makepasswd generating passwords on linux

I was writing a script the other day and had to generate a password and found the nifty tool call makepasswd.

makepasswd is a command that generate true random passwords using /dev/random.

To install you do
sudo apt-get install makepasswd

To generate a password you do

makepasswd

and if you want a 16 character password you do

makepasswd --chars 16

Wifipwdump.sh

A small post to tell you about a little script I wrote to troubleshoot an issue I had with a wireless network the other day. Nobody was able to tell me what the WiFi password was thus I had to dump it from a system that was connected.

Since I will most likely not remember how I did it a next time I wrote a little script for it you can find at https://github.com/Xiobe/scripts/blob/master/wifipwdump.sh

Tomtom password reset issue.

I reported on the 6th of June 2013 an issue at Tomtom's website. It was something that I discovered by accident because I was helping out a family member who had forgotten his password. I waited until now to publicly disclose it because I wanted to give Tomtom the opportunity to fix it.

The Tomtom application that was installed on my family member's computer allowed my family member to trigger a password reset (by entering the e-mail address coupled to the account). My family member opened his mailbox and had a new e-mail from Tomtom with the password reset.

I got distracted in the process by the cat (cats are masters in social engineering) and asked to reset it a second time. In the inbox of my family member were thus 2 e-mails coming from the reset service. My family isn't into computers and thus when I asked to click the the link, they clicked on the first mail they saw, which was the eldest one. The reset worked and my family was happy, not realizing that this e-mail wasn't suppose to trigger the reset since there was a newer request for the reset.

The link in the e-mail looks like this:
http://www.tomtom.com/myTomTom/password_reminder_confirm.php?frm_email=familymember@mail.com&frm_check=f4357e2fa574a1764edcf077eaaf95dd

As you can see the format of the link is quite basic, an e-mail address and a hash.

On my way home I was going over the situation and asked my family member if I could get a copy of the e-mails to make sure if I didn't misinterpret something. I wondered if I could make a password reset now that the password was already reset.

I just clicked the link (no proxies in between) and did a reset of the password by using the form. Thus basically anybody who had that link could reset the password. What exact information you can find and how valuable the information is something I considered out of scope.

Since I work for CERT.be, I am familiar with the responsible disclosure guide of NCSC. The first problem I had was finding out who I had to contact at Tomtom. No information on their website, but I was lucky, the whois contact worked.

In CC of my e-mail to Tomtom I had put the NCSC (The CERT of The Netherlands) and CERT.be. The reason why is simply to have a cover-my-ass strategy. Tomtom is a company in The Netherlands and well I am a Belgian citizen that is why I chose to put both national CERT teams in copy. I do not want to get in trouble for discovering a problem, I just want it to get it fixed.

I got a reply from Tomtom on the 14th of June 2013. First of all they thanked me, they would look into the problem and promised me to keep me informed. The sad truth is that this last promise wasn't kept. I don't know if the reason why I never got a reply is that I was truthful about the fact I would write this blog entry about it.

Welcome to big hotel

I recently had to visit the office of a customer just outside of Brussels. I knew approximatly where it was. Since I didn't get any GPS signal, I had to ask for directions and I stopped at a hotel near by my destination just to ask for final directions.

The hotel where I stopped is part of a big international chain. I walked up to the front desk where a lovely young lady called Marielle (Dutch accent, the ring on her left hand on the ring finger indicated that she is most probably married) according to her name tag greeted me. I explained my problem. She didn't knew where my customer was located so I social engineered her by simply asking if she had Internet access on her computer and if she had access to a website like Google maps. While she was typing I noticed that on every screen in the left corner there was a post-it with the magic words user: username, password: password.

Suddenly my mind started working in a different way and just for fun I asked if I could come behind the desk to have a look at the Google map and by looking at the screen I noticed that it was an Internet Explorer.

So lets have a look at what we got:
- a name for name dropping
- a target who is susceptible to social engineering
- a browser, which has a good track record of being vulnerable
- a user name and password for something which will be most probably the application for managing the rooms

To say it with the words of Louis Armstrong ... What a wonderful world.

Even a 10 year old would guess it

Recently I was somewhere in a data center in Belgium where the local administrator password was written down on a post-it and was next to the screen of the console. I don't say I would approve but I could understand if you put it there and the password was complex. This was absolutely not the case, it was the company name.

Some people wonder how those evil hackers can get into their systems even if they have the latest antivirus updates and a firewall ... there is no patch for HumanOS.

password or pa$$w0rd?

This week I had 2 cases where I had the "what!? You 're kidding me, right?" feeling. Both were password related.

I had to give some remote support on a CRM system and the password for the administrator account was pa$$w0rd. I guess the people administrating this systems don't have a clue about what it would mean to loose this asset.

Since I am a MSSQL DBA people automatically assume that I have no clue about linux systems. The other day I got agitated in a meeting because somebody said that linux was not important. I apparently reacted in a way which got the attention of some people because suddenly I got a request to look at a postfix server. When I connected over SSH to the server I had to use an account called administrator and I'll let you get the password ... yep, it was password. I needed root to access some files but my contact was not absolutely sure about the password so I tried my luck and yes, it was password.

Security is not something simple, but some basics like a good password policy and auditing for weak passwords are simple. There are no excuses for these mistakes.