Analyzing PIN codes

[ A load of PIN codes visualized ]

You can click the image above to see it full size. It is a heatmap generated by us (@KluZz and myself), and the data are 4-digit PINs extracted from a physical access control system. According to the system operators, more than 50% of the PINs are believed to be selected by the users themselves, while the remaining ones are randomly generated by the system when a new 'user' is created and physical card is issued. The complete data set includes PINs for guest visitor cards etc.

According to Norwegian privacy laws, we didn't request and didn't get any ownership information on each PIN, so they cannot be traced back to individual users.

Now you may ask why did we do this?

Live Memory Password Aquisition

[ Screenshot of Passware Kit Forensic ]

Congratulations to Passware on their newest release of Passware Kit Forensic, now at version 11.7. This new release brings "instant" decryption of Microsoft Office 2007-2010 password protected documents through memory analysis, as well as some other interesting new features. I am quoted in their press release, available here (PDF): http://www.lostpassword.com/pdf/pr-120521.pdf

 Lets take a look at these new features from a threat/risk perspective:

Note to self: Inception + Ubuntu 12.04LTS

If you want to get inception up and running on (default config) Ubuntu 12.04LTS, you should expand your dependencies installation like this (adding juju, doxygen and g++):

sudo apt-get install git cmake python3 doxygen g++ juju


Now go ahead with the rest of the installation. :-)

Forbud mot skimmingutstyr

[Klikk på bildet for full størrelse]

Navnet på denne bloggposten + bildet over bør være en god indikasjon på hva denne bloggposten handler om. Legger jeg til endringen i straffelovens § 186, som annonsert i pressemelding 151-2010 fra Justis- og Beredskapsdepartementet 10. desember 2010, så kommer vi enda nærmere.

Challenge received

[Picture from lego.com - I'm a Star Wars fan!]

"Accept the challenge I do, your Highness". (Yoda, Star Wars)

Kirsi Helkala gave presentations at both Passwords^10 and Passwords^11. Her work on passwords is fascinating, now working as a associate professor at Gjøvik University College in Norway. See her list of publications to understand what I'm talking about. She has given me a challenge - nine in fact - all being unsalted MD5s. I need help! :-)

FY til Adecco!

I forrige uke var jeg muligens litt småtøff i kjeften da jeg la ut en melding på Twitter angående Adecco (Norge), med link til testresultater fra SSLLabs. La meg bare si med en gang at @AdeccoNorge har svart, så jeg går ut i fra at de tar dette seriøst.

Countermail - protecting your privacy?

Due to some media coverage lately, I got curious and had to take a look at the Swedish service Countermail. It seems to go far and beyond services like hushmail in order to protect your privacy, at least that's my impression from their service description. Not that I have a habit of trusting marketing talk of course, but they do have some pretty tough claims at their site.

Now I do like to look for logical errors, mistakes etc., but I am not a pentester anymore. I'll leave Backtrack and that sort of stuff to the younger generation. :-) So here are just a few simple comments on their service offerings, after playing around for an hour or so: