OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: NT encryption
From: Glenn Pearl (glennpBROOKE-STAFFING.COM)
Date: Wed Sep 20 2000 - 11:44:15 CDT


I was not aware that there was any limitation on allowable extended-ASCII
characters. I have used passwords that contain characters not in the list
below (for instance, 0212), and have had no problems logging on to any NT or
Win9x box in our network.

Concerning LM on Win9x, you can now use NTLM2 on those boxes by installing
the Directory Services Client from the W2000 CD (Q239869). NT 4.0 has had
NTLM2 support since SP4. Q147706 tells how to configure this.

Hope it helps,
Glenn Pearl
Brooke Staffing Companies
glennpbrooke-staffing.com

> -----Original Message-----
> From: Kurt Buff [SMTP:kurtbuffLIGHTMAIL.COM]
> Sent: Wednesday, September 20, 2000 12:27 AM
> To: FOCUS-MSSECURITYFOCUS.COM
> Subject: Re: NT encryption
>
> If we use the punctuation characters (30, the total I come up with,
> considering that you can't use the '/' and '\' characters, as follows -
> `~!#$%^&*()_-+=|[{]};:'"?.>,<), plus the 62 alphanumeric characters (a-z,
> A-Z, 0-9, and the space character), plus the 38 high-ASCII allowed
> characters[1]. That yields a character space of 131 characters.
>
        <snip>

> But wait, there's more! Consider this: Although you can set NT to not use
> the weaker LANMAN-style passwords, most Win9x platforms won't talk the
> newer, more secure NT protocol. That means that if you want to make
> NetBIOS
> connections to your NT servers from your Win9x platforms, you have to
> deliberately not set them to exclude the weaker passwords, thereby
> allowing
> anyone who is sniffing on the wire to do that much less work cracking the
> passwords they see flow by. Does anyone know if the newest patches allow
> Win98 or Win95 or WinMe to talk the better protocol? I'd bet not, if I
> were
> a betting man.
>
> Sweet Dreams,
>
> Kurt
>
>
> [1] from a post by Alan C. Ramsbottom on 16 April, 1997 to the NT BugTraq
> list:
>
> ...a character entered with an ALT sequence selected from the following
> list
> *only*. Type ALT then one of the four digit numbers below to enter these
> characters in your password. [KBuff: By this, he means that you need to
> hold
> down the ALT key while typing one or more of the 4-number sequences below
> from the 10-key pad at the right of your keyboard]
>
> 0131 0199 0224 0231 0237 0244 0252 0135 0201 0225 0232 0238 0246 0255 0149
> 0209 0226 0233 0239 0247 0196 0214 0228 0234 0241 0249 0197 0220 0229 0235
> 0242 0250 0198 0223 0230 0236 0243 0251
>
>
> -----Original Message-----
> From: Focus on Microsoft Mailing List
> [mailto:FOCUS-MSSECURITYFOCUS.COM]On
> Behalf Of Todd Schubert
> Sent: Tuesday, September 19, 2000 07:13
> To: FOCUS-MSSECURITYFOCUS.COM
> Subject: NT encryption
>
>
> A colleague of mine recently told me that the NT encryption scheme only
> uses
> the first 8 characters of the password. This doesn't make much sense to
> me
> as it seems relatively insecure. Could someone shed some light on this
> for
> me.
>
> Todd