An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.
10
votes
6answers
4k views
Invalid users trying to log in to my server
Im getting a lot of log attempts from unknown IP addresses and and this is happening every minute, I am using private and public keys to log in with SSH.
I have noticed that even with private and ...
4
votes
1answer
326 views
Can a Bitlocker To Go user pin be brute forced?
I have a external hard disk and protected a partition on it with Bitlocker To Go. I printed the recovery code but I lost it. I can't remember the user PIN either. If I could only know the first ...
2
votes
2answers
127 views
Cloud services - A window to outsourcing illegal activities?
Recently I was exposed to a number of stories where alleged illegal activities (for this case, we can take brute-force) are outsourced to the cloud, and are run by the cloud providers. The providers, ...
3
votes
2answers
294 views
Implementing brute force attacks on hash values in Javascript
I'm working for my bachelor thesis at the end of which I aim to implement a proof-of-concept Javascript-based hash cracker. The idea is to work like this: Users can submit a hash value along with ...
3
votes
2answers
5k views
Remove Password Protection from XLS Document
Similar to what is listed here, http://datapigtechnologies.com/blog/index.php/hack-into-a-protected-excel-2007-or-2010-workbook/, is there a way to remove the password from an XLS (Excel 2003) ...
3
votes
1answer
3k views
Is my router vulnerable if WPS is enabled but WPS pin code is disabled?
I was reading about Reaver and wi-fi protected setups (WPS).
In my Netgear router I have the option to disable the WPS pin code, but still have the WPS push button enabled. Am I secured with such ...
1
vote
2answers
802 views
Computing RSA 1024-bit Decryption Performance [closed]
I want to be able to tell how many keys per second, using RSA 1024-bit keys, can be checked on a standard Pentium 4 system. How can I use this to determine decryption performance, and possibly ...
2
votes
3answers
297 views
How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)
After the hack of Mat Honan I studied my own laundry list of accounts I have at the numerous web sites I use. There is one fact that stands out:
Many of the websites severely restrict the size and ...
0
votes
1answer
500 views
How many possibilities can today's computers check (per second) in a SHA512 hash of a 50-byte-long random entry? [closed]
The problem I want to avoid is "brute force" attacks against a database. So if I add a 50-byte-long cryptographically random salt to my information (which I don't need to retrieve, just its hash) - is ...
2
votes
2answers
243 views
Seeking advice on how to build a box to brute force hashes? [closed]
I work in a startup security firm, and I need to build a GPU-based to brute force password/hashes, which can be used to validate password strength and test hashing algorithms. I expect some high ...
1
vote
2answers
228 views
Hash, encryption of file… key? Need help [closed]
So my previous question was with some help on pcap files as I am doing a security course and we have a challenge to figure out what was going on in our network. Now one of the files I retrieved is an ...
2
votes
3answers
850 views
Securing AES 128 encrypted ZIPs against brute force attacks
How long would it take to brute force decrypt an AES 128 encrypted zip file if the password is 8 characters long in the range of A-Z, a-z, 1-9?
Does it make any difference if .NET's System.Random ...
1
vote
2answers
630 views
how long does it take to brute force varying encryption standards?
Let's say I want to encrypt information in a database. What would be the best encryption algorithm to use and why. I was thinking AES, since it's widely used as a government standard, but if the ...
-2
votes
6answers
335 views
Are passwords made up from concatenating a few foreign words better than shorter random characters?
Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example:
"pussiMeansCatInEskimo"
"caballoMeansHorse"
"CatIsGatto"
"SalopeMeansBitch"
...
2
votes
2answers
141 views
ASLR in Ubuntu 11.10
In many of the exploits I see nowadays, brute forcing is a common method of bypassing ASLR on 32 bit machines. However, many of these exploits crash the current process, for example, PHP. Isn't the ...
1
vote
3answers
195 views
Mass account lockout prevention using CSRF tokens
I'm currently working on reducing the risk of mass account lockout on a site that (unfortunately) issues sequential, numeric user IDs. Changing the structure of the userID is not an option at this ...
