• slazer2au@lemmy.worldEnglish
    210·
    19 days ago

    Use EICAR test strings as passwords so when the password is stored as plain text the antivirus software will delete the file.

      • slazer2au@lemmy.worldEnglish
        58·
        19 days ago

        Doesn’t have to be a binary file, toss the string in a txt file and the AV still throws a fit.

      • NatakuNox@lemmy.world
        6·
        19 days ago

        01001000 01100101 01101100 01101100 01101111 00101100 00100000 01110100 01101000 01101001 01110011 00100000 01101001 01110011 00100000 01101110 01101111 01110100 00100000 01100001 00100000 01110011 01110100 01110010 01101001 01101110 01100111 00100000 01101111 01100110 00100000 01100010 01101001 01101110 01100001 01110010 01111001 00100000 01110100 01101000 01100001 01110100 00100000 01110100 01101111 01110100 01100001 01101100 01101100 01111001 00100000 01110111 01101111 01101110 00100111 01110100 00100000 01101001 01101110 01100110 01100101 01100011 01110100 00100000 01111001 01101111 01110101 01110010 00100000 01110000 01101000 01101111 01101110 01100101 00100000 01101111 01110010 00100000 01100011 01101111 01101101 01110000 01110101 01110100 01100101 01110010 00100000 01110111 01101001 01110100 01101000 00100000 01100110 01110101 01110010 01110010 01111001 00100000 01110000 01101111 01110010 01101110 00101110 00100000 01010100 01101000 01100001 01110100 00100000 01101001 01110011 00100000 01100001 01101100 01101100 00101110 00101110 00101110 00100000 01000100 01101111 01101110 00100111 01110100 00100000 01100011 01101000 01100101 01100011 01101011 00100000 01101001 01101110 01110100 01100101 01110010 01101110 01100001 01101100 00100000 01110011 01110100 01101111 01110010 01100001 01100111 01100101 00101110 00100000 01010100 01101000 01100001 01101110 01101011 00100000 01111001 01101111 01110101 00100000 01111000 01101111 01111000 01101111

    • henfredemars@infosec.pubEnglish
      24·
      19 days ago

      Unfortunately there is significant overlap between plain-text-password-servers and servers that can’t be bothered to use antivirus. Also, the string may not work if it’s not at the start of the file. AV often doesn’t process the whole file for efficiency purposes.

    • Orygin@sh.itjust.works
      19·
      19 days ago

      Sadly it wouldn’t work if found in a CSV file with other records:

      According to EICAR’s specification the antivirus detects the test file only if it starts with the 68-byte test string and is not more than 128 bytes long. As a result, antiviruses are not expected to raise an alarm on some other document containing the test string

  • JeeBaiChow@lemmy.world
    67·
    19 days ago

    Interesting… I wrote a gag comment about using an SQL injection as my password and crashed the Lemmy API. Using connect if that makes any difference.

  • sylver_dragon@lemmy.worldEnglish
    471·
    19 days ago

    Sadly, no. CSV files can deal with embedded commas via quoting or escaping. Given that most of the dumps are going to be put together and consumed via common libraries (e.g.python’s csv module), that’s all going to happen automagically.

    • nymnympseudonym@piefed.socialEnglish
      20·
      19 days ago

      Can be != will be

      You’re looping over 50M records, extracting into your csv. Did you bother using the appropriate library, or did your little perl script just do split(/,/,$line)

      • ilinamorato@lemmy.world
        14·
        19 days ago

        Everything you can use for a password can be escaped out of a csv. Partially because csvs have to be interoperable with databases for a bunch of different reasons, and databases are where your passwords are stored (though ideally not in plaintext). There’s no way that I can think of to poison your password for a data breach that wouldn’t also poison the password database for the service you’re trying to log into.

        • bassomitron@lemmy.worldEnglish
          4·
          19 days ago

          Gotcha, that’s what I was thinking as well. I haven’t done any software development in a long time (I have a degree in it, but professional career sent me down another path in tech), so my memory on input sanitization is very rusty. Thanks for the response!

