Please read:

The following is not my post but it is from:
One Man's Blog
OneMansBlog.com is Copyright © 2006-2007 by John Pozadzides.
This work is licensed under a Creative Commons Attribution 2.5 License.

Since I found it via digg.com, I would just blog it from there, but for some reason my digg account and blogger are just not getting along quite the same ever since I switched over to the beta at blogger (now the standard). But, I truly feel this is something that everyone should know.

How I’d Hack Your Weak Passwords

Digg This! (1489 Diggs, 140 comments) • Save to del.icio.us (186 saves, tagged: security password hacking) • Technorati: 17 links to this item • Add to Technorati Favorites! • Google Bookmark This • Add to Yahoo MyWeb2 • Add a comment

Hello DIGG visitors! Thanks for stopping by. As you may have noticed, the server is under a little bit of strain at the moment. It might have something to do with the 5,000 visitors per hour that are stopping by. :-)

The page you are viewing is a static HTML document so that it can handle the load, but a lot of people are trying to click through to other pages on the site. (Thanks for your interest by the way!)

If you try to visit another article but get a Wordpress database error you may want to try reloading it a few times. Or, if I may suggest... if you'll open the article in another window and check on it in a few hours the server should catch up and you can refresh and read the page later. Thanks again!!!

User LoginIf you invited me to try and crack your password, you know the one that you use over and over for like every web page you visit, how many guesses would it take before I got it?

Let’s see… here is my top 10 list. I can obtain most of this information much easier than you think, then I might just be able to get into your e-mail, computer, or online banking. After all, if I get into one I’ll probably get into all of them.

1. Your partner, child, or pet’s name, possibly followed by a 0 or 1 (because they’re always making you use a number, aren’t they?)
2. The last 4 digits of your social security number.
3. 123 or 1234 or 123456.
4. “password”
5. Your city, or college, football team name.
6. Date of birth - yours, your partner’s or your child’s.
7. “god”
8. “letmein”
9. “money”
10. “love”

Statistically speaking that should probably cover about 20% of you. But don’t worry. If I didn’t get it yet it will probably only take a few more minutes before I do…

Hackers, and I’m not talking about the ethical kind, have developed a whole range of tools to get at your personal data. And the main impediment standing between your information remaining safe, or leaking out, is the password you choose. (Ironically, the best protection people have is usually the one they take least seriously.)

One of the simplest ways to gain access to your information is through the use of a Brute Force Attack. This is accomplished when a hacker uses a specially written piece of software to attempt to log into a site using your credentials. Insecure.org has a list of the Top 10 FREE Password Crackers right here.

So, how would one use this process to actually breach your personal security? Simple. Follow my logic:

* You probably use the same password for lots of stuff right?
* Some sites you access such as your Bank or work VPN probably have pretty decent security, so I’m not going to attack them.
* However, other sites like the Hallmark e-mail greeting cards site, an online forum you frequent, or an e-commerce site you’ve shopped at might not be as well prepared. So those are the ones I’d work on.
* So, all we have to do now is unleash Brutus, wwwhack, or THC Hydra on their server with instructions to try say 10,000 (or 100,000 - whatever makes you happy) different usernames and passwords as fast as possible.
* Once we’ve got several login+password pairings we can then go back and test them on targeted sites.
* But wait… How do I know which bank you use and what your login ID is for the sites you frequent? All those cookies are simply stored, unencrypted and nicely named, in your Web browser’s cache. (Read this post to remedy that problem.)

And how fast could this be done? Well, that depends on three main things, the length and complexity of your password, the speed of the hacker’s computer, and the speed of the hacker’s Internet connection.

Assuming the hacker has a reasonably fast connection and PC here is an estimate of the amount of time it would take to generate every possible combination of passwords for a given number of characters. After generating the list it’s just a matter of time before the computer runs through all the possibilities - or gets shut down trying.

Pay particular attention to the difference between using only lowercase characters and using all possible characters (uppercase, lowercase, and special characters - like @#$%^&*). Adding just one capital letter and one asterisk would change the processing time for an 8 character password from 2.4 days to 2.1 centuries.

Password Length - All Characters - Only Lowercase

• 3 characters - 0.86 seconds - 0.02 seconds
• 4 characters - 1.36 minutes - 046 seconds
• 5 characters - 2.15 hours - 11.9 seconds
• 6 characters - 8.51 days - 5.15 minutes
  
• 7 characters - 2.21 years - 2.23 hours
• 8 characters - 2.23 hours - 2.42 days
• 9 characters - 20 millennia - 2.07 months
• 10 characters - 1,899 millennia - 4.48 years
• 11 characters - 180,365 millennia - 1.16 centuries
• 12 characters - 17,184,705 millennia - 3.03 millennia
• 13 characters - 1,627,797,068 millennia - 78.7 millennia
• 14 characters - 154,640,721,434 millennia - 2,046 millennia

Remember, these are just for an average computer, and these assume you aren’t using any word in the dictionary. If Google put their computer to work on it they’d finish about 1,000 times faster.

Now, I could go on for hours and hours more about all sorts of ways to compromise your security and generally make your life miserable - but 95% of those methods begin with compromising your weak password. So, why not just protect yourself from the start and sleep better at night?

Believe me, I understand the need to choose passwords that are memorable. But if you’re going to do that how about using something that no one is ever going to guess AND doesn’t contain any common word or phrase in it.

Here are some password tips:

1. Randomly substitute numbers for letters that look similar. The letter ‘o’ becomes the number ‘0′, or even better an ‘@’ or ‘*’. (i.e. - m0d3ltf0rd… like modelTford)
2. Randomly throw in capital letters (i.e. - Mod3lTF0rd)
3. Think of something you were attached to when you were younger, but DON’T CHOOSE A PERSON’S NAME! Every name plus every word in the dictionary will fail under a simple brute force attack.
4. Maybe a place you loved, or a specific car, an attraction from a vacation, or a favorite restaurant?
5. You really need to have different username / password combinations for everything. Remember, the technique is to break into anything you access just to figure out your standard password, then compromise everything else. This doesn’t work if you don’t use the same password everywhere.
6. Since it can be difficult to remember a ton of passwords, I recommend using Roboform. It will store all of your passwords in an encrypted format and allow you to use just one master password to access all of them. It will also automatically fill in forms on Web pages, and you can even get versions that allow you to take your password list with you on your PDA, phone or a USB key.
7. Once you’ve thought of a password, try Microsoft’s password strength tester to find out how secure it is.

Another thing to keep in mind is that some of the passwords you think matter least actually matter most. For example, some people think that the password to their e-mail box isn’t important because “I don’t get anything sensitive there.” Well, that e-mail box is probably connected to your online banking account. If I can compromise it then I can log into the Bank’s Web site and tell it I’ve forgotten my password to have it e-mailed to me. Now, what were you saying about it not being important?

Often times people also reason that all of their passwords and logins are stored on their computer at home, which is save behind a router or firewall device. Of course, they’ve never bothered to change the default password on that device, so someone could drive up and park near the house, use a laptop to breach the wireless network and then try passwords from this list until they gain control of your network - after which time they will own you!

Now I realize that every day we encounter people who over-exagerate points in order to move us to action, but trust me this is not one of those times. There are 50 other ways you can be compromised and punished for using weak passwords that I haven’t even mentioned.

I also realize that most people just don’t care about all this until it’s too late and they’ve learned a very hard lesson. But why don’t you do me, and yourself, a favor and take a little action to strengthen your passwords and let me know that all the time I spent on this article wasn’t completely in vain.

Please, be safe. It’s a jungle out there.

