Letters-Only LM Hash Database

Peter Clark writes "Disk storage has increased tremendously in the past 5 years and the blatant insecurities in the antiquated LM hashing technique have not gone away; though functionality has been added to disable LM hashes, this is not set by default. With some help from Elcomsoft, simple flat files have been created that hold every combination of LM hash for letters only passwords. Jesko has coded a server application which allows you to access this database. Simply telnet to: beginningtoseethelight.no-ip.org on port 2501 and paste in a LM hash. So how does this differ from Rainbow tables? Well this will return a password 100% of the time, using minimal processor power, in approximately less than 0.2 seconds."

less than 0.2 seconds

[Sediyama (527384)]

I think someone is underestimating the /. effect.

Someone explain?

[mistersooreams (811324)]

Anyone feel that a article summary with this much technical detail should have some links or explanation of what it's actually talking about? And since I'm one of the ignorati who doesn't understand, could some please explain to me?

Re:Someone explain?

[Jaruzel (804522)]

As I understand it LM Hashes can't be reversed. So what someone has done here is pre-hashed an entire dictionary, and created a word=hash lookup system.

You telnet to it, feed it the hash, and it replies with the word.

LM hashes are how a lot of passwords are 'encrypted'

Excuse the fuzzy description... Crypto is not my strong point.

Re:Someone explain?

[gweihir (88907)]

As I understand it LM Hashes can't be reversed.

That is untrue. Any hash can be reversed in the sense that you can generate an input that will result in a specific output. However the input may not be the only one generating that output and it may be computationally infeasible to do this for sufficiently random original inputs to the hash. The property of a (theoretical) perfectly secure hash is that you have to try possible inputs and hash them until you are lucky.

In other cases you might actually be able to reverse the algorithm itself and do without trying a lot of inputs. A hash were this is possible with significantly less effort is usually called "broken".

So what someone has done here is pre-hashed an entire dictionary, and created a word=hash lookup system.

Yes, that is called a "Dictionary Attack", and the dictionary is a function reversing the hash and given in the form of a table. Quite an old technique. But since LM hashes are not very secure, the possibility to do this is not surprising to anybody in the field.

That is NOT "reversing a hash" (-1, Misinformed)

[sczimme (603413)]

That is untrue. Any hash can be reversed in the sense that you can generate an input that will result in a specific output.

That is NOT reversing the hash: this should be painfully bloody obvious since the process you describe runs the same hash in the same manner.

Reversing a hash - meaning you start w/ the hash and work backwards to recreate the original data - is impossible. Bits are lost during the hash process, and there is no data in the hash that will allow those bits to be reconstructed. Read _Applied_Cryptography_ by Bruce Schneier, or at least read any of the many crypto/hash FAQs available on the web. NIST [nist.gov] has some good papers available.

Re:Someone explain?

[by Anonymous Coward]

http://en.wikipedia.org/wiki/Lm_hash [wikipedia.org]

Re:Someone explain?

[terraformer (617565)]

They are talking about the hashing algorithm MS uses on Windoze machines and networking. LM stands for LanManager which is what the networking component in windows has been called since as far back as I can remember. What I wish people would do is send up some examples to test out. Those without regular access to windows would benefit greatly. Also, I wish I could shed some more light on the letters only thing, but I am confused as to whether that is for the hashed passwd or the hash itself. I suspect it may be the passwd itself but I am not sure since it is not clear.

Re:Someone explain?

[Doctor Memory (6336)]

I suspect it may be the passwd itself but I am not sure since it is not clear.

Of course it's not clear, it's been hashed -- haven't you been following along?

Re:Someone explain?

[Foolhardy (664051)]

To stop this compatibility behavior, see the MS knowledge base article Q299656 [microsoft.com].

Basically, you want the security policy "Network security: Do not store LAN Manager hash value on next password change." in Group Policy->Computer Configuration->Windows Settings->Security Settings->Local Policies->Security Options.
Or you can set the registry value the policy sets directly: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\Lsa\NoLMHash.
Note that on 2000 and earlier, this prevents only the cre

Re:Someone explain?

[afidel (530433)]

however, for backward compatibility with older Windows 9x machines some companies still use NTLMv1.

Actually by default all passwords shorter than 14 characters are stored as BOTH LMv2 AND LMv1 hashes in the registry and both are valid for authentication if they are present. This is true for both Windows Server 2000 and Server 2003. You CAN disable the storage of LMv1 hashes but that does not remove any existing hashes from the SAM, you would also need to force LMv2 authentication and even then someone who could steal the SAM file could get the plaintext.

Re:Someone explain?

