An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.
2
votes
2answers
292 views
Can key files be brute-forced like passwords?
Let's say you use a program like Truecrypt or Keepass which allows you to have a password + key file. I understand that passwords can be brute-forced/dictionary-attacked but is the same true for key ...
5
votes
3answers
668 views
Can ssh keyfile security be broken in a few hours if the file is exposed?
At this link there is a claim that if an RSA key has a strong passphrase security might be broken in a few hours if an attacker has the private key.
Is there something weak about the security of RSA ...
3
votes
5answers
545 views
Is passwords with combination of different encodings super safe?
I was thinking about generating passwords with combination of English, Arabic, Chinese charac. Is this pass secure enough against brute force attacks?
5
votes
2answers
354 views
mysql security logging
Is there any logging available that logs mysql connection attempts to the port, login attempts, and times succeeded with username, IP address and date time?
Im trying to detect brute force attempts.
...
3
votes
1answer
312 views
Non English password dictionaries
What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
6
votes
2answers
392 views
How can I restrict users' connection attempts to my FTP server?
Is there any way possible to restrict user to make a connection to the FTP server on my Windows XP computer?
I have an FTP server established in Windows XP and now I want to make access to that FTP ...
5
votes
1answer
119 views
General purpose slow/unique hash routine for dup checking of private data, without storing the data itself?
I am wondering if there is a percentage of uniqueness known to be lost with every repeat of various hash routines, like MD5, SHA1, and how that might compare with other algorithms.
If theoretically I ...
7
votes
8answers
1k views
With which algorithm I can prevent a brute force on a login?
I want make my software more secure. I want prevent it from brute force attack. I know that a strong password is the best but I can not control it.
The algorithm must scale from a very small system ...
6
votes
5answers
687 views
Are there any security measures that are resistant to a brute force attack?
I'm not talking in particular about encryption, but security as a whole. Are there any security measures that can be put in place to protect data and/or a system that can withstand even a hypothetical ...
7
votes
3answers
236 views
How do I secure my advertisement space against ad overlay browser attachments?
I don't really have an issue with advertisements simply being blocked by individual users who are visiting a customers site or my own site. As an individual you have the freedom to choose not to look ...
1
vote
3answers
634 views
What utilities exist to brute force a username and password?
I'm trying to persuade management to purchase two factor authentication for securing VPN and terminal server access.
I've made significant progress by demoing TSGrinder, but would like to list other ...
6
votes
4answers
1k views
Is .htaccess protection secure enough?
For the moment we protect a directory on our site with .htaccess and .htpasswd. But I was wondering how secure this is? Are there things I should watch for or can do make it more secure?
I don't know ...
10
votes
1answer
886 views
Timing attacks on password hashes
Timing attacks can have a devastating impact in scenarios where the secret is involved, often in cases where byte-wise array comparison is used.
Now there are those that advertise using constant ...
-1
votes
3answers
1k views
Number of AES-256 operations per second on a maximized Cray XE6
How many FLOPs does one AES-256 operation take in ECB mode? How many AES-256 operations in ECB mode can a maximized Cray XE6 perform per second?
Cray states that it can be scaled to over 1 million ...
6
votes
4answers
932 views
Password entropy in layman's terms
Entropy is a term used often in relation to password security and brute-force attacks, but it is a topic that can get complicated quickly. What is the best way to describe password entropy (what it is ...
3
votes
1answer
594 views
It's really that insecure to have POP3 enabled in my gmail account?
Several people are claiming that you should turn off pop3 in gmail because it allowed bruteforce attacks on the password.
Doesn't Google prevent this kind of attacks? What is the truth on this ...
3
votes
2answers
581 views
Known Password Lengths and security considerations
Many people wil often brag about the length of their password, like "yeah nobody is ever going to crack my password cause its 22 characters long." I was thinking, if you knew the exact length of their ...
10
votes
2answers
284 views
How much security is compromised if we accept other characters as login (other than the original password)?
I've just realised that facebook accepts 3 forms of a password:
Source:
Facebook actually accepts three forms of your password:
Your original password.
Your original password with the ...
