🚀 go-pugleaf

"someone" <someone@somewherw.from.the.earth> writes:

>I am the admin of this workstation, there are many people using the
>computer, some accounts have admin rights, so they can use the NTcrack to
>get the password of other user (including me) and see their info

>so I wanted to change the hashing rountine to sometime of my own so the
>cannot use NTcrack or l0phtcrack to uncrack the hashed password

That is a *bad* idea, unless you are better at writing secure hash
functions that the Revest of RSA. I think you are not.  Adding some
salt would be a good move though.

NTcrack and l0phtcrack, and all Un*x password crackers including
crack, are based on a dictionary. Given the name, comment, etc and big
dcitionary plug them into the hash function and see if something
matches. If the value does not match try the next idea...

In Un*x you have to talk account of the salt but that is avialable in
the clear, so the same theory works. salt just makes it harder work
because lists of passwords can only be attacked in groups with the
same salt.

Provided you keep your password out of the generated lists the
cracking programs will not be able to find it. However far too much NT
authentication is based on the *hash* and not the password. This makes
it a waste of effort to reverse the hash function---just modify the
client so it accepts hash values instead of passwords and you can
break in without major problems.

To date nobody hash managed to reverse either the NT or the Un*x
password hashing algorithms.

Duncan (-:

If they have ADMIN rights then they don't need to decrypt your password.
All they have to do is go look in your directory.  The Administrator can see
all files.  It doesn't matter who's they are. They can change your rights
and even delete your account, but you can do the same.  You had all better
just agree not to mess with the others accounts, or make everyone users with
only the necessary rights and give no one access to the Admin functions.

Jon

--
*******************************************************************
My opinion is that of my own and not that of my employer.
DON'T REPLY TO MY RETURN ADDRESS, it is wrong.

someone wrote in message <65g78r$r6g1@inetgate.tp.ac.sg>...
>I am the admin of this workstation, there are many people using the
>computer, some accounts have admin rights, so they can use the NTcrack to
>get the password of other user (including me) and see their info
>
>so I wanted to change the hashing rountine to sometime of my own so the
>cannot use NTcrack or l0phtcrack to uncrack the hashed password
>
>I'm using VC 5.0 to program and i wanted to replace MSV1_0.dll to sometime
>of my own but i do not know to functions to replace
>
>also i have tried subauth but it's not working
>
>can someone help me on this problem
>
>
>

In article <65g78r$r6g1@inetgate.tp.ac.sg>, someone@somewherw.from.the.earth 
says...
> I am the admin of this workstation, there are many people using the
> computer, some accounts have admin rights, so they can use the NTcrack to
> get the password of other user (including me) and see their info

How about looking at stopping the EXE from running... having something
that watches for the particular module and kills it.  Off-hand I can't think
of the best way to go about this, but it shouldn't be impossible.

If other users have admin rights they can change your password, delete
your account, etc. anyway!

Si

---
Note: My email address is intentionally invalid to foil spammers.
      Change 'nospam' to 'si' for my real email address.

Greetings,

 Please forgive what may be a foolish question from a NT security novice.

  The blurbs state that service pack 3 for nt 4.0 makes several security
enhancements.  Reading the specifics it seems to me (a person of little
experience with nt security) that the dictionary method will no longer
be possible.

I am misunderstanding?

Thanks
  Dan Thompson

Si Owen <nospam@wordcraft.co.uk> wrote in article
<MPG.ee73560eaa987d19896be@news.demon.co.uk>...
> In article <65g78r$r6g1@inetgate.tp.ac.sg>,
someone@somewherw.from.the.earth 
> says...
> > I am the admin of this workstation, there are many people using the
> > computer, some accounts have admin rights, so they can use the NTcrack
to
> > get the password of other user (including me) and see their info
> 
> How about looking at stopping the EXE from running... having something
> that watches for the particular module and kills it.  Off-hand I can't
think
> of the best way to go about this, but it shouldn't be impossible.
> 
> If other users have admin rights they can change your password, delete
> your account, etc. anyway!
> 
> Si
> 
> ---
> Note: My email address is intentionally invalid to foil spammers.
>       Change 'nospam' to 'si' for my real email address.
>