announce - [openwall-announce] JtR 1.7.5-jumbo-3; phpass 0.3; password recovery updates

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20100425090733.GA17895@openwall.com>
Date: Sun, 25 Apr 2010 13:07:33 +0400
From: Solar Designer <solar@...nwall.com>
To: announce@...ts.openwall.com
Subject: [openwall-announce] JtR 1.7.5-jumbo-3; phpass 0.3; password recovery updates

Hi,

This is to announce three news items at once.  I'll start with the latest:

1. The jumbo patch for John the Ripper 1.7.5 has been updated to
revision 3.  Most notably, this adds documentation on LM/NTLM
challenge/response authentication cracking (doc/NETNTLM_README),
improves the netntlm.pl script, and adds the "--config" option to
"john".  These changes have been contributed by JoMo-Kun:

http://www.openwall.com/john/#contrib
http://www.openwall.com/lists/john-users/2010/04/14/4

2. There's a new revision of our PHP password hashing framework -
phpass 0.3:

http://www.openwall.com/phpass/

This revision no longer requires the getmypid() PHP function (which a
few shared hosting providers disable) and it recognizes the "$H$" hash
encoding prefix (as used by phpBB3).

Also, the size of an array in the C reimplementation, which is unused by
the framework itself and is meant for testing the correctness of the PHP
implementation only, has been corrected.  (Obviously, I was careless
about that code; I should have reviewed it when I decided to include it
along with phpass.)

I'd like to thank Christian von Schultz for reporting the bug.

3. Rixler Software's password recovery products for Word, Excel, and
some other Microsoft Office documents have been added to Openwall's
collection of password recovery resources.  These new products use an
innovative approach where the 40-bit encryption key gets cracked within
seconds on Rixler's server, yet the actual "document" is not "revealed"
to the server (only some technical information is sent to the server).

http://www.openwall.com/passwords/microsoft-word
http://www.openwall.com/passwords/microsoft-excel
http://www.openwall.com/passwords/microsoft-office

At the same time, ElcomSoft's Microsoft SQL Server password change/reset
and WiFi WPA/WPA2-PSK password security auditing products (using the
processing power of GPUs of up to four modern NVidia or ATI graphics
cards when available!) have also been added to the collection:

http://www.openwall.com/passwords/microsoft-sql-server
http://www.openwall.com/passwords/wifi-wep-wpa-wpa2-psk

Enjoy!

Alexander

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.