full-disclosure - Re: Wordpress Cookie Authentication Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20071120173007.GI32379@tern.cl.cam.ac.uk>
Date: Tue, 20 Nov 2007 17:30:07 +0000
From: Steven Murdoch <fulldisc+Steven.Murdoch@...cam.ac.uk>
To: XSS Worm XSS Security Information Portal
	<cross-site-scripting-security@...worm.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Wordpress Cookie Authentication Vulnerability

On Wed, Nov 21, 2007 at 03:48:06AM +1100, XSS Worm XSS Security Information Portal wrote:
> This also applies to many other blog software

In which case they are not storing their passwords properly. 

What makes the Wordpress scheme vulnerable is that you can attack it
*without* brute forcing the password. Also, because there is no salt,
brute forcing is much easier than it need be. 

> and also every system with a password database.

No, it does not apply to systems which use one way hashing correctly,
for example the UNIX password database. This technique has been known
for around 30 years.

The reasoning and history behind these schemes can be found in a paper
by Morris and Thompson, published in 1978:

 http://cm.bell-labs.com/cm/cs/who/dmr/passwd.ps

Steven.

-- 
w: http://www.cl.cam.ac.uk/users/sjm217/

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/