    • Manifish_Destiny@lemmy.world
      8·
      18 days ago

      A perspective from someone who red teams for a living:

      If I encounter a password like that, I’m probably going to pay special attention to your account among the millions. Commas dont stop most people from being weak to password permutations either.

      • Tangent5280@lemmy.world
        7·
        18 days ago

        If you’re manually checking the 12 million username password pairs in the leaked database you aren’t really going to breach many accounts before people update their passwords, are you?

        • Manifish_Destiny@lemmy.world
          2·
          13 days ago

          I’m referring to when it breaks my tooling and I’m forced to dig into the problem.

          That being said, thats not really a problem for modern tools like credmaster.

    • madjo@feddit.nl
      2·
      17 days ago

      intermix the , and the ; as well, in case the CSV uses a different separator.

    • sunshine@lemmy.ml
      1·
      18 days ago

      I think Python csv would save that as "Pass\",\"words\",\"Are\",\"fun\",\"\\n" and then it would be read by Excel / LibreOffice / Python csv as expected.

    • BodilessGaze@sh.itjust.works
      22·
      19 days ago

      CSV existed for over 30 years before RFC 4180. Excel, and countless other tools, have their own incompatible variants. Excel in particular is infamous for mangling separators when exporting to CSV.

      • madjo@feddit.nl
        2·
        17 days ago

        Excel mangles everthing…
        I work with a lot of EANs and every CSV import into Excel means I have to pay extra attention to the EAN field, because Excel likes to think for me, and thinks that the scientific notation would be very helpful for me… It’s not! 8.72E+12 is useless to me, Excel!!!
        And don’t get me started on FEB-01.

        I just fuckin’ hate Excel.

    • nandeEbisu@lemmy.world
      5·
      19 days ago

      You would be surprised how many people are simply splitting the string on commas instead of using an actual ascii parser. Especially for one off scripts, like churning through a csv full of passwords.

    • python@lemmy.world
      4·
      18 days ago

      Hm, now you’re making me wonder how feasible it would be to use Emojis in my passwords…

      • SlurpingPus@lemmy.world
        3·
        18 days ago

        Should work alright if the server handles Unicode correctly, and isn’t one of those ass sites that put restrictions on the password’s length and composition. Hashing functions don’t even care if you’re feeding them raw binary.

        • python@lemmy.world
          1·
          17 days ago

          I… I hope my passwords are hashed and salted long before they reach the server, so the way it handles unicode shouldn’t affect it all that much. The logistical issue I was seeing with emojis was more that some of them look the same but have different Unicodes alltogether, so typing in the same emoji across devices might be tricky if their keyboards default to different codes.

          • madjo@feddit.nl
            1·
            17 days ago

            Oooh hashed and SALTED! I kept peppering the passwords that get sent to my server. Now all I need is to clean up the mess and the mold that all those hash browns leave behind.

          • SlurpingPus@lemmy.world
            1·
            17 days ago

            Passwords are typically sent to the server and hashed there. I’m a bit hazy right now on the implications of client-side hashing, but it would likely present some security problems.

            Edit: at the least, it would allow an attacker to use a leaked password database to log in to the sites, sidestepping the whole hashing thing.

            There are protocols that send a hashed or encrypted password instead of plaintext, but they’re more complex than just hashing. Iirc they involve a challenge-and-response method.

  • samus12345@sh.itjust.worksEnglish
    9·
    19 days ago

    Why did the creator add an incorrect apostrophe in “commas,” but not “passwords?” At least be consistent!

  • kryptonianCodeMonkey@lemmy.world
    9·
    19 days ago

    Correct me if I’m wrong, but doesn’t text with commas in it get put in double quotes in acsv file to avoid this exact thing?

    Like if I had cells (1A: this contains no comma), (2B: this, contains a comma), and (3C: end of line), the csv file would store (this contains no comma,“this, contains a comma”,end of line)