Mindwebs.

nicapicella's weblog


Sunday, 07th March 2010; 15:15


Hacking: Social engineering >= cracking

Recently I received a zip-file. As I went on to extract the file therein contained, I found out that the archive was password-protected. I checked my source — nothing hinted at any password protection. Hmpf. What now?

I am pretty that zip-file passwords are not the most secure protection around, so I searched for a "password recovery" program. I found, to no surprise, heaps. I downloaded the first that was free, but before even balking at the time it would need to brute-force a possibly decent password, the program gave up: It didn't recognize the file format. (Even though my system says it's a plain vanilla zip-file…)

A bit flustered, I remembered that the file I was handling should have been quite wide-spread on the internet — so I googled it. In fact, within the ten top hits for "<filename>.zip password" already the google summary revealed what appeared to be a promising password. First try, success!

And I know that the title I chose for this post is quite the mouthful; still, my first reaction as a computer scientist to a "forgotten" password was something along the lines of "I can recover it". But my approach was evidently completely wrong — even if the password cracking program would have worked, it probably would have taken a lot of time. If it would have found the passwort at all. Had the program worked. Lots of ifs. Though the "social engineering" of a simple (much more simple, I might add, than searching, downloading, intsalling, and using a dedicated program) google search revealed the solution. In a handful of seconds.

permalinktop



Valid XHTML 1.0! Valid CSS! Creative Commons License
Last modified: 02:00 29/Mar/10 |•| What does all this mean?