[afidel (530433)]

C:\WINDOWS\system32\config\SAM for XP and
C:\WINNT\system32\config\SAM for Windows 2000
There are tools out there like PWDUMP from SAMBA that can extract the hash from a SAM file.

Re:Someone explain?

[Dun Malg (230075)]

Anyone feel that a article summary with this much technical detail should have some links or explanation of what it's actually talking about? And since I'm one of the ignorati who doesn't understand, could some please explain to me?

In simple terms, a hash is a sort of "one-way" function. Passwords are often saved as hashes. THe password is fed in one end, and the hash comes out the other. The hash is saved in a file. When one logs in and types in one's password, the system feeds what you typed in through the hash function and checks if the result matches the hash of your password. Since there is no way to reverse the hash process, it's been considered fairly safe to leave these hashes moderately unprotected. This database is, presumably, a sorted collection of the possible hashes from all letters-only passwords up to a certain length. The hash can't be reversed to get the password it came from, but a huge database of all possible hashes and their originating passwords certainly makes that irrelevant.

Re:Someone explain?

[gclef (96311)]

This database is, presumably, a sorted collection of the possible hashes from all letters-only passwords up to a certain length

Actually, last time I checked, most versions of windows that used LanManager hashes split the password string into a new hash every 7 characters (yes, that is incredibly stupid). In other words, if your password was 8 characters long, there would be two hashes for your password: one that covered the first 7 characters, and one that covered the last 1 character.

So, I would assume the folks here have done every letter combination for up to 7 character long passwords, since that's all they'd need to do.

Re:Someone explain?

[Blastrogath (579992)]

LM hashes are Lan Master hashes, an old microsoft standard.

They're not used much anymore because they're ludicrously insecure yet windows still makes a LM hash of all passwords by default. You can easly get someone's (administrator) password from these hashes, and the hashes aren't hard to get from a computer.

They're not used and can give others your password, and now there's a site that'll give you any letters only password from it's hash in seconds.

lookup table vs computation

[sczimme (603413)]

Instead of using the brute-force computing approach of generating hashes and comparing them to the known hash (looking for a match), this process uses an already created list or table of passwds and their associated hashes. Creating the table is computationally and storage[ally] non-trivial, but once it is in place cracking a passwd is as easy as grep-ing through the list/table to find the known hash.

Nutshell:

cracking passwds individually: no up front work and extremely variable cracking time

crea

of course...

[Qwerpafw (315600)]

The files increase exponentially in size for passwords which include numeric characters. While the security risk exists, good password design obviously minimizes it. People aren't going to be lugging around terabyte-sized password database files.

Re:of course...

[Jeffrey Baker (6191)]

Why not? A terabyte fits in a briefcase these days, and a remote attacker is not constrained by space. A petabyte of storage is barely one rack's worth and not very expensive, either.

Re:of course...

[EddieBurkett (614927)]

People aren't going to be lugging around terabyte-sized password database files.

Not yet they aren't, but it's not unreasonable to expect that someday they will. Then again, one would hope by that point sufficient encryption would exist such that anything vulnerable would have been replaced. It's not like people continue to run unpatched legacy systems nowadays. . .

Re:of course...

[GTRacer (234395)]

People aren't going to be lugging around terabyte-sized password database files.

I thought that was the whole point of this exercise - that a centrally-available hash master was viable.

And just out of curiosity, wouldn't the master file be really compressible?

GTRacer
- My PW's have always included numbers and often punctuation just for this reason

Re:of course...

[cduffy (652)]

And just out of curiosity, wouldn't the master file be really compressible?

Not really -- good hashes act random.

Re:of course...

[Corrado (64013)]

People aren't going to be lugging around terabyte-sized password database files.

But they wouldn't need to. All you need is a telnet client and a network connection. And there is no reason that one couldn't add to the existing files.

In fact, this would be a really cool project to break up into pieces. Bob takes everything starting with A|a, Steve takes B|b, etc... Then just build a front end (accessable via telnet) that passes each query off to each back end and returns the results. You could even hac

Non sequitur?

[Nighttime (231023)]

Disk storage has increased tremendously in the past 5 years and the blatant insecurities in the antiquated LM hashing technique have not gone away;

Maybe I'm being a bit thick here but how does the first part of that sentence relate to the other?

Re:Non sequitur?

[PitaBred (632671)]

I beleive it means that you can make a lookup table relatively cheaply, rather than having to generate it on demand, and thus greatly speed up the LM hacking.

Re:Non sequitur?

