-
26 Mar 2010Great tool to check for weak Web passwords
I've always been a fan of Acunetix Web Vulnerability Scanner. It's a lesser-known tool that packs a big punch. One of its most redeeming qualities is its password checking. As I mentioned in this post, Acunetix Web Vulnerability Scanner took what was going to be a basic assessment of an Outlook Web Access system with very few findings up many notches into a true penetration of the system...all thanks to ...
Continue Reading... -
01 Feb 2010
Relying on users to wipe out wimpy passwords??
I just came across a Dark Reading piece by Adrian Lane on wiping out wimpy passwords. Adrian says that user training is needed so people know how to create strong passwords. I'm not picking on you Adrian however this has become a downright ridiculous approach, one that's been proven time and again not to work. My take is if you have to set your users up for success and, therefore, ...
Continue Reading... -
03 Nov 2009
Good dictionary to use for password cracking
Here's a pretty comprehensive password dictionary I recently came across that you may want to use in your security testing...there may be "friendlier" download link but I haven't searched for it.If time is a factor, this dictionary may be too big for its own good given the time it'd take to run through everything but at least you know you're using a good dictionary. After all, your dictionary-based password cracking ...
Continue Reading... -
13 Oct 2009
Proper password length
Probably late to the game but just had to post this:During a recent password audit, it was found that a blonde was using the following password: MickeyMinniePlutoHueyLouieDeweyDonaldGoofy When asked why such a big password, she said that it had to be at least 8 characters long....
Continue Reading... -
12 Oct 2009
Cool tool for cracking/resetting SQL Server passwords
Elcomsoft has a neat - and relatively new - tool called Advanced SQL Password Recovery I thought you may be able to benefit from. It can be used to change any SQL Server databases protected by a password included SQL Server 2000, 2005 and 2008. All you need is access to the master.mdf file. SQL Server optional.I was going to show a screenshot but there's not that much to show...you ...
Continue Reading... -
16 Jul 2009
Another ridiculous way of handling Web passwords
I use iContact's marketing service. It's an overall great app and reputable company but they've now made my list of ridiculous password requirements. I was logging in to their site today using what I consider to be a strong password and got this message:As part of our latest application security upgrade, iContact has strengthened the criteria for account passwords. To access your account, you must first reset your password.So I ...
Continue Reading... -
05 May 2009
Hilarious/ridiculous password requirements
I came across some very laughable Web-site password requirements with some sites I've used recently that I wanted to share. The need for us to use strong passwords/passphrases on the Web is pretty obvious. I also believe in balancing security with reality and not going overboard.My first example is just that: overboard. It's AT&T Wireless. Check out their ridiculous password requirements:Your password is case-sensitive and must:- Be six to twenty ...
Continue Reading... -
11 Dec 2008
Let this be a reminder to keep your online passwords in check
While you're shopping on Amazon.com, eBay, and elsewhere this fine holiday season, let Mike Rothman's dilemma be a reminder that we all need to take our online passwords seriously. So, keep them strong, keep them unique from one another, keep them to yourself, and (most importantly) keep them in mind. It's that long lost account that can get you....
Continue Reading... -
13 Aug 2008
Very clever way of recovering passwords from MD5 hashes
In his infinite wisdom, Vladimir Katalov with Elcomsoft has developed tool called MD5 Password Cracker that uses the computing power of NVIDIA graphics cards to recover passwords from MD5 hashes. Very cool. And it's free.According to Elcomsoft, for comparison, this type of cracking on a 2.2 GHz Intel Core 2 Duo E4500 processor only yields about 30 million passwords per second and around 70 million per second on Intel Core ...
Continue Reading... -
18 Jul 2008
Crack the darn password!
Here's an interesting story about a network admin working for the city of San Francisco who's refusing to give up a password. He won't give it up, then why not just crack it? It's probably a shared password anyway quite possibly stored/used somewhere else on his computer. There are TONS of password cracking tools out there by Elcomsoft and others. This could be an easy task.Our government at work......
Continue Reading...
Resources
Client Testimonials
“A business associate referred our company to Principle Logic when we were seeking a resource to perform vulnerability /penetration testing for our external and internal networks. We found Kevin Beaver to be professional, well informed, and easy to work with. His testing did not disrupt our networks, and his progress updates were timely.
His final report was very thorough and included security recommendations for our network environment. The executive leadership was so impressed with Kevin’s security expertise, they have extended their agreement to continue to perform periodic testing. We highly recommend Kevin Beaver and Principle Logic as a resource for network security testing.”
(IT managed services firm)
Kevin has written/co-written 12 books on information security including one of the best-sellers of all time:
