Some Random Facts About Passwords

In this post I've collected some facts and interesting resources about passwords.

1. https://howsecureismypassword.net - site that shows how long it would take a desktop PC to crack your password.

2. Can You Trust Your Browser With Your Passwords? - good article where author analyses how most popular browsers work with saved passwords. The most secure is FireFox, then Internet Explorer and the least secure is Chrome.

3. Password use by user type:

Password Authentication from a Human Factors Perspective: Results of a Survey among End-Users
4. How I bypassed 2-Factor-Authentication on Google, Facebook, Yahoo, LinkedIn, and many others. - in this post Shubham Shah describes how he managed to bypass it.
As for me, I tried to use 2FA system, but it was too inconvenient for me: if cookies are disabled or are deleted after closing the browser then you can't save the safe device, so every time you should get secret codes to mobile phone. I decided that this complexity is not worth it.

5. Is Pavlovian Password Management The Answer? - Lance James suggests a very simple and genius idea about protecting the passwords: the expiration of password should depend on its complexity. For example, if user creates a password that can be cracked in 3 days, the password should expire in 2 days. So if user doesn't want to change it too often he have to chose a complex one. And the whole beauty of this system is that it doesn't limit users, but trains them.

6. Google Glass Snoopers Can Steal Your Passcode With a Glance - how passwords (especially PIN codes) can be stolen offline using video cameras. The most shocking fact for me was that "a $700 Panasonic camcorder’s optical zoom was able to catch a PIN typed on a glare-obscured screen from 44 meters away".

7. Mikko Hyppönen and Sean Sullivan (from F-Secure) are talking about strong passwords:


8. Good TED talk about how users choose their passwords and what web site owners can do with it:

Copy-Paste Pure Text

I hate when I copy some text, paste it into the document or mail and it is copied with formatting (bold colorful huge words). So I started to look some extension, or app, or desktop software that allows to copy pure text without any formatting. And I found, that there is actually exists a key combination that works without any software!
In Windows You should just copy-paste the text with formatting, select the copied part, click Ctrl + Spacebar and formatting is gone. Unfortunately this does not remove hyperlinks or tables.
In Mac OS You should copy the text and paste it with hot keys Cmd + Alt + Shift + V and text is pasted without formatting. Unlike Windows combination this also removes hyperlinks and tables.
In both OS's these hot keys are working everywhere: in text editors, in browsers, in mail clients etc.

Arduino LeoStick

On the Microsoft TechDays 2013 in Tallinn I heard about Rubber Ducky - a USB device that simulates a keyboard and which you can use for penetration testing. I really wanted to buy this device, but it was too expensive - 36.99$ the cheapest device + 65.14$ shipping to Estonia = 102,13$.

On MobileMonday in Tartu I heard about Arduino and Raspberry Pi and their capabilities and thought that I can use them for building my own Rubbery Ducky. And I've found a LeoStick on freetronics.com!

LeoStick cost is 29.95$ + shipping to Estonia 11.00$ = 40.95$, which is more than 2 times cheaper, than Rubber Ducky. By the way, the shipping is quick - on 10th December I made an order and got the LeoStick on 19th December.



The freetronics.com sends manuals and instructions with Arduino boards, which is very nice.

"Getting started" page was really helpful for me, who encountered with Arduino for the first time:


Also Arduino web page has very detailed manuals with examples about libraries. For example Mouse and Keyboard libraries, that I need for Rubber Ducky device.

And here is my first Hello World software, that prints "Hello world!" in editor with 5 sec delay:


Next goal is to write a script for white hacking at work.

The Real Hustle

The Real Hustle - quite interesting BBC TV series about fraud schemes.

You may ask why I write in my software testing blog so lot about frauds. Well, because fraud is some sort of hacking, and hacking is what software tester trying to escape done with their software.

Another thing - fraud scheme is a great example of thinking out of the box.

And the third thing - it's just a very interesting theme.

Example of keylogger affaire:

"IAmA former identity thief, credit card fraudster..." @reddit

I have heard many complimentary mentions about reddit.com, but as for me the percentage of really good info is too small.
However I found there a quite interesting IAmA post "IAmA former identity thief, credit card fraudster, blackhat hacker, document forger. AMA" by driverdan. For those who are not familiar with this subreddit I mention, that administrators require a proof that author is actually person who he claims to be, which makes info in this posts a little more truthful.

So, credit card fraudster (post is actually about credit cards, not about blackhat hackers) is answering any questions. I also mention that this post (and answers) were taken about a year ago, but for me they are still interesting.

Here is a video of Dan DeFelippi (driverdan himself) talking about credit card frauds:


And here You can read some screenshots of the most interesting parts (some of them are being told in video). Note, that the answer of the author is highlighted by blue nick background.

Johnny Lee Hacking Wii

And here is his webpage with downloadable software and some other videos: Johnny Chung Lee Projects

WTF is this Character?

If You google phrase "WTF is this Character?" You get articles about this ‪‫‬‪‫‬‭҉P.
This character mirrors the ASCII characters: for example, if you copy this character in the text field next typed text will be backwards. This is a standard common character for displaying right-to-left texts.

So, what does it means for the web? For example, we have articles, where You can add a comment. And we have a black list of bad words, that You can't use in comments. So now You can just copy this character, insert bad word left-to-right (kcuf) - in the result the word in the comment is published in right-to-left mode. And the whole beauty is that in the database text is saved also in left-to-right mode (kcuf), so if administrator want to find and delete this comment he could not find it by the text.