[stray (73778)]

it's all about a time/space trade-off:

- you have a password hash you want to crack

you can either:

- brute force your way through a long list of possible passwords to find one that matches the hash; everytime you do this, it takes a lot of time and processing power

- or you can go through all possible passwords ONCE and save the resulting hashes; subsequent cracking jobs are very fast, but you wasted a lot of space to store all possible hashes.

thus, if disk space is cheap and you can afford to keep a couple of gigs in pre-computed hashes around, you have a very fast way of cracking weak hashes. a couple of years ago, this was not possible due to hard drives being like 200MB large.

Clear writing is a lost art...

[NotQuiteReal (608241)]

If the article were written more along these lines;

It is well known that the LM (LanManager password) hashing technique used by older Windows OSes (thru WinMe) is insecure. Now someone has really pointed this out by simply saving all possible password hashed in a database made possible with today's cheap, large disk drives...

But that wouldn't be nearly as much fun - by being vague you get many more posts correcting grammar, explaining what should have been there in the first place, etc.

In short, better writing might promote more useful comment posts, and we wouldn't want that on Slashdot.

modeling unknown passwords

[strook (634807)]

There's gotta be a better way to model what a user's password can be than just all combinations of only letters, or a list of common passwords plus substitutions. I think these are the only ones I've seen. But this doesn't really reflect that "fiqojeio" is a much less likely password than say "foo7bar+".

I think this sort of attack could get much stronger than people expect if there was some sort of Markov-process-ish way of generating plausible passwords. I mean, if Google can guess when you spelled something wrong, these programs should be able to figure out which strings are more likely to be passwords. Or maybe I'm overgeneralizing by how I pick my own passwords....

Re:modeling unknown passwords

[Dun Malg (230075)]

There's gotta be a better way to model what a user's password can be than just all combinations of only letters, or a list of common passwords plus substitutions. I think these are the only ones I've seen. But this doesn't really reflect that "fiqojeio" is a much less likely password than say "foo7bar+".

I see this as mostly just a harbinger of Things To Come. At what point will it become a trivial matter to generate a database of all possible hashes of all possible passwords (incl. all symbols and numbers

Re:modeling unknown passwords

[shrikel (535309)]

much less likely password

Yes, much less likely, but people sometimes choose things like that for their passwords anyway. My wife's self-chosen password to her bank account, for example, is 'Nfok3G!~qOmp', and I can tell you that NOBODY is going to guess that one!

My passwords

[nuggz (69912)]

I tend to use 6-8 characters.
Numbers, upper and lower case letters.
so 62^+62^7+62^8 =2.12x10^14 combinations.
I think I'm okay for a while.
Multicase passwords do HUGE things to the statistics of the problem.

Re:My passwords

[kidgenius (704962)]

Multicase passwords do HUGE things to the statistics of the problem.

Normally, yes. But the LM method converts everything to uppercase before hashing. So your 8 character password, that had 10^14 combinations has just been reduced down to (26+10)^8... combinations or 2.9*10^12. Now, you might be saying "That was only a factor of four drop, no big deal, still 10^12 combos left. Realize though, that this DB currently has all possible passwords of a maximum length of 15 characters. This is 2.8*10^13 combos. This is less than the 10^12 possibilities that your password has. Consider that it searches in 0.2 seconds, and your password is not so safe.

Re:My passwords

[delta407 (518868)]

Multicase passwords do HUGE things to the statistics of the problem.

That's why Microsoft's LM hashing algorithm is so cool -- it uppercases your password before hashing. With this algorithm, multicase passwords do nothing to the statistics.

I think I'm okay for a while.

You're okay for about 2 hours and 34 minutes: that's how long it takes to traverse every possible alphanumeric input on the author's test rig. Additionally, the article suggests that tables including every possible LM hash for [A-Z0-9] would occupy only 1.2 TB of space, meaning that these lookups could be done in a matter of milliseconds instead.

Holy Ratshit, Batman!

[deacon (40533)]

That's why Microsoft's LM hashing algorithm is so cool -- it uppercases your password before hashing. With this algorithm, multicase passwords do nothing to the statistics.

Please, please tell me you are joking.

I am no fan of MicroSoft, but come on, no one would really do something like this.

I figured that my passwords are safe because they are normally the tunes of music..

For example

Taaaah-dum+dum*dum#dum#taaaaah|dum!tum^d u m$tum%rumtittytum.

And since I am tone deaf, It's not very likey that someone will

Re:Holy Ratshit, Batman!

[Oestergaard (3005)]

He is not joking. And he didn't tell the whole story either; there are several either tremendous stupidities in the LM hash which makes long passwords worthless, and relatively short ones easier to break than their length would otherwise indicate (separate grouping of characters, triple-DES'ed *independently*).

