Cryptographers Aim to Find New Password Hashing Algorithm

Passwords are the keys to our online identities, and as a result, they’re also near the top of the target list for attackers. There have been countless breaches in the last few years in which unencrypted passwords have been stolen from a database and leaked online, and security experts often shak...

John the Ripper Linux Password Cracker

This module uses John the Ripper to identify weak passwords that have been acquired from unshadowed passwd files from Unix systems. The module will only crack MD5, BSDi and DES implementations by default. Set Crypt to true to also try to crack Blowfish and SHA256/512. Warning: This is much slower...

SHA-1 Hash Collision Could Be Within Reach of Attackers By 2018

It’s been just a few days since NIST approved Keccak as the winner of the SHA-3 competition, and it likely will be some time before we begin seeing the new hash algorithm popping up in common products and services. However, some in the cryptography community say it may not be a bad idea to start...

SHA-3 Winner Chosen, But It May Be Years Before Keccak Has an Effect

Now that NIST has selected Keccak as the winner of the five-year-long SHA-3 competition, the next question to be answered is whether the new hash algorithm will be implemented in any meaningful way in the near future. The answer, for right now at least, appears to be probably not. The SHA-3...

Forthcoming SHA-3 Hash Function May Be Unnecessary

For the last five years, NIST, the government body charged with developing new standards for computer security, among other things, has been searching for a new hash function to replace the aging SHA-2 function. Fives years is a long time, but this is the federal government and things move at the...

Scientific Linux Security Update : perl on SL6.x i386/x86_64

Perl is a high-level programming language commonly used for system administration utilities and web programming. The Perl CGI module provides resources for preparing and processing Common Gateway Interface CGI based HTTP requests and responses. It was found that the Perl CGI module used a...

Social Site Formspring Says 420k User Password Hashes Posted Online

Hackers broke into a development server at Formspring, a social Q&A site, and made off with the password hashes for 420,000 users and later posted them online. The company has reset all of the users’ passwords and said it also has changed the way that it handles passwords. Formspring officials sa...

nspr, nss security update

CentOS Errata and Security Advisory CESA-2012:0973 Merged security bulletin from advisories: https://lists.centos.org/pipermail/centos-announce/2012-July/080886.html Affected packages: nspr nspr-devel nss nss-devel nss-pkcs11-devel nss-sysinit nss-tools nss-util nss-util-devel Upstream details at...

CVE-2012-2743

Revelation 0.4.13-2 and earlier does not iterate through SHA hashing algorithms for AES encryption, which makes it easier for context-dependent attackers to guess passwords via a brute force attack...

CVE-2012-2743

Revelation 0.4.13-2 and earlier does not iterate through SHA hashing algorithms for AES encryption, which makes it easier for context-dependent attackers to guess passwords via a brute force attack...

CVE-2012-2743

Revelation 0.4.13-2 and earlier does not iterate through SHA hashing algorithms for AES encryption, which can enable context-dependent attackers to guess passwords through brute force. Affected component/file: the password hashing/crypto path in Revelation; root cause is lack of SHA algorithm ite...

CVE-2012-2173

The ODBC driver in IBM Security AppScan Source 7.x and 8.x before 8.6 sends an SHA-1 hash of the connection password during connections to a solidDB database, which allows remote attackers to obtain sensitive information by sniffing the network...

Default credentials

The ODBC driver in IBM Security AppScan Source 7.x and 8.x before 8.6 sends an SHA-1 hash of the connection password during connections to a solidDB database, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2012-2173

The CVE concerns IBM Security AppScan Source’s ODBC driver for solidDB. "The ODBC driver in IBM Security AppScan Source 7.x and 8.x before 8.6" transmits an SHA-1 hash of the connection password during database connections, allowing remote attackers to sniff network traffic and obtain sensitive i...

CVE-2012-2173

The ODBC driver in IBM Security AppScan Source 7.x and 8.x before 8.6 sends an SHA-1 hash of the connection password during connections to a solidDB database, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2012-2173: Undefined Security Weakness

The ODBC driver in IBM Security AppScan Source 7.x and 8.x before 8.6 sends an SHA-1 hash of the connection password during connections to a solidDB database, which allows remote attackers to obtain sensitive information by sniffing the network...

With LinkedIn: The Bell Tolls For Simple Password Hashing

This week’s revelations about leaks of user passwords from the professional networking site LinkedIn, dating Web site eHarmony.com and music site Last.fm suggest that even tech-savvy firms are slow to accept that hashes -a once-reliable technology for storing data online – now offer scant...

LinkedIn Confirms Millions of Account Passwords Hacked

LinkedIn Confirms Millions of Account Passwords Hacked LinkedIn Wednesday confirmed that at least some passwords compromised in a major security breach correspond to LinkedIn accounts. Norweigan IT website Dagens IT first reported the breach, noting that "Two days ago a package on the 6.5 million...

FreeBSD : portupgrade-devel -- lack of distfile checksums (b428e6b3-926c-11e1-8d7b-003067b2972c)

Ports security team reports : The portupgrade-devel port fetched directly from a git respository without checking against a known good SHA hash. This means that it is possible that packages built using this port may not match the one vetted by the maintainer. Users are advised to rebuild...

CVE-2012-0726: Undefined Security Weakness

The default configuration of TLS in IBM Tivoli Directory Server TDS 6.3 and earlier supports the 1 NULL-MD5 and 2 NULL-SHA ciphers, which allows remote attackers to trigger unencrypted communication via the TLS Handshake Protocol...