At Defcon 2010 on Thursday, at a specified time, KoreLogic will release a file containing 53,000 password hashes. The file will contain passwords of varying types (such as SHA, SSHA, MD5, DES, Lanman, NTLM, etc.) and will range from being “easy” to extremely difficult to crack. The password file is not simply 53,000 randomly generated passwords which would favor the person or group with the most GPU/CPU bruteforcing horsepower. Instead, the password file contains passwords based on what we believe are challenging patterns. Passwords will be of varying lengths, patterns, and complexity. Creative password cracking techniques, rules, dictionaries, and tools will be needed. The teams who are smart about the methods they use (i.e., teams who can crack more, with less work) will most likely be the most successful.

KoreLogic will be giving away the following prizes for first, second, and third place:

• First Place: $600 (or equivalent item)
• Second Place: $300 (or equivalent item)
• Third Place: $100 (or equivalent item)

More Info: http://www.korelogic.com/defcon_2010-contest.html

Well we finally had enough time away from the lab to get around to the Kontest for the free Kon Boot license. The contest will be to write an article for our site on a password tool of your choice, it has to be a tool we haven’t covered already (but not an obscure tool that is only useful to a handful of people and no Nirsoft tools :p ). It can be a recovery tool, cracker, exploit etc… it doesnt have to be a long article, just as long as your covering the basics of how to use the tool and maybe some examples. The contest will end next Monday so get those articles in to . 10 lucky winners will receive the licenses shortly afterwards

A hacker named Kirllos seems to have sold close to 700,000 accounts, and has a rare deal for anyone who wants to spam, steal or scam on Facebook: an unprecedented number of user accounts offered at rock-bottom prices. Kirllos’ Facebook prices are extremely cheap compared to what others are charging. In its most recent Internet Security Threat Report, Symantec found that e-mail usernames and passwords typically went for between $1 to $20 per account — Kirllos wants as little as $0.025 per Facebook account.

Our Post Made pretty by Kate Bingaman Burt.

You know the lock-screen gesture protection used on Iphone/Android smartphones to prevent people from picking up your phone and having immediate access to all your personal information? Right, well, I hope you’re not relying on your phone’s swipe gesture protection to keep all your dirtiest secrets from falling into the wrong hands.
The next image is a good example of how easy it is to circumvent the Nexus One’s lock-screen gesture password.
(more…)

http://www.thelstalk.com/how-to-hide-your-password/

A new study, which is being published in the Proceedings of the Human Factors and Ergonomics Society, details just how long we’ve been aware of the password problem. It cites a study of Unix passwords from 1979, which showed that about 30 percent of the passwords were four characters or less, and about 15 percent being words that appear in the dictionary. Fast forward to 2006, when a separate survey of 34,000 MySpace passwords revealed that the most common were “password1″, “abc123″, “myspace1″, and “password”.

src: arstechnica.com