords for the company you are auditing and put them through a piece of software to analyse ?

share|improve this question
    
"why would you get a list of all the passwords" - You would not do this. –  Ramhound Jun 21 '12 at 15:28
    
well maybe not all of them a snippet –  OliverBS Jun 21 '12 at 15:29
1  
Well, I would guess these are password hashes... –  schlamar Jun 21 '12 at 15:33

3 Answers 3

up vote 9 down vote accepted

You wouldn't get a list of all the passwords. Any company that could or would produce such a thing would fail any reasonable security audit.

You might get a list of all the password hashes which could then be run through a tool that attempts to determine what the password is. The ease with which the password hashes can be broken and the types of passwords that are broken will be a good guide to figuring out what password complexity policies need to be addressed. If, for example, you're able to crack half of the password hashes because users are entering 6 character passwords that use all lower case letters, then you'd probably recommend increasing the minimum length and imposing some requirements about the use of uppercase letters, numbers, punctuation and other characters.

share|improve this answer
1  
Oh right, I see that makes more sense now. thanks –  OliverBS Jun 21 '12 at 15:37
    
Though it is a bad idea, there is always the suggestion to increase complexity. See why this is wrong: xkcd.com/936 –  schlamar Jun 21 '12 at 15:42
    
@ms4py - Sure, there are different ways to craft the rules to ensure the passwords are complex enough. If you require 20 character passwords, for example, you probably don't care about whether the password is in all lower case. Then there is the matter of training your users to generate and remember 4 random common words or to pick the first character from each word in a long phrase. Password complexity rules aren't perfect, but they do at least prevent users from using "password" or "password1" as their password. –  Justin Cave Jun 21 '12 at 15:54

If you do this from the same ip number and for root account and you have firewall switch off and sshd started up - this is definitely dangerous :-)

ps. Passwords should not be used in plain text, it should be stored only in the memory of users. Dealing with lists of user passwords would be seriously no good.

The best is to enforce a nice policy on password change and expire them, so after users will be asked to change the password, so then you will know that it's all fine and the passwords are strong. And they should be stored as salted hash, preferably 100.000 times hashed.

share|improve this answer

To test for potentially weak passwords that can be cracked easily by a malicious attacker.

This could give an indication of the state of the password policy of the particular company, which might be an issue in certain circumstances.

If there are plenty of weak passwords found, the pen tester could suggest to the company to change and enforce a better password policy.

Of course, i see no reason to ask the company to hand over a list of passwords. Perhaps it could be a list of passwords found after compromising a user database, or a linux shadow file.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.