FC: One attempt to crack the passwords on the TSA's MS Word docs

From: Declan McCullagh (declanat_private)
Date: Tue Jan 07 2003 - 09:34:24 PST

  • Next message: Declan McCullagh: "FC: Massachusetts AG serves cryptome.org with subpoena for logs"

    [Obviously I can't share the password with the list (unless the DOJ were to 
    change its mind and pledge in writing not to prosecute). But here's an 
    update on one person's efforts. --Declan]
    
    ---
    
    From: "SteelHead" <bill@ries-knight.net>
    To: "Declan@Well. Com" <declanat_private>
    Subject: Update on TSA Document password.
    Date: Mon, 6 Jan 2003 08:27:25 -0800
    
    
    Still running the cracker.. Looking impressive so far
    
    Bill
    
    Recovering password for the file:
    C:\...121402.tar\tsa.security.docs.121402\LEO_FAQ.doc
    
    Detected MS Word 2000/97 document
    
    Starting password recovery engine...
    
    Starting Dictionary attack with mutations...
    Dictionary file: dict.txt, 3 mutation(s), 0 mistype(s), length: [1 - 15]
    Symbol set: 0123456789abcdefghijklmnopqrstuvwxyz
    
    Testing password: SSENLUFREWOP
    Done: tested 541,809 passwords in 07sec
    Attack speed (passwords per second): 75,251
    
    Starting Xieve attack...
    Xieve table: <built-in>, level: 1%, length: [4 - 9]
    Symbol set: 0123456789abcdefghijklmnopqrstuvwxyz
    
    Testing password: bbaysiabug
    Done: tested 13,740,655,448 passwords in 1 day 11h 44m 33sec
    Attack speed (passwords per second): 7,873,760 effective, 106,786 real
    
    Starting Brute-force attack...
    Brute-force length: [1 - 7]
    Symbol set: 0123456789abcdefghijklmnopqrstuvwxyz
    
    Testing password: 4oafk12
    (Tested 12,414,815,642 passwords in 1 day 7h 56m 54sec)
    Passwords checked per second: 107,941 
    
    
    
    
    -------------------------------------------------------------------------
    POLITECH -- Declan McCullagh's politics and technology mailing list
    You may redistribute this message freely if you include this notice.
    To subscribe to Politech: http://www.politechbot.com/info/subscribe.html
    This message is archived at http://www.politechbot.com/
    Declan McCullagh's photographs are at http://www.mccullagh.org/
    -------------------------------------------------------------------------
    Like Politech? Make a donation here: http://www.politechbot.com/donate/
    Recent CNET News.com articles: http://news.search.com/search?q=declan
    -------------------------------------------------------------------------
    



    This archive was generated by hypermail 2b30 : Wed Jan 08 2003 - 13:38:39 PST