312-49 · Question #459
You are the network administrator for a small bank in Dallas, Texas. To ensure network security, you enact a security policy that requires all users to have 14 character passwords. After giving your…
The correct answer is A. Passwords of 14 characters or less are broken up into two 7-character hashes. This describes a well-known weakness in the legacy LM (LAN Manager) hash algorithm used by older Windows systems. LM hash splits a password into two independent 7-character chunks, zero-pads each if needed, and hashes them separately. This means a 14-character password is never…
Question
You are the network administrator for a small bank in Dallas, Texas. To ensure network security, you enact a security policy that requires all users to have 14 character passwords. After giving your users 2 weeks notice, you change the Group Policy to force 14 character passwords. A week later you dump the SAM database from the standalone server and run a password-cracking tool against it. Over 99% of the passwords are broken within an hour. Why were these passwords cracked so Quickly?
Options
- APasswords of 14 characters or less are broken up into two 7-character hashes
- BA password Group Policy change takes at least 3 weeks to completely replicate throughout a
- CNetworks using Active Directory never use SAM databases so the SAM database pulled was
- DThe passwords that were cracked are local accounts on the Domain Controller
How the community answered
(50 responses)- A76% (38)
- B4% (2)
- C8% (4)
- D12% (6)
Explanation
This describes a well-known weakness in the legacy LM (LAN Manager) hash algorithm used by older Windows systems. LM hash splits a password into two independent 7-character chunks, zero-pads each if needed, and hashes them separately. This means a 14-character password is never treated as a single 14-character secret - it is effectively two 7-character passwords. Attackers crack each half independently, making brute-force trivially fast. This is why Microsoft deprecated LM hashing in modern Windows, but it may still be present on older or misconfigured systems. The policy change does not help if the underlying hash algorithm has this flaw.
Topics
Community Discussion
No community discussion yet for this question.