Re: Cracking IBM Mainframe Password Hashes

2014-03-18 Thread Lou Losee
The biggest problem with this is if I recall correctly, the user id is encrypted with the password with a variant of DES that has a slight twist from the published DES algorithm. That is why there are two types of DES encrypt calls in the RACROUTE REQUEST=EXTRACT macro; ENCRYPT=(data addr,DES) and

Re: Cracking IBM Mainframe Password Hashes

2014-03-18 Thread Andrew Rowley
On 19/03/2014 10:21, Ed Gould wrote: I thought IBM would have spoken up before this. From what little I have heard is that even with the raw data (ie the RACF DB) the password is unable to be broken. You can't calculate the password from the stored value - as far as I know that is still the c

Re: Cracking IBM Mainframe Password Hashes

2014-03-18 Thread Ed Gould
On Mar 18, 2014, at 5:57 PM, Andrew Rowley wrote: On 19/03/2014 9:30, Anne & Lynn Wheeler wrote: also http://en.wikipedia.org/wiki/Password_cracking things were speeded up some when repositories of tens of thousand of the most common passwords were published. some countermeasure http://en.wi

Re: Cracking IBM Mainframe Password Hashes

2014-03-18 Thread Andrew Rowley
On 19/03/2014 9:30, Anne & Lynn Wheeler wrote: also http://en.wikipedia.org/wiki/Password_cracking things were speeded up some when repositories of tens of thousand of the most common passwords were published. some countermeasure http://en.wikipedia.org/wiki/Salt_%28cryptography%29 The GPU b

Re: Cracking IBM Mainframe Password Hashes

2014-03-18 Thread Anne & Lynn Wheeler
and...@blackhillsoftware.com (Andrew Rowley) writes: > I'm sure it is using the encryption method. The speed of password > cracking on GPUs is fast enough that most hashes are vulnerable using > traditional length passwords. RACF might be worse than some because > the algorithm might not be specifi

Re: Cracking IBM Mainframe Password Hashes

2014-03-18 Thread Andrew Rowley
On 19/03/2014 0:51, Lou Losee wrote: I also wonder if they truly mean password hashes, as in the ancient RACF password hash methods, or the more commonly used encryption method of securing passwords or to be more technically correct, user ids. I'm sure it is using the encryption method. The spe

Re: Cracking IBM Mainframe Password Hashes

2014-03-18 Thread Elardus Engelbrecht
Radoslaw Skorupka wrote: >> How did they tested it? Obtained a real copy of RACF DB and do your cracking? >I bet, yes. Do you want real copy of RACF db? I'll create it for you. >Tell me the usernames and passwords you want to have. I'm too lazy to do that, I'll have rather mow my lawn. ;-D >If

Re: Cracking IBM Mainframe Password Hashes

2014-03-18 Thread R.S.
W dniu 2014-03-18 12:56, Elardus Engelbrecht pisze: I'm not surprised. As a RACF person, I sometimes receive e-mails from spammers and wannabe crackers trying to 'advise me' on a lot of things. ;-) Well, in my case the statndard is nobody even heard about RACF. So I receive no comments or advi

Re: Cracking IBM Mainframe Password Hashes

2014-03-18 Thread Lou Losee
I also wonder if they truly mean password hashes, as in the ancient RACF password hash methods, or the more commonly used encryption method of securing passwords or to be more technically correct, user ids. -- Artificial Intelligence is no match for Natural Stupidity - Unknown On Tue, Mar 18,

Re: Cracking IBM Mainframe Password Hashes

2014-03-18 Thread Shmuel Metz (Seymour J.)
In , on 03/18/2014 at 09:19 AM, Jose Munoz said: >Someone can comment on it, I received an email from an Open System >college arguing that mainframe is very weak...please help me to >answer it: The Devil is in the details. Strip the BS and what they are saying is that if you ignore the standa

Re: Cracking IBM Mainframe Password Hashes

2014-03-18 Thread Elardus Engelbrecht
Jose Munoz wrote: >Someone can comment on it, I received an email from an Open System college >arguing that mainframe is very weak...please help me to answer it: I'm not surprised. As a RACF person, I sometimes receive e-mails from spammers and wannabe crackers trying to 'advise me' on a lot of

Re: Cracking IBM Mainframe Password Hashes

2014-03-18 Thread R.S.
W dniu 2014-03-18 07:19, Jose Munoz pisze: Gents, Someone can comment on it, I received an email from an Open System college arguing that mainframe is very weak...please help me to answer it: " oclHashcat v1.20 support added to crack RACF (IBM mainframe) hashes with 1 Billion (Giga) Hashes/seco

Re: Cracking IBM Mainframe Password Hashes

2014-03-17 Thread Paul Gilmartin
On Tue, 18 Mar 2014 09:19:25 +0300, Jose Munoz wrote: > >Someone can comment on it, I received an email from an Open System college >arguing that mainframe is very weak...please help me to answer it: > Well, first you need to access the encrypted password file, and/or bypass the prevalent three-str

Cracking IBM Mainframe Password Hashes

2014-03-17 Thread Jose Munoz
Gents, Someone can comment on it, I received an email from an Open System college arguing that mainframe is very weak...please help me to answer it: " oclHashcat v1.20 support added to crack RACF (IBM mainframe) hashes with 1 Billion (Giga) Hashes/second on a single stock clocked hd6990 graphics