“Password Attack Discussion & Benchmarks ”

1. “Password Attack Discussion & Benchmarks” Alan Amesbury Office of Information Technology University of Minnesota http://www1.umn.edu/oit/security/passwordattackdiscussion.html Last modified on November 15, 2005 Presented by Ying Jiang Email: yjia031@ec.auckland.ac.nz

2. Summary The author discussed password attack strategies and gives the results of experimental test. • Introduce three reasons why LANMAN is weak. • Introduce brute-force attacks, dictionary attacks and combined attacks. • Show benchmark output.

3. Critical Comment What is meant by LANMAN • The author is supposed to provide readers with some background knowledge of LANMAN before introducing the reasons why LANMAN is weak. This will help readers to better understand his article. Proposed definition • LANMAN is an obsolete authentication protocol for Microsoft Windows, used in systems before the implementation of Windows NT. Its replacement is NTLM [1]. [1] URL: http://en.wikipedia.org/wiki/Lanman [Accessed on Oct.6, 2006]

4. Critical Comment: AboutExperimental Test • Not careful control of the environment in which the benchmark is being run. • Did not show the detailed experiment procedures. • Did not give test variables which to be used in the experiment. • The results of experimental test provided without statistical analysis such as mean and standard deviation. • It’s better to make some plots such as histogram to compare and contrast the experimental results for readers’ convenience.

5. Appreciative CommentClearly explain why LANMAN is weak • Case insensitive • Only 7 characters limited • Computationally cheap.

6. Explanation

7. Discussion • How can you design an experiment to simulate real-world password attacks?