The fun part is that any default install of Windows (at least up to and including XP) will send out the current users LM hash if he tries to connect to a SMB share.

So, if someone placed a link on their homepage to a patched Samba which logged LM hashes, they could gather LM hashes from most of their windows using visitors.

This would *include* those behind many firewalls, because many default firewall setups will allow *outgoing* connections - and in this particular case, it is indeed the windows client that is initiating the connection to the remote web server in order to send away the current users LM hash (along with username, domain, local machine name and other goodies).

Yes, I told CERT about this some three years ago. They wouldn't touch it with a five foot pole. I then told Microsoft about it. Their response was something like "fixing that problem would require us to re-design our windows networking layer - therefore it is not a security problem".

Well, there you have it.

But hey, if you're on Windows you're fucked anyway, and none of this should really come as a shock to you :)

Here's how

[Foolhardy (664051)]

In the local Security Policy->Security Options, you want to change "Network security: Lan Manager authentication level" to at least "Send NTLM response only". Or the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\Lsa\LmCompatibilityLevel to at least 2.

See this [microsoft.com] page for this and related policies.
This [microsoft.com] for an overview of LM, NTLM and NTLMv2.
And here [microsoft.com] to see how to prevent storage of LM hashes.

Re:My passwords

[Pete (big-pete) (253496)]

I tend to use 6-8 characters.
Numbers, upper and lower case letters.

I tend to use uppercase, lowercase, numbers, and punctuation. An example might look like: s1mhm$tM-BIdc! (just off the top of my head, and memorable to me)

Most people do have horrific password security though...

-- Pete.

This just in from beginningtoseethelight...

[jmcneill (256391)]

Dear Slashdot Readers,

Thank you for letting us know your passwords.

Regards,
The staff of beginningtoseethelight

awright!

[sootman (158191)]

now we're gonna kick it old-skool and /. a telnet server! woo hoo, just like the old days! our next target: gopher://sunsite.unc.edu

Whew! I'm still safe

[DongleFondle (655040)]

I guess I'm still relatively safe though because my admin password is not only 10 characters long, but has capitals, lower case, numbers and symbols in random order.

Its H82sd*e2Tn.

Nobody is ever going to crack that!!!

Disable LM Hash

[mixmasterjake (745969)]

Unless you have machines on your network running 95/98 you should disable LM Hash in Windows. It is there only for backwards compatibility and you can disable it easily:

http://support.microsoft.com/default.aspx?scid=KB; EN-US;q299656 [microsoft.com]

Hashes

[CastrTroy (595695)]

I had a thought last month, when there was news of duplicates being found in the MD5 hash. For security purposes, couldn't we just use the MD5 hash along with the SHA1 hash. Would there be any string of data which held the same hash for both MD5 and SHA1? This could help increase the power of digital signatures. Anyway, this database of hashes and passwords only works for letter-only passwords, which are assumed to be quite easy to brute force anyway.

How long until...

[rewt66 (738525)]

beginningtoseethelight gets hit with a DMCA lawsuit?

And, yes, I am aware of the irony of posting this on election day in the US...

It doesn't matter. Really.

[juan large moose (27329)]

The LM and NTLM hashes are password equivalent.

If you have the LM Hash, and the server accepts LM Authentication, you don't need the password. At all.

Likewise, if you have the NTLM Hash, and the server accepts NTLM, NTLMv2, or LMv2 authentication, then you don't need the password.

The hashes are password equivalent.

I've written it all up in my online book [ubiqx.org] (slashdot review [slashdot.org]), but...

Basically, the hashes are generated with no salt...nothing to obfuscate them. The algorithm used to log in is challenge/response:

• The server sends a random 8-byte string (the "challenge").
• Both client and server encrypt the challenge using the LM and/or NTLM Hash, not the password.
• The client sends its result (the "response") back to the server.
• The server compares results. If they match, the server grants access.

So... The hash is not exposed on the wire. It has to be reversed from the challenge and response. That's possible (and fairly easy with LM Auth), but it's got little to do with the password/LM Hash database.

The only way to use the LM Hash database to reverse the challenge/response is to use it as a hash dictionary.

Chris -)-----

Rainbow Tables , Make your own!

[OneArmedMan (606657)]

A buddy of mine works in Network Security, so for something to do and cause it would help him with his job we made our own rainbow tables. The time it took and disk space is roughly as follows.

5 average pc's ( all about 2000Mhz or so ) took about 30 days, and generated about 18Gb or tables.

Now these tables give us about 95%+ hit rate on any LM Hash we , erm "acquire"

The tables contain all hashes upto 14 Chars length using all letters all numbers and some symbols.

Just about the only hashes these tables wont hit are the machine generated ones.

