OT Again - Excel Password Recovery

just mailed you off group

Si

I take it excel passwords aren't very secure?

AJH

when I worked as the CISO at a large bank, if we could crack an excel password in under 5 minutes then it had to be reported to Head Office in Tokyo.

basically, any microsoft password is pretty poor, and the tools are fairly easy to come by to audit them

I love my job!

Si Security Practice Solutions Architect

How about winzip?

AJH

There are many tools that will break WinZip passwords, too.

There are tools that will break/crack pretty much any password!

I remember one long fun(?!) night sitting up in my office until

5am watching a piece of software slowly crack a Win2k Server Admin password after I'd pulled the hard drive and extracted the appropriate file for it to 'look' at. IIRC the software wasn't exactly cheap tho.

Matt

blimey - the windows server password ones are some of the "freeist" to come by. The mechanisms are so well documented, you can gethold of a boot CD that does everything for you, using a linux boot.

My counterparts in Tokyo were shocked to find out that one, proper data encryption then started to come on stream - wonder why ;-)

Si

This was many years ago now. I gave up on the IT lark ages ago after getting bored of sitting in the server room until 5am trying to sort problems out!

Matt

Winzip now has proper encryption, so if you choose a decent password then it can be practically impossible to crack the password. Just using alphanumeric passwords of 8 chars or so is not good enough, but a 20-30 character password consisting of a phrase with a few outlandish characters thrown in instead of spaces for example can make password cracking take far too long to be worth it, and we're talking several tens of years on a fast computer.

In my password auditing work, I can usually crack about 30% of a Windows domain's passwords in the first half hour, and the next third in about four hours, on a middling computer. If the NT lanman hashes are turned off then this time increases dramatically as the lanman hash contains a copy of the main password shifted to upper case, which reduces the cracking effort enormously. Winzip passwords are more time consuming to crack and if the password is decent, it's not worth the bother.

Interesting. It was only after I posted I realised the winzip option is no good. The advantage of password protecting formulae in excel is that you can leave a copy of the worksheet with a customer without them being able to see how your workings were done.

AJH

I wasn't aware that there had been a change (obviously!) - that's good news.

You do have to make sure that it's selected, I think that it's the default now, and if you select the earlier crap encryption it moans at you and discourages you. I don't use winzip much though so don't know which versions all this happened in.

Matthew Maddock uttered summat worrerz funny about:

I sit next to a 'kin massive server room trying to sort out Humans via the "long arm"... I know where I'd rather be sat. Damn these machines for becoming too reliable (That should sort me a network crash for the morning ;-) )

Lee