I believe the issue is to do with defence in depth, and the known proclivities of people to use the same passwords on different systems. (if this isn't the case, I'd be glad to hear!)

So, you break into one system and gain admin rights (bypassing the password system somehow, or using a password cracked from another system from a stolen password hash), then you crack the passwords, and can use them on *other computers*, as well as the one you originally broke into.

Once you've broken in and got admin rights, you don't need so much to crack passwords to do bad things, like read or alter sensitive data. However, if you have a password perhaps it's a more stealthy way to continue your nefarious activities? There's no rootkit left around to detect, though if you use someone's password and assume their identity - that leaves traces of system usage that can be picked up in audit logs.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11355/32722#32722