I guess the point is turn *OFF* LM hashes at all cost, and if you absolutely "must" use them, make sure you kept them secure!

oh and a side note, if you are interested in cracking / brute forcing LM hashes, make sure to run them thru a copy of L0pht Crack or some such to get all the Blank, Pass==Name, Pass==Name-reversed hashes out of the way first.

Re:What is an LM hash?

[bunnyman (121652)]

Windows generates and stores user account passwords by using two different password representations, generally known as "hashes." When you set or change the password for a user account to a password that contains fewer than 15 characters, Windows generates both a LAN Manager hash (LM hash) and a Windows NT hash (NT hash) of the password. These hashes are stored in the local Security Accounts Manager (SAM) database or in Active Directory.

The LM hash is relatively weak compared to the NT hash, and it is therefore prone to fast brute force attack.

Source: http://support.microsoft.com/default.aspx?scid=KB; EN-US;q299656

Re:What is an LM hash?

[Tony Hoyle (11698)]

It's what Windows used to use to do authentication (NTLMv1). They improved on it a while ago (NTLMv2) but still transmit the LM hash by default in all authentication - basically rendering the security of NTLMv2 completely useless.

I used to piss off the admins where I last worked by runnig L0hptCrack over their tightly secure network and telling them the admin password every time they changed it :) Luckily I was high enough in the company to get away with it (I was authorised to know the password anyway... just more fun that way).

You can and should switch this off unless you're using just a home LAN (beats me why it isn't off by default). Even better upgrade all your network to at least Win2k then disable NTLM entirely and use kerberos (samba 3 can be a full kerberos domain member).

(FYI: See:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\cont ro l\LSA\LMCompatibilityLevel

A value of 0 (the default) means you have no security.

Change it to 3 on your clients, or 5 on your Domain controller)

Re:What is an LM hash?

[jfengel (409917)]

LM = Lan Manager, the Windows 95 way of handling network passwords.

hash = a way of storing passwords without leaving the password on the disk. You encrypt the password into a hash code and store that instead. You can't unencrypt it to derive the password but you can check a password guess by encrypting the guess the same way. If the guess hash == the password hash, you get in.

The best part is, you don't have to keep the hash code a secret, because it's not the hard part. You're not asked to provide the hash value; you're asked to provide something that hashes to the value. So you can store it on the disk and even send it out over the LAN where it can be sniffed.

That's very convenient: you can cache the hash code on every computer without having to trouble the central server to do the work. You don't want to send the password over the network (where it could be sniffed); nor is sending the hash code to the server for verification (because that could be spoofed). You distribute the hash to each computer, then let it decide if the password guess is correct. The password never goes across the network.

That works as long as you can't decrypt the hash. But if you work long enough you can just brute force it: just run all the passwords until you come up with the one that hashes to the same value. And you can do it offline: you take the hash code back to your own computer(s) and do the brute force there. You're not sitting in front of the computer you want to hack.

The old LM hash code was relatively short; ten years ago when it was developed disk drives were much smaller. Now a combination of big disks and big processors (and clever algorithms) make it possible to brute-force it.

The thing is, Windows NT and later use NT hashes instead, which are more secure. But for compatability with Windows 95 and 98, by default they also store the LM hash code. Which means that your password is sitting on a visible place on the disk, encrypted in a way which is readily reversible to modern hackers.

That's been true for a while, but this new hack makes it trivial to decrypt; it used to take hours.

Re:Please explain

[rkhalloran (136467)]

RTFA, but quickly, LM hash (Lan Manager hash) is the older MSFT scheme for encrypting passwords. It's been known as insecure for some time, but thought to take an fair amount of time to crack. This saves the problem; take the hashed PW, run it through this site and recover the password.

Re:Please explain

[Not_Wiggins (686627)]

Even worse, take the hashed PW, run it through the site, and if it DOESN'T return the password, you've already eliminated a large chunk of possibilities from your (next step) brute force attack.

Now, admittedly, it would still take ungodly long time to crack all the next possibilities, but it does save SOME time.

This also makes one wonder if the next generation of password cracking is to distribute the terrabytes of pre-digested passwords across multiple systems so that you have the "numbers only" database

Re:And why do I care?

[duffbeer703 (177751)]

LM as in NTLM... which means that old-style NT Authentication will be going away soon.

RTFA, eh?

[andyrut (300890)]

LM is a password-hashing scheme used in Windows. Read the first paragraph of the linked article:

This article is based primarily on a local default setup of NT5.0 Professional or 2K (Windows 2000), however there maybe additional verified references to XP Professional and Server Editions. Much will apply across the NT range, but not all has been verified.