Ok, do you all remember how on Slashdot and Digg they had a link to a sourceforge project used to crack passwords? It can be found here.
My brother wouldn’t let me use his laptop over the weekend so I downloaded the ISO and made a boot CD to show how easy it would be to get his password. So, we booted his lappy up with the CD in there and sure enough, it cracked his password in a few minutes. So, we ran it on my other brother’s lappy from work.
His work uses domains and the cracker didn’t actually find his username, so it couldn’t crack his password. It did find the local admin though (which is an account closely guarded by his work’s IT department). Now my brother happened to know that password. When it had finished running, it had only managed to determine half of the password. I was curious about this so I did some experimenting.
I’ve determined that if I put a special character at the beginning and end of the password, that Ophcrack cannot determine a single letter of the password. That is, if I put a [!@#$%^&*()_] as the leading and ending characters. I believe that if your password is too long, windows stores it in two hashes. So, if you have a long password, you need to put some of those characters in the middle. If not, Ophcrack will be able to determine at least a few characters of your password.
What I found interesting about the domain issue is that you can log into a laptop with a domain username and password even when not connected to the domain. In fact, when my brother first used the laptop, he was not even connected to the domain and could log in with his username and password. This suggests that windows stores domain usernames and passwords on the local machine.
If that is the case, one just needs to figure out where to point Ophcrack and it just might be able to harvest domain usernames and passwords. If so, then shame on Windows. That would be a huge security flaw!