Awesome write on how the major web browsers store your password and how you can recover them on
raidersec’s blog

One of my friends is trying to raise money for his own D&D type board game on kickstarter so im trying to give a little plug 🙂
http://www.kickstarter.com/projects/1408460255/warparty?ref=live

The latest version of OS X Lion allows any user to easily change the password of any local account, due to permissions oversights on Apple’s part. The news comes less than a month after another Lion vulnerability that let users bypass LDAP without a password gained notoriety.

Originally reported by Defence in Depth blogger Patrick Dunstan, the root of the newly discovered problem in Mac OS X 10.7 is tied to the user-specific shadow files used in modern OS X platforms. These files are essentially hash databases and contain, among other things, the user’s encrypted passwords. Ideally, they should be accessible only via high-privilege accounts.

According to Dunstan, Apple dropped the ball in terms of how Lion handles privilege. “Whilst non-root users are unable to access the shadow files directly, Lion actually provides non-root users the ability to still view password hash data,” Dunstan wrote. “This is accomplished by extracting the data straight from Directory Services.” Any user can accomplish this trick by simply invoking the directory services listing using the /Search/ path — for example, $ dscl localhost -read /Search/Users/bob (where “bob” is the username). This causes Lion OS X to spew out the contents of Bob’s shadow hash file, including data that can be used to crack Bob’s password with a simple script, such as a Python script written by Dunstan.

Source: Info World

Ducati Diavel ignition starts with password only, with no key. The password is last 4 of VIN on all models.

Programmable embedded devices have the capability of being detected as a HID device , just like a keyboard or mouse. So if you have physical access and a minute alone you can compromise a system with something the size of your thumb. The possibilities are endless, HTTP/FTP download, injecting binaries into debug or Powershell etc.. Also this device is cross platform which means Windows,Linux,UNIX and Apple are all vulnerable.

Here’s an example project we made for a Windows7 box that adds a new Admin user to the system and hides that user from the logon screen. the whole process takes about 16 seconds , with most of the time taken by the device being detected as a keyboard and the driver installed. The device costs about $20 and can be found here

Outputted into a 500MB torrent file, currently residing on the popular torrent tracker ThePirateBay is a database dump of about a million or so commenters and staff passwords.

Inside the torrent file lies a file entitled Readme.txt. This file is potentially the most sensitive of them all, for it holds the usernames and passwords used by the entire Gawker staff, focusing particularly on Gawker’s founder Nick Denton.

The usernames and passwords to Denton’s Google Apps, Twitter, Campfire accounts are all listed; Denton uses the same password for them all.

Also some gaming sites ftp passwords were stolen too..

Though all of the passwords were encrypted,simple ones may be vulnerable to a brute-force attack. You should change your Gawker password and on any other sites on which you’ve used the same passwords.

Passware Kit decrypts hard disks encrypted with BitLocker or TrueCrypt in a matter of minutes if the target computer is running. Now Passware Kit is capable of this instant decryption even for powered-off computers by analyzing a hibernation file (hiberfil.sys).

The software instantly extracts BitLocker and TrueCrypt encryption keys from a hiberfil.sys file, which is created automatically when a system hibernates. This means that if the target computer with a mounted BitLocker or TrueCrypt hard disk has hibernated at least once, Passware Kit will instantly decrypt the hard disk even if the target computer is no longer running.
http://bit.ly/pw-55

The Password Exploitation Class was put on as a charity event for the Matthew Shoemaker Memorial Fund . The speakers were Dakykilla, Purehate_ and Irongeek.

Lots of password finding and crack topics were covered. Hashcat, OCLHashcat, Cain, SAMDump2, Nir’s Password Recovery Tools, Password Renew, Backtrack 4 R1, UBCD4Win and much more.
(more…)

During a recent password audit, it was found that a blonde was using the following password:

“MickeyMinniePlutoHueyLouieDeweyDonaldGoofy”

When asked why such a big password, she said (wait for it)….

… that it had to be at least 8 characters long.