3
votes
1answer
392 views
Reasonable (BruteForce) Attempts/Second Estimate?
I've read various articles on password strength and passwords vs pass phrases (including the one from XKCD and its thread here), but most of those articles seem to be focused on online passwords, and ...
1
vote
3answers
1k views
How should I defend against TightVNC brute-force attacks?
How should I defend against this type of attack? This is a tightvnc logfile excerpt from a linode cloud server running Ubuntu 12.04 (Precise) with the ubuntu-desktop package added to the bare server. ...
1
vote
1answer
609 views
Brute-force a passphrase, generated by `pwgen 16 -s`, of a GPG CAST5 archive
A sad story: One of our hard drives failed. While it was failing, we managed to take a quick backup. As it is our standard practice, we encrypted the backup using GPG (by however method Duplicity uses ...
1
vote
1answer
2k views
How to use http-get-form in THC-Hydra?
I've been messing with Hydra (Brute Force) to solve the "Damn Vulnerable Web App"
brute force section but the problem is when I use http-get-form it said:
Warning: child 1 seems to have died, ...
17
votes
7answers
738 views
Are common passwords at particular risk?
The question Should we disallow common passwords like “password” and “12345”? on User Experience immediately made me think that these common passwords were extremely dangerous not because they are ...
0
votes
1answer
610 views
tightvnc authentication failure problem [closed]
When I run a tightvnc client to establish a VNC session I sometimes receive an error message that suggests there are repeated failed VNC login attempts or a brute force attack.
The message dialog ...
2
votes
1answer
304 views
Academic papers on GPU password cracking?
Are there any scientific papers or publications on GPU password cracking?
0
votes
1answer
137 views
Stripping / appending characters from user password before hashing to conceal it forever?
I had this idea to permanently conceal user password by requiring minimum length then stripping certain characters. For example if the user password is secret123, the system will strip it down to ...
2
votes
2answers
276 views
Can key files be brute-forced like passwords?
Let's say you use a program like Truecrypt or Keepass which allows you to have a password + key file. I understand that passwords can be brute-forced/dictionary-attacked but is the same true for key ...
5
votes
2answers
189 views
Are more passwords breached via dictionary/bf attacks or via packet-sniffers/key-loggers?
This question has always intrigued me whenever the subject of passwords is brought up. Does anyone have direct experience or a reputable source to answer what percentage of password breaches are ...
5
votes
3answers
622 views
Can ssh keyfile security be broken in a few hours if the file is exposed?
At this link there is a claim that if an RSA key has a strong passphrase security might be broken in a few hours if an attacker has the private key.
Is there something weak about the security of RSA ...
3
votes
5answers
543 views
Is passwords with combination of different encodings super safe?
I was thinking about generating passwords with combination of English, Arabic, Chinese charac. Is this pass secure enough against brute force attacks?
17
votes
5answers
1k views
What's the practical limit for rainbow-table based bruteforce?
Say we have a hash of a password. The password can be considered to be made of of totally random characters and has a fixed length of N. The hash is SHA1(password+salt), where the salt is of length M. ...
5
votes
2answers
345 views
mysql security logging
Is there any logging available that logs mysql connection attempts to the port, login attempts, and times succeeded with username, IP address and date time?
Im trying to detect brute force attempts.
...
6
votes
2answers
377 views
How can I restrict users' connection attempts to my FTP server?
Is there any way possible to restrict user to make a connection to the FTP server on my Windows XP computer?
I have an FTP server established in Windows XP and now I want to make access to that FTP ...
5
votes
1answer
116 views
General purpose slow/unique hash routine for dup checking of private data, without storing the data itself?
I am wondering if there is a percentage of uniqueness known to be lost with every repeat of various hash routines, like MD5, SHA1, and how that might compare with other algorithms.
If theoretically I ...
7
votes
8answers
1k views
With which algorithm I can prevent a brute force on a login?
