News for hackers. Stuff that matters.

A comment on Xerox Alto zero-day: cracking disk password protection on a 45 year old system. Parent comment

Re:Xerox Alto zero-day: cracking disk password protection on... by 13of40 on Thursday January 04, 2018 @06:23PM (#16075049)
Best one I've seen was a university library card catalog system from the 80s/90s that used unshadowed, 8-character salted passwords via the crypt() function on the Unix box it was on. Inexplicably, whoever wrote the application had limited it to require exactly five uppercase letters, crackable in a few seconds on my 33Mhz 386.
[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by romwell on Thursday January 04, 2018 @06:48PM (#16075197)
Maybe that was the reason? To provide a way for the developer to do customer support in these cases, that is.

The password being there, as the people in the bike store where I bought the lock told me, to keep the honest people honest.

[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by 13of40 on Thursday January 04, 2018 @07:44PM (#16075523)
Anyone with admin access on the Unix box could have just edited the password file and put in a hash for a password they knew.
[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by kalleboo on Thursday January 04, 2018 @09:33PM (#16076026)
My high school in the late 90's similarly handed out passwords all composed of 8 (or was it 6?) numbers. Combined with Windows 98's weak hashing (was it LanMan back then?), Cain & Abel on contemporary hardware could reveal them in seconds.
[ Parent | on HN ]