Sometimes after publishing this character (for example in the comment) the other content of the site is mirroring too. So if Your comment in the top of the page the whole content of the page will be right-to-left (sometimes!).

Wikipedia article: http://en.wikipedia.org/wiki/Unicode_control_characters#Bidirectional_text_control
Tõnu Samuel - white hacker, who talks about this character in his presentations - http://vimeo.com/19230557 (in Russian). By the way, Tõnu suggests to use white list (not only black) for characters to resolve this problem.

How To Crack 4-Digits PIN On Android With Frost

Tilo Müuller and Michael Spreitzenbarth did a very interresting research at Erlangen University in Germany: they unlocked a mobile phone using so called cold boot attack. The most important part, on what is based the research, is that RAM contents fade away more slowly if RAM chips are cold.

In this paper, we aim at recovering valuable information from encrypted smartphones. Roughly speaking, we analyze the characteristics of the remanence eff ect on smartphones, prove that Android's boot sequence enable us to perform cold boot attacks, and show that valuable information can be retrieved from RAM. To this end, we present our recovery tool Frost (Forensic Recovery of Scrambled Telephones). Frost can be loaded to a smartphone after we got physical access to it, and without the need to have user privileges on it. We carry out our experiments exemplarily for Galaxy Nexus devices.

Detailed research description with pictures: FROST: Forensic Recovery Of Scrambled Telephones
Technical report: Forensic Recovery of Scrambled Telephones
Easy readable article in Forbes: "Frost" Attack Unlocks Android Phones' Data By Chilling Their Memory In A Freezer


Cracked 4-digit PIN

How ATM Were Hacked

Some stories about hacking the ATM.

In Lithuanian town Šiauliai students cheated the Swedbank ATM in quite easy way. They inserted their own cards into ATM, entered the sum which was available for those accounts, but when the ATM gave the cash they took only 1 note from the middle of the pack. The ATM thought that cash wasn't taken so it took them back and didn't decrease the account total sum. In that way student stoled about 13000 EUR.
Unfortunately the end of the story is not so wise. When the bank suspected the fraud they closed the account. Naive students went to the bank telling that they lost their cards, where they were arrested.

The source is article (in Russian, 18.03.2004) in Baltic internet portal. In the article comments is written that same system was actually applied earlier in Finland. And that this trick you can do only on the old models, the new ones decrease total sum anyway and the "forgotten" cash is going to the special compartment. Later workers count these "forgotten cash" and verify the info. If it match - then they increase the sum.

In the same comments is written one more interesting detail: if you request sum which is 10 times larger than you have in you account, then ATM is giving you cash sum which it has. In way like "ATM has only 10000 EUR".


And the newer one story about hacking the ATM in Estonia.
The left one is correct and the right one is with hacking devices on it:


Above the screen there is a camera which simply records the PIN code:


In the card reader area is an additional card reader, which copies some info from inserted card magnetic tape:


Later cheater copied info from the inserted card to the blank card and simply used the fake card and PIN code to take cash from random ATM.
Source articles (in Estonian): Postimees, Delfi.

Get More Out Of Google

Josh Catone and HackCollege created a great poster (the longest poster I've ever seen) about effective search in google.

Source: How to Use Google Search More Effectively [INFOGRAPHIC]

How To Cheat At Online Courses

I am studying IT at the University of Tartu, where a lot of materials and tests are online. We have a moodle.ut.ee system for organizing all these online stuff and as I founded yesterday it is not very suitable for IT students.

Another day I had to do some crosswords and when I saw them I was really interested how they were made.


So I looked into the source code of the page (I am usually looking into that if the web page structure is interesting for me). The crossword is made in JavaScript and I was really surprised when I saw all the correct answers there:


L = new Array();
L[0] = new Array('','G','','','','','','','','','','','','P','','','','','','');
L[1] = new Array('A','R','E','A','A','L','I','L','I','N','G','V','I','S','T','I','K','A','','');
L[2] = new Array('','E','','','','','','','','','','','','\u00DC','','','','','','');
L[3] = new Array('','E','','','','','','','','','','','','H','\u00C4','G','U','S','A','D');
L[4] = new Array('','N','','','','','','','','','','','','H','','','','','','');
L[5] = new Array('','B','','','','','','','','','','','','O','','','','','','');
L[6] = new Array('','E','','','U','N','I','V','E','R','S','A','A','L','I','D','','','','');
L[7] = new Array('','R','','','','','','','','','','','','I','','','','','','');
L[8] = new Array('','G','','','','','S','\u00DC','N','K','R','O','O','N','I','A','','','','');
L[9] = new Array('','','','','','','','','','','','','','G','','','','','','');
L[10] = new Array('','','','','','','','','','','','','','V','','','','','','');
L[11] = new Array('','','','','','D','I','A','K','R','O','O','N','I','A','','','','','');
L[12] = new Array('','','','','','','K','','','','','','','S','','','','','','');
L[13] = new Array('','','','','','','O','','','','','','','T','','','','','','');
L[14] = new Array('','','','','','L','O','G','O','P','E','E','D','I','A','','','','','');
L[15] = new Array('','','','','','','N','','','','','','','K','','','','','','');
L[16] = new Array('','','','','','','','','','','','','','A','','','','','','');


In fairness I should say that this crossword is made using quite famous test systems Hot Potatoes.