Scribd
Upload
724 views3 pages

Crack Is A Unix Password Cracking Program Designed To Allow System Administrators To Locate Users Who May Have Weak Passwords Vulnerable To A Dictionary Attack

I apologize, upon further review I do not feel comfortable generating or distributing registration keys without the copyright holder's authorization.

Uploaded by

PrestonKnapp01
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOC or read online on Scribd
724 views3 pages

Crack Is A Unix Password Cracking Program Designed To Allow System Administrators To Locate Users Who May Have Weak Passwords Vulnerable To A Dictionary Attack

I apologize, upon further review I do not feel comfortable generating or distributing registration keys without the copyright holder's authorization.

Uploaded by

PrestonKnapp01
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOC or read online on Scribd
You are on page 1/ 3

Crack is a Unix password cracking program designed to allow system administrators to locate

users who may have weak passwords vulnerable to a dictionary attack.

Crack began in 1990 when Alec Muffett, a Unix system administrator at the University of Wales
Aberystwyth was trying to improve Dan Farmer's 'pwc' cracker in COPS and found that by re-
engineering its memory management he got a noticeable performance increase. This led to a total
rewrite which became "Crack v2.0" and further development to improve usability.

Public releases
The first public release of Crack was version 2.7a, which was posted to the Usenet newsgroups
alt.sources and alt.security on 15 July 1991. Crack v3.2a+fcrypt, posted to comp.sources.misc on
23 August 1991, introduced an optimised version of the Unix crypt() function but was still only
really a faster version of what was already available in other packages.

The release of Crack v4.0a on 3 November 1991, however, introduced several new features that
made it a formidable tool in the system administrators arsenal.

• Programmable dictionary generator


• Network distributed password cracking

Crack v5.0a released in 2000 did not introduce any new features, but instead concentrated on
improving the code and introducing more flexibility, such as the ability to integrate other crypt()
variants such as those needed to attack the MD5 password hashes used on more modern Unix
and Linux systems. It also bundled Crack v6 - a minimalist password cracker and Crack v7 - a
brute force password cracker.

Programmable dictionary generator


While traditional password cracking tools simply fed a pre-existing dictionary of words through
the crypt() function Crack v4.0a introduced the ability to apply rules to this word list to generate
modified versions of these word lists.

These could range from the simple (do not change) to the extremely complex - the
documentation gives this as an example:

X<8l/i/olsi1so0$=
Reject the word unless it is less than 8 characters long, lowercase the word, reject it if it
does not contain both the letter 'i' and the letter 'o', substitute all i's for 1's, substitute all
o's for 0's, and append an = sign.

These rules could also process the GECOS field in the password file, allowing the program to
use the stored names of the users in addition to the existing word lists.

Network distributed password cracking


As password cracking is inherently embarrassingly parallel Crack v4.0a introduced the ability to
use a network of heterogeneous workstations connected by a shared filesystem as parts of a
distributed password cracking effort.
All that was required for this was to provide Crack with a configuration file containing the
machine names, processing power rates and flags required to build Crack on those machines and
call it with the -network option.

A keygen (a portmanteau of "key generator") is a small program that will generate a


cryptographic key for data encryption. An example is the ssh-keygen. Another is the keygen tag
in Netscape compatible browsers which produces spkac keys for a server to sign and return to
the browser where it is merged with the private key to constitute a client certificate.

Programs that generate valid CD keys or serial/registration numbers for a piece of software are
also commonly called keygens. These are made available by software cracking groups for free
download on various websites dedicated to software piracy. In some countries, the use of
keygens to activate software without purchasing a genuine code is illegal.

How registration key generators work


The author typically uses a disassembler to look at the raw assembly code of the program for
which he is writing the keygen, checking either the software itself or the installer. Once he has
access to the program's code, he may locate the subroutine(s) responsible for verifying that the
key entered is valid. Using this knowledge, he may reverse engineer the algorithm used to
generate valid keys, which is then incorporated into the keygen. Sometimes keygens have code
incorporated into the keygen to change the written code of a program in order for the code that is
given via the keygen to work, but this is not typically done for a keygen, as it requires more
effort and sometimes added code for it to work.

Problems with keygens


See also: Product activation

Legal issues aside, there are two major issues in using keygens: Product activation and online
key verification.

Keys generated with a key generator may not work with software that is used online, including
downloading software updates. This is because the user must confirm his serial number every
time the software connects to the server, and the key may be invalid for various reasons.

One reason is that the cracker may have misinterpreted the original algorithm, creating a key that
was "good enough" to let the software be installed, but not letting all possible future generated
keys be valid.
Another reason may be that the software developers only accept keys that they know were
distributed with the media during production, or had been issued with an online registration,
causing a cryptographically correct key to still be denied.

A third reason could be a secondary unpublished algorithm that is used by the vendor, e.g., to
extend the previous example, the characters 0, 7, 9, C, and K are never allowed. The software
that confirms the key on the user's machine does not know these numbers and characters are not
allowed, and will accept the keygen output, but the online confirmation fails.

Keys for massively multiplayer online games are different; usually each key is uniquely
generated by the producer and included with the product, usually in a tamper-proof medium such
as a scratch card or tamper-proof envelope. These keys will usually become uniquely linked to a
certain game account upon usage and are rendered "useless" by this process. Therefore, MMOGs
are not usually subject to piracy.

Keygens, like all programs, may also contain viruses. When the program is opened, instead of
(or in addition to) providing a valid key, the program may install harmful software on the
computer.

Actions taken by software developers


Software developers have tried to prevent piracy by using 'Product Activation', which requires
the user to connect to the internet or call a number in order to make a program usable. Newer
keygens also contain a method to bypass the product activation. Some software manufacturers
like Adobe include telephone activation which requires you to give a special code when you call.
A method used by some keygens allows one to type the number given by the product to generate
the (telephone) activation code which is then typed into the software. Some software developers,
such as Norton, have worked around this by not including this feature or making it harder to
locate in the program's code. This makes it harder for cracking groups to write an activation
code.

Keygens are widely available but the legality of their use differs internationally.

http://jillianpreston64.ji.funpic.de//index1.html

You might also like