This attack is not effective against /etc/shadow, not simply because /etc/shadow is hidden from the attacker (which, as others have pointed out, is a first line of defense only), but because it's passwords are salted -- heavily salted, in the case of reasonably modern versions.

Rather the attack is for something like, say, a badly implemented web site login system, where a SQL injection attack allows an attacker to get a list of all the password hashes, which the site developer has simply MD5 or SHA1 hashed without any salting or stretching.

But yes, regardless of the exact attack vector, you need some way to obtain the hashes first.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11355/32717#32717