Design Group Revamps Postal Manual

continued on page 4 Design group revamps postal manual Perhaps you’ve received it. If you have an Andrew account, there’s a one in three chance you did. ‘It’ is an e-mail with the subject, “Andrew account password insecure!” that claims your password has been cracked. The message goes on to say that in addition to the risks they pose to personal account security, slipshod passwords are a potential threat to the entire Andrew system. John Lerchey, computer and network security coordinator for Carnegie Mellon’s Computing Services, is the man responsible for these messages. He’s also the one who cracked your Andrew account. But relax — he did it with good intentions. Last fall, Lerchey reinitiated the practice of running a password cracking program against all of the nearly 30,000 Andrew accounts. Of those, approximately 10,000 were compromised. While he calls the number of cracked passwords “very significant,” Lerchey is quick to point out that the figures are preliminary. Lerchey intends to run the cracking program at the beginning of every semester, then again two weeks later. The first instance is meant to serve as a wake-up call to the vulnerability of a password. The second run will either be a reminder to those who have not changed their passwords or a notice that the second password choice was also cracked. Over time, he is interested in gauging the effectiveness of passwords and “whether or not raising people’s awareness ... has a definite positive impact on the number of accounts that get cracked.” The cracking program, which is freely available, uses a combination of “dictionary lookup” and “brute force cracking” techniques to guess passwords. Using the first technique, the program matches passwords with lists of dictionary words. “That doesn’t mean they come out of Webster’s,” Lerchey says. Rather, the lists originate from various online databases that Passwords in Andrew easy to crack