I want make my software more secure. I want prevent it from brute force attack. I know that a strong password is the best but I can not control it.
The algorithm must scale from a very small system ...
3
votes
1answer
303 views
Non English password dictionaries
What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
1
vote
3answers
591 views
What utilities exist to brute force a username and password?
I'm trying to persuade management to purchase two factor authentication for securing VPN and terminal server access.
I've made significant progress by demoing TSGrinder, but would like to list other ...
4
votes
3answers
883 views
What are the odds of brute-forcing an archive with 256-bit encryption?
I have a file (a stand-alone archive). I lost the password to it, but it has been encrypted using 256-bit encryption. The password is some 20-odd characters long (including non-alphanumeric ...
6
votes
4answers
1k views
Is .htaccess protection secure enough?
For the moment we protect a directory on our site with .htaccess and .htpasswd. But I was wondering how secure this is? Are there things I should watch for or can do make it more secure?
I don't know ...
10
votes
1answer
848 views
Timing attacks on password hashes
Timing attacks can have a devastating impact in scenarios where the secret is involved, often in cases where byte-wise array comparison is used.
Now there are those that advertise using constant ...
-1
votes
3answers
1k views
Number of AES-256 operations per second on a maximized Cray XE6
How many FLOPs does one AES-256 operation take in ECB mode? How many AES-256 operations in ECB mode can a maximized Cray XE6 perform per second?
Cray states that it can be scaled to over 1 million ...
7
votes
3answers
235 views
How do I secure my advertisement space against ad overlay browser attachments?
I don't really have an issue with advertisements simply being blocked by individual users who are visiting a customers site or my own site. As an individual you have the freedom to choose not to look ...
3
votes
1answer
578 views
It's really that insecure to have POP3 enabled in my gmail account?
Several people are claiming that you should turn off pop3 in gmail because it allowed bruteforce attacks on the password.
Doesn't Google prevent this kind of attacks? What is the truth on this ...
3
votes
2answers
563 views
Known Password Lengths and security considerations
Many people wil often brag about the length of their password, like "yeah nobody is ever going to crack my password cause its 22 characters long." I was thinking, if you knew the exact length of their ...
2
votes
1answer
12k views
How long to brute-force WPA password?
Bob has a password (for his WPA encrypted wifi) which is 8 characters, all lowercase, and not a dictionary word.
Eve lives next door to Bob and wants to illegally hack his WPA. The number of ...
7
votes
3answers
403 views
It is possible that brute force attempts are successful before the worst case, correct?
When I read about a password being secure and stating that it would take X amount of week, years, etc. isn't that referring to the worst case?
What happens if the brute force method is successul in ...
2
votes
3answers
762 views
what is the fastest and cheapest way to crack this kind of hash - md5(md5($password) + salt))?
I'm looking for a program that can use any GPU (ATI\NVIDIA) and can brute force a vBulletin hash - md5(md5($password) + salt)).
I have the salt and hash.
the password contains the symbols - ...
9
votes
2answers
283 views
How much security is compromised if we accept other characters as login (other than the original password)?
I've just realised that facebook accepts 3 forms of a password:
Source:
Facebook actually accepts three forms of your password:
Your original password.
Your original password with the ...
5
votes
3answers
649 views
Attack vectors for brute-forcing website passwords
When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
4
votes
4answers
705 views
Brute-force heuristics used in password cracking
Existing questions on this site discuss some of the heuristics used by password cracking tools to avoid doing a completely naive brute-force search (for example, "dictionary word with number ...
6
votes
4answers
907 views
Password entropy in layman's terms
Entropy is a term used often in relation to password security and brute-force attacks, but it is a topic that can get complicated quickly. What is the best way to describe password entropy (what it is ...
4
votes
3answers
160 views
What alternatives do email services provide when an account is hacked?
I am concerned about how does email services like Yahoo, Gmail, Hotmail etc provide security to their costumers and prevent their account from being compromised.
For example,
I have seen that if ...
