Reusable Security

Finally back from Shmoocon and Washington D.C. I had an absolute blast and now I'm ready to get back to work. While there's a lot I want to talk about regarding the Con and some of the other research going on, I'll save that for my next post. I finally got a chance to sit down and watch my own presentation on rainbow tables, and there are a couple of things I'd like to add. The real focus on this research is to help law enforcement . Ideally I see a central agency who has the spare computer power generating rainbow tables containing very complex word mangling rules and large dictionary files. They would then distribute these tables to state and local agencies who don't have the resources to do much in the way of password cracking. This way these local agencies can cheaply crack a large number of passwords without having to invest in the resources to do so. Now this won't help with salted files, but in instances where the bad guy uses the same password on both t...

I write most of my code in C and occasionally C++. I know Perl, (or Java), would be better in many cases but all my programming classes, (the school kind), require C so that's what I'm banging out most of the time. Add to that the fact that most password cracking programs are written in C/C++, ( JtR written in C), (L0 phCrack written in C), ( rcrack written in C++), (Access Data's PRTK's cracking engine is written in C), so C tends to be my language of choice. Well, today I came smack up against the fact that the strnstr () function isn't widely supported across platforms. Yes, I know the "n" functions aren't much better than the other string functions. Heck, I've had more than enough segfaults even when I thought I was using them correctly. At the same time though, they are "easy" to use and supported everywhere, (with the exception of strnstr ). I know about the "l" functions, but once again they are mainly used on OpenBS...