6
votes
2answers
1k views
Dictionary Attack on Wifi
I know a few people with pretty weak passwords. What kind of systems exist to prevent dictionary attacks? Would it make sense to restrict the number of connection attempts in a certain timeframe?
...
7
votes
3answers
414 views
It is possible that brute force attempts are successful before the worst case, correct?
When I read about a password being secure and stating that it would take X amount of week, years, etc. isn't that referring to the worst case?
What happens if the brute force method is successul in ...
8
votes
3answers
1k views
time to crack file-encryption password - more than just iteration
I have often seen that takes x amount of time to crack a certain length password. But this just seems to be the amount of time it takes to iterate through all the possibilities. What about the time it ...
2
votes
1answer
13k views
How long to brute-force WPA password?
Bob has a password (for his WPA encrypted wifi) which is 8 characters, all lowercase, and not a dictionary word.
Eve lives next door to Bob and wants to illegally hack his WPA. The number of ...
4
votes
3answers
161 views
What alternatives do email services provide when an account is hacked?
I am concerned about how does email services like Yahoo, Gmail, Hotmail etc provide security to their costumers and prevent their account from being compromised.
For example,
I have seen that if ...
4
votes
4answers
724 views
Brute-force heuristics used in password cracking
Existing questions on this site discuss some of the heuristics used by password cracking tools to avoid doing a completely naive brute-force search (for example, "dictionary word with number ...
5
votes
3answers
659 views
Attack vectors for brute-forcing website passwords
When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
1
vote
5answers
212 views
Is there something similar to DNSBL's for protecting against forceful browsing?
I want to protect a couple of Apache webservers against forceful browsing. Lately there have been multiple scans querying for non-existent applications on them like phpMyAdmin, notably known for their ...
3
votes
2answers
1k views
Why limit passwords to ascii printable characters? [duplicate]
Possible Duplicate:
Do non-keyboard characters make my password less susceptible to brute forcing?
Every article on password security that I read tells people to make the password more ...
5
votes
4answers
3k views
Brute force vs other methods of recovering passwords from shadow file
Do you know any good approach for de-hashing/actually bruteforcing hashed passwords in the shadow file?
On various operating systems, any good solutions/methods/programs.
Or is it better to upload ...
5
votes
4answers
156 views
software to keep a list of IP that try to access ssh over a set of rules and feasibility
i'm interested in software or set of scripts to keep a lists of filtered IP that attempt to brute-force ssh, and to label an IP as brute-forcing i would add some checks like:
one attempt to log as ...
18
votes
4answers
5k views
how long does it take to actually generate rainbow tables?
I've been reading up about rainbow tables as I think they're quite interesting cause they're actually a pretty simple concept.
Anyway, I was wondering, has anyone been involved in actually generating ...
4
votes
2answers
2k views
Can DES-based hashed password be recovered if salt is known?
Can a hashed password be recovered if the hashing is done with DES based crypt function in PHP and both the hash and salt are known by the attacker?
Consider the following example:
$salt = 'mysalt';
...
2
votes
1answer
513 views
Will using unicode chars in my password increase security? [duplicate]
Possible Duplicate:
Do non-keyboard characters make my password less susceptible to brute forcing?
Bruteforce tries cracking the hash with every possible combination of letters.
Then, If ...
24
votes
4answers
9k views
Are salted SHA-256/512 hashes still safe if the hashes and their salts are exposed?
Scenario: a database of hashed and and salted passwords, including salts for each password, is stolen by a malicious user. Passwords are 6-10 chars long and chosen by non-technical users.
Can this ...
8
votes
1answer
139 views
Long running SMTP session
I recently noticed an SMTP session on my server which started when a remote host connected but never seemed to result in any emails being delivered. I could see that it was probably a SPAM site and so ...
3
votes
2answers
307 views
How to optimize compressed file cracking?
I'm currently doing research on cracking encrypted, compressed files (specifically: uif, zip, 7z, dmg). Looking at all the utilities out there, it seems the time it takes to crack something is ...
2
votes
1answer
620 views
Pen test cell-phones
A customer has asked to conduct a pen-test on the phones of employees. The target is text messages in the phones. Text messages are stored on the SIM for security reasons. Physical access to the ...
