I was thinking last night after reading an article about pen testing and security audits, why would you get a list of all the passwords for the company you are auditing and put them through a piece of software to analyse ?
3
-
"why would you get a list of all the passwords" - You would not do this.– RamhoundCommented Jun 21, 2012 at 15:28
-
well maybe not all of them a snippet– OliverBSCommented Jun 21, 2012 at 15:29
-
1Well, I would guess these are password hashes...– schlamarCommented Jun 21, 2012 at 15:33
Add a comment
|
3 Answers
You wouldn't get a list of all the passwords. Any company that could or would produce such a thing would fail any reasonable security audit.
You might get a list of all the password hashes which could then be run through a tool that attempts to determine what the password is. The ease with which the password hashes can be broken and the types of passwords that are broken will be a good guide to figuring out what password complexity policies need to be addressed. If, for example, you're able to crack half of the password hashes because users are entering 6 character passwords that use all lower case letters, then you'd probably recommend increasing the minimum length and imposing some requirements about the use of uppercase letters, numbers, punctuation and other characters.
answered Jun 21, 2012 at 15:35
-
Though it is a bad idea, there is always the suggestion to increase complexity. See why this is wrong: xkcd.com/936– schlamarCommented Jun 21, 2012 at 15:42
-
@ms4py - Sure, there are different ways to craft the rules to ensure the passwords are complex enough. If you require 20 character passwords, for example, you probably don't care about whether the password is in all lower case. Then there is the matter of training your users to generate and remember 4 random common words or to pick the first character from each word in a long phrase. Password complexity rules aren't perfect, but they do at least prevent users from using "password" or "password1" as their password. Commented Jun 21, 2012 at 15:54
To test for potentially weak passwords that can be cracked easily by a malicious attacker.
This could give an indication of the state of the password policy of the particular company, which might be an issue in certain circumstances.
If there are plenty of weak passwords found, the pen tester could suggest to the company to change and enforce a better password policy.
Of course, i see no reason to ask the company to hand over a list of passwords. Perhaps it could be a list of passwords found after compromising a user database, or a linux shadow file.
If you do this from the same ip number and for root account and you have firewall switch off and sshd started up - this is definitely dangerous :-)
ps. Passwords should not be used in plain text, it should be stored only in the memory of users. Dealing with lists of user passwords would be seriously no good.
The best is to enforce a nice policy on password change and expire them, so after users will be asked to change the password, so then you will know that it's all fine and the passwords are strong. And they should be stored as salted hash, preferably 100.000 times hashed.