Back from the Bahamas

Its never easy to leave, but we had a wonderful time down in Abaco. Compared to our last trip down to the Bahamas, this trip was much more low key. Last year we went down to Treasure Cay with Melanie's folks and her brother, Andrew. It was their first trip to the Bahamas, so we spent a lot of the trip exploring the island. This time, Mel and I simply kicked back and relaxed. There were a few days of exploring, but it wasn't off to the typical tourist spots. My Dad took Mel and I out for her first bonefishing experience. Several months ago, my Dad picked up a new bonefish skiff so he could enjoy his favorite sport more often. Bonefishing is a unique sport spent out on the flats in the Bahamas. The flats are sections of the ocean where during low tide the water level drops to around a foot deep. When the water drops like this, the bonefish swim up to hunt for crabs and other food. The tricky part is the flats are by no means small sections of land, they can stretch for several hundred yard and there is no particular pattern to where the bonefish will be. In a large part, bonefishing is much more like hunting than fishing, because you really have to try and track them down. I'll be posting some of our trips out to the flats later when I have a chance.
The rest of the trip was spent on the beach and enjoying the company of my parents. By the time we arrived, they had already spent a month down in the Bahamas and loving every moment of it. I have a strong feeling that from now on, I will be hard pressed to locate my parents anywhere near Montana during January from now on. They will be leaving on this upcoming Tuesday to travel up the east coast and visit with friend for a few weeks, and will then return to Treasure Cay for a few week more after that. Our return trip from the Bahamas always seems to make it that much harder to leave, and this last time was no exception. Along with a two and a half hour delayed flight from the island, our bags managed to miss the flight to Florida. From experience, we have learned that its best to arrive a day earlier before traveling to the Bahamas, and fly out a day later once you return. We had prepared for the delays both going to and coming from the island, but the missing bag was a curve ball. After we cleared immigration, we went down stairs to claim our bag and move through customs. That is when we discovered our bag, along with several others from the flight, had not made it over. That was a little upsetting, but they told us to call the 800 number on our ticket jacket. After fifteen minutes on hold, Melanie finally got in touch with someone on the phone. By this point we were already in the shuttle in transit to our hotel. That is when we found out that claims had to be made in person at the airport, and could not be taken over the phone. So we had the distinct pleasure of traveling back to the airport to a different terminal to place our claim. From there on out things did start to pick up, but it really was an unwanted headache. They did find out bag, and it was dropped of around five hours after we got home. Well, I should finish this off for now, but I will post a few more details about the trip later. Until then, cheers!

W4: Pluses and Minuses

Decided to steal a page from my wife, and submit a quit posting while we wait for our flight. Just want to thank Ft. Lauderdale Airport for having the common decency of providing free WiFi. Seriously, does anyone ever pay for WiFi at other airports unless you absolutely have to, and I for one have never access that bad. But, back to the heart of things.
This past week of training had its ups and downs, I had a good week based of the intensity of the work outs I completed, but I did poorly based off how many days I worked out. I will have to improve on that. I started the week of with a 5k run, which I finished in just over 30 min, which is good, but I will need to shave some more time off that. The big work out came this past Thursday, when I decided to give a litmus test to my progress so far. I started out with a 10 mile bike ride, that I finished in around 45 minutes. I basically rode a modified circuit and after I returned back to the house I kicked off the running section of my workout. I grabbed Kiera, and 5 minutes after finishing my bike ride I was back on the road for a 3 mile run. I clocked in at 30 minutes for that run, and I was feeling the burn after that work out.
This next week will be interesting to see how Melanie and I will be able to adjust our training to a new environment. But, all and all it should be pretty fun, besides you really can't complain about running on the beach. That's all for now.

W3: Condition Sore

After three weeks of training, I'm starting to feel it, and I am sore. I didn't push myself as hard as I would have liked, I probably should have gone out on some of the days I took off, but I still have time to make up for that. As payback for that slacking, I may have over done it today. I started off with a bike ride down to the store to pick up some breakfast supplies. That would have been a moderate workout for the day, but I wasn't finished quite yet. Later in the afternoon Mel convinced me to head out with her for a run with Kiera. We did a 3.2 mile run, after which my body let me know it wasn't too happy with me. But this will pass, and I better get used to it if I want to be in proper shape for when the triathlon rolls around.

Night out for Hockey

Second row! Not too shabby.

Week two in the bag

Second week of training, and things are going well. I've been doing mainly running for the past couple of weeks, but soon I will branch out to more training with the swimming and bike sections of the triathlon. Mel has been spending most of her time in the pool which has served her very well since it has helped a lot with the bike and running by building up her core strength. I did jump on a stationary bike earlier this week, and even though my endurance is up from the running, the muscle groups did not see that bike coming. The swimming part will be the toughest part for me to fit into my schedule, but I am sure I can get creative with that. Another week down, time to bump up the intensity.

