Passwords

On most Unix systems, passwords are limited to eight characters. Passwords are stored in an encrypted form. On many older systems, these encrypted passwords are readable by anyone in the /etc/passwd file, which must be world-readable to allow programs needing to translate names to user IDs to operate. The encryption is difficult to break, but since the algorithm is known, a dictionary attack may be used. The intruder copies the password file, then uses another computer to encrypt hundreds of thousands of words, looking for a match. Commonly available dictionaries include English, German, French, biology, sports, Star Trek etc. A number of rules may also be applied to tranform words, such as appending digits, replacing "S" with "$", and so on.

Since the password must ideally be memorable, it is not so easy to generate one immune to this kind of attack. One approach is to build a password from two shorter, unrelated words, like "Red=Cat". Of course, this suggestion could itself be used to create a cracking rule, and there are not that many short words in the English language ....

In some Windows systems, passwords are lightly enciphered in .PWL files. A program with access to these files (in Win95, this means any program at all) may be able to decrypt them. Win95 allows (encourages) users to "save this password for next time". Passwords saved in this manner may be displayed using Back Orifice or similar tools, and are thus not recommended on any network-accessible computer or one where physical access is not controlled.

Prevention

Many newer systems use a scheme known as shadow passwords, where the encrypted password from /etc/passwd is replaced by an "x" and the real encrypted password is stored in /etc/shadow. Usually there is a command pwconv to convert the old form of file to the new, secure form. The shadowed password file may only be read by the superuser.

Since an intruder may often be able to identify user accounts on different systems, it is not a good idea to use the same password on many different systems.

Up to Security Page

A.Daviel