"How do the RainbowCrack tables help someone who is sitting at a login prompt on either a Unix box or a PC with a Windows OS on it?"

The answer is, not at all. That is not what this attack does; this attack is for determining the actual password after an (unsalted) password hash has been obtained by some other means.

"There must be tools in existance that will lock an account after, say, 10 incorrect login attempts"

Yes there are, and have been for a long time. But that is not relevant to this, two ways:

a) this isn't an attack on Windows or Unix logins, it's more for badly implemented web sites; and

b) it's an off-line attack, so you there's no need to make repeated guesses at the target site -- once you've looked up the hash in the rainbow table, you know the password and can simply login.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11355/32718#32718