Week one down.

If you happen to read Melanie's blog (which she has been more active with lately) you may already know that we both signed up for our first triathlon. As for those of you who did not know that, well.. now you do.
It was an idea that was kind of tossed out there one night when we were having a night on the town with friends. It was kind of one of those things where you look at it and say "Sure, why not.". Now its not a full triathlon, for those of you who are thinking we are heading out to Hawaii or something. Rather its a sprint marathon, which is a 300 meter swim, 20k bike, and 5k run. I got a bit of a late start on things, but I just finished my first week of training. It feels good, but we'll see how my attitude changes when we get closer to the actual race. I'll post more updates as I go. But for now,I've got to go hit the showers.. Mel and I are going out for an Italian dinner tonight.

Too funny

December sure has gone by quickly

Hello all,

I have to start by apologizing about the lack of updates this month, it has been unusual in the truest form. There have been quite a few curve balls thrown at me this month, but I am happy to report I'm still moving along nicely. I'll flesh out the details on another post but I wanted to fill in some details from last night.

Melanie and I had been invited out by Shana (one of Melanie's fellow Doc students) to go to the Carolina Hurricane's game against the New York Islanders. The idea was to try and score some of the student discount tickets which only go on sale the day of, and must be purchased at the RBC center. The only tickets we were able to secure were up in the 300's. We made the trek upstairs to find our seats when we were approached by one of the Storm Squad (Hurricane Cheerleaders). She wanted to know if we would be interested in playing some trivia for a chance at some better seats. Melanie was immediately nominated by Shana and I. So, just before the National Anthem, we went back downstairs to meet for the event. Mel was taken down to one of the corner booths on the ice to play the "Sub Club" sponsored by Subway for the new seats. Shana and I slipped down with Melanie as she walked to the booth and found a nice pair of seats about 18 seats up to watch the action. The game was that they would put up a question on the Jumbotron and the announcer would read it off until one of the players grabbed the Stormy hat (Hurricane's mascot) from the table. At that time the question would disappear and the announcer would stop reading and wait for the answer. It turns out that the game didn't quite play out like that, they did take the question down and the announcer did stop "reading" it, but he ended up repeating it before he asked the question. Melanie's competitor made for the hat first and guessed correctly. She did kick her self a little bit, since the question was true false, so a guess would have been just fine, if you were wrong the tickets just went to the other player. She had also been combing her mind with facts and figures about last season and players names, when the question turned out to be "True or False, the Hurricanes were leading after the 1st period in their last game?". Even if she didn't win, she got to be on the Jumbotron, get a shot at some better seats, and best of all, had the best seat in the entire house when the Hurricanes scored their first goal. Not much else after that, just enjoyed watching the Canes finish off with a 5-1 victory with out too much sweat.

What I was thankful for

Wii's, Skis, and other elements..

Hi Ho everyone,

Been a busy, crazy, and fun couple of weeks.. I'll do my best to break it down for you. I guess its best to start back on the weekend before Thanksgiving. Prior to that date I had been receiving a few calls from my good friend Owen out in LA. Owen always has a good story or two that primarily cause me to kick myself and wonder why it was that I'm on the opposite coast of where I should be... but I can get into that later. The latest and greatest story had been about his exploits with a Nintendo Wii, which thanks to his job he had been playing with for a week prior to its release to the general public. I had been thinking about picking up a new console, but after the sticker shock of the PS3, I placed myself squarely in the camp of sitting this cycle out, or at least that was what I thought. Owen, who just happens to be a non-gamer, had nothing but astounding praise for the Wii, and of course I caved and decided that a Wii would be quite a bit of fun for Thanksgiving and the annual Mario Cart rally my in-laws and I get into. Hence, after work on Sunday morning, I drove out the the local Target and kept my fingers crossed for that I might have a shot at one of the 24 units the store would have for sale at 8:00 am. I rolled into the parking lot at 6:30 am and walked up to a smattering of bundled chairs and tents.



