• tal@lemmy.today
        link
        fedilink
        arrow-up
        17
        ·
        edit-2
        1 year ago

        It’s hunter2

        For the uninitiated, this was a purported IRC conversation on bash.org (which apparently is down now, sadly):

        https://web.archive.org/web/20040604194346/http://bash.org/?244321

          Cthon98: hey, if you type in your pw, it will show as stars
          Cthon98: ********* see!
          AzureDiamond: hunter2
          AzureDiamond: doesnt look like stars to me
          Cthon98: *******
          Cthon98: thats what I see
          AzureDiamond: oh, really?
          Cthon98: Absolutely
          AzureDiamond: you can go hunter2 my hunter2-ing hunter2
          AzureDiamond: haha, does that look funny to you?
          Cthon98: lol, yes. See, when YOU type hunter2, it shows to us as *******
          AzureDiamond: thats neat, I didnt know IRC did that
          Cthon98: yep, no matter how many times you type hunter2, it will show to us as *******
          AzureDiamond: awesome!
          AzureDiamond: wait, how do you know my pw?
          Cthon98: er, I just copy pasted YOUR ******'s and it appears to YOU as hunter2 cause its your pw
          AzureDiamond: oh, ok.
        

        I’ll add that I’m a little suspicious that the event is apocryphal. Cliff Stoll’s The Cuckoo’s Egg described a (true) story of a West German hacker, Markus Hess, working for the KGB during the Cold War to try to break into US industrial systems (e.g. chip design, OS source code) and military systems (various military bases and defense projects). Hess had broken into a system at the University of California at Berkeley, where Stoll was studying astrophysics and working as a sysadmin. Stoll discovered the breakin, and decided to leave the hacker alone, to use the system as a honeypot, and try to figure out what systems the hacker was attacking so that he could warn them, so he had a pretty extensive writeup on what was going on. Stoll had been providing updates to the FBI, CIA, NSA, Army and Air Force computer security personnel, and a few others.

        Stoll was trying to figure out who the hacker was, as the hacker was only touching his system via other systems that he’d broken into, like a US defense contractor; he didn’t know that the hacker was German.

        Hess used “hunter” or a variant, like “jaeger”, German for “hunter”, as a password on many of the systems that he broke into; this was one of several elements that led Stoll to guess that he might be German; that sounds very suspiciously similar to the password in the above conversation.

        I’d add that the whole story is a pretty interesting read. Eventually, Stoll – who was having trouble getting interest from various US security agencies, which were not really geared up to deal with network espionage at the time, made up a fake computer system at UC Berkeley that claimed it contained information related to Strategic Defense Initiative, part of a major US ballistic missile defense project, and indicated that a physical letter had to be sent to get access. Hess noticed it, handed the information off to his KGB handlers, and a bit later, a Bulgarian spy in Pittsburgh tried sending said letter to get access to the system. When Stoll handed that tidbit off, that got a lot of attention, because the FBI was definitely geared up for catching spies in the US trying to compromise US military systems, and exposing domestic spy rings was right up their alley. The FBI finally put a bunch of people on it, Stoll got to give a presentation at the CIA, etc.

    • EpicFailGuy@lemmy.world
      link
      fedilink
      English
      arrow-up
      7
      arrow-down
      3
      ·
      1 year ago

      More than to protect a real password, this is done (in my experience) to prevent a bunch of unoriginal drones make that THEIR password, because they think is funny, which only means the string gets added to a “passwords to attempt” text list on some hacking website …

      Decreasing security all together

      Case in point: Hunter2, correcthorsebatterystaple, solarwinds123 and Pa$$w0rd1

      • Furbag@lemmy.world
        link
        fedilink
        arrow-up
        7
        arrow-down
        2
        ·
        1 year ago

        I mean, the philosophy behind correcthorsebatterystaple is good. I used that method for master passwords to password managers and it really does work well to help you remember a long complex password that can’t be guessed easily.

        But some people might have been missing the point of that xkcd using correcthorsebatterystaple itself.

        • jasory@programming.dev
          link
          fedilink
          arrow-up
          7
          ·
          1 year ago

          It’s okay. The thing is when running an attack are you going to permutate through every combination of characters, or are you going to use words from a dictionary first? correcthorsebatterystaple (not a dictionary word) is better than antidisestablishmentarianism (a dictionary word) but in a realistic attack concatenating dictionary words is going to be the next step.

          • Terrasque@infosec.pub
            link
            fedilink
            arrow-up
            2
            ·
            edit-2
            1 year ago

            Because of the number of potential words in the dictionary, it’s still fairly secure. I would recommend 5 or 6 words though