It was a chilly 30-40 degrees out, so I zipped up my coat and started my wait. Only and hour until the employees would come out and produce the desired vouchers. There were quite a few people there, so the 24 units may have already been spoken for, any hope I had of securing one would be slim in deed. Around 15 minutes after I arrived, another camper showed up, I nodded as they walked up and he surveyed the line for a place to walk up to. From the depths of one particular hooded camper asked "Are you here for a Wii?". When the fellow nodded, a reply of "Oh I'm sorry, you aren't going to get one. They only have 24, and there are 24 of us here.". Slightly stunned, he nodded "Oh, OK then" and turned back to his car. I had not received the same greeting, so I thought that just maybe I was in that 24th slot, but realistically I also made mental note that I would probably be left out on that number.

A short time later, that question was answered for me. The same bundled Co-ED gave me a confused look and asked "Have you been here all night?" I responded that I had arrived around 35 minutes ago, "Oh, sorry, but your are not going to get a Wii, there are already 24 people here."

"That's ok, I will wait it out"

"Oh... Well, if you want we might be able to work something out."

"What's that?"

"Well, we are buying two Wii's, I would be willing to sell you the other for $600"

For those of you whom are not aware, the Wii is priced at $250, which is exactly the amount I am paying for one, not one cent more. After shooting that idea down, the rest of the line turned back to itself and counted down the remaining hour. As was expected, I did turn out to be #25, and thus my shot of obtaining a Wii on launch day was not looking good. I did have one other opportunity, since one kid that had previously planned on not buying a Wii had been talked into taking a ticket anyway. After the 24th voucher had been handed out, and I had started walking away, the kid ran up and tried to sell me his. As stated before, I am not paying more than $250, which included paying additional for someone's ticket. He only ended up getting $50 for it, which was payed for by the person in front of me. I'm glad that the price of the Wii is not going to really make the $300 price tag he paid a very profitable one. But, eventually I will find a way to get one, and if that is before the holidays or after it doesn't really matter. Don't worry though, as the week progressed from there it did get a lot better, more on that later.

Borat

Last night Mel and I went out to see Borat: Cultural Learnings of America for Make Benefit Glorious Nation of Kazakhstan. I was familiar with the character from HBO's "Da Ali G Show". What I was not prepared for was how hard I would laugh.

Straight to the point, this movie will go WAY beyond your comfort zone, but the funny thing is you will probably be laughing too hard to care. That said, I can not stress more that this movie must be seen to believe it. I knew about the gorilla style comedy Sacha Baron Cohen, since I had seen some of the interviews he had done as Ali G, another Borat like character from his show, only done in the vein of a hip-hop culture. With that in mind, I was expecting a few good laughs, but since Borat seemed more in line with Jonny Knoxville's Jackass, I was not expecting too much.

Like a midnight train with two tones of bricks this movie knocked me out of the park. I am still getting a good laugh 24 hours later. This is the first movie I have ever called people on to make sure they go see it. So folks, on your next free night, I really want you to go see Borat. Skip the popcorn, you would just end up loosing most of it. I would normally say to sit down, buckle up, and hold on for a movie like this but in this case, leave the seatbelt off, being a part of the car crash that is about to occur is just one thing you can't afford to miss in this movie.

What a night.

Mood: Headed to bed (@,@)

Webb - Votes are still being counted, 8 precincts left to count, 6 of which the Webb camp fell confidant that they are pro-Webb precincts. By which they look to increase his 7-11k vote lead. The Secretary of State will go out this morning to verify the votes took place, and then provisional votes will be counted, which are also felt to be in good standing with the Webb camp.

GOVERNOR - The Dems have picked up 6 states, to bring it to 28 v. the GOP 20.

Montana is still waiting, I will catch it when I get up.

Lieberman in the drivers seat?

Mood: Tired

With Montana in the balance, Lieberman becomes a very important person. With the Dems looking more and more likely to get 6 seats, Lieberman has the ability to rock that boat, or bring it safely into the harbor. I would go into more details, but for now, keep an eye on him, the GOP wants him to stay independent, and Dems would welcome him back into the fold, which would come at a price. Bringing it down to the wire here, and I can't wait!

Montana DON'T FAIL ME NOW!

Mood - Ecstatic!

Hailing from Bozeman Montana myself, I am stunned that it will play such a large part in this years election. I was a bit worried, but I know that regardless of how things ultimately turn out, they are much much better than I had thought they would be. With this large turn-over of power is going to weigh greatly on what direction we head as a nation. Its been a rough set of years to see the polarization of this nation used against each other. We are standing at a crossroad, and I for one believe that the future has brightened quite a bit. For me this is not about retribution, I do not want to rub this in, but what I do want is for this country to come together. I really think we have a chance know. Looking back, both Regan and Clinton had to adjust in order to work with the new political landscape, now it is Bush's turn. I really hope he takes this message to heart, and sets things aside to come back to where the rest of the country lives, and does not try to dig in his heels.

So now we wait, and as I sit here surrounded by a sleeping wife, a sleeping dog, and well a wired cat, but it just seems fitting. Had a lot of fun, and for those who popped in to join me, I appreciate that. Its a new dawn in American politics, 30 min left, Yellowstone County a must win for Conrad. Unbelievable!!

Hmmm, two self proclaimed winners

First with Webb, now McCaskill have come out before their competitors and claimed the victory. Traditionally, the looser would make the call to the winner to congratulate the them, head out to offer the concession speech. Not sure where this went to, but now it seems that we've gone for winner take all.

But this does leave us in and interesting completion to our night here, as goes Montana, so the country.

Oh yeah, McCaskill is the winner! This just in. This is CRAZY!!

Then there was two.

Montana has Tester 115,182 @51% with 58% reporting, so its looking good. Missouri has McCaskill rounding the corner and taking the lead: 852,065 @49%, with 84% of precincts reporting. Here is a breakdown of what else the nation voted on:

AZ - English as Official Language - Yes
AZ - Million Dollar Voter reward - No
AZ - Minimum Wage increase - Yes
CA - Fund Alternative Energy - No
MO - Raise Minimum wage - Yes
CO - Ban Gay Marriage - Yes
ID - Ban Same-Sex Marriage - Yes
NV - Raise Minimum wage - Yes
OH - Raise Minimum wage - Yes
SC - Ban Same-Sex Marriage - Yes
TN - Ban Same-Sex Marriage - Yes
VA - Ban Same-Sex Marriage - Yes
WI - Ban Same-Sex Marriage - Yes
CO - Legalize Marijuana - No

2000 revisited

Mood: Excited

We are on the eve of a very interesting event. The balance of power in the Senate may not be known for a few weeks, here is how it would work. Montana and MO need to continue the trend to the DEMS, that would leave the balance hanging on VA, which has headed to bed, with a recount on the way. Just as was the case in FL back in 2000, it moves to a much larger issue. Montana has been leading toward Tester all night, MO is switching places quite a bit. The night is young for sure.

Corker takes TN

Mood: Focused

Tennessee looks to have tipped over to Corker, which would lead for all three Senate races to fall to Dems. Tough to pull off, but its possible. VA as stated before is going to stretch into extra innings, where they will pick up the recount tomorrow. 2265 vote difference to the advantage of Webb - the State will pick up the tab on that recount.

Back in a bit.

12:30

Mood: Digging it!


U.S. Senate Virginia
Candidate Votes % of votes
Jim Webb (DEM) 1,143,144 49%
George Allen (REP)* 1,140,879 49%
99% of precincts reporting

U.S. Senate Tennessee
Candidate Votes % of votes
Bob Corker (REP) 870,606 51%
Harold Ford (DEM) 812,506 48%
91% of precincts reporting

U.S. Senate MISSOURI
Candidate Votes % of votes
Jim Talent (REP)* 669,292 50%
Claire McCaskill (DEM) 612,233 46%
64% of precincts reporting

U.S. Senate Montana
Candidate Votes % of votes
Jon Tester (DEM) 63,698 54%
Conrad Burns (REP)* 51,745 44%
25% of precincts reporting

The train continues with picking up a lot of Gov. positions, that will change the political landscape as well. I have to say I am going to be very very interested in what Bush's next move is. I'll be the first to admit it, I can't stand the guy, but if he can take the hint and move to the middle it would be the first correct step in a very long line of wrong steps.