537Chapter 29SecurityAnd this function (Web hosting directory) will compare a password
537Chapter 29SecurityAnd this function will compare a password given by a visitor with a stored, encrypted password: function verify_pw($given, $stored) { $salt = substr($stored, 0, CRYPT_SALT_LENGTH); $given_encrypted = crypt($given, $salt); return ($stored == $given_encrypted); } See Chapter 44 for a complete example of a user management system that uses the basic prin- ciple of storing and comparing encrypted passwords. Running arbitrary programsIt s every system administrator s worst nightmare. The server s running more slowly thanusual. A look at the running programs on the server reveals that a program entitled crackisburning 98 percent of the processor s time. Most likely, this program has been placed here bya cracker who is using it to decrypt (crack) passwords. The administrator logs in to kill theoffending program but finds that his password is incorrect. His server has been root compro- mised, and there is no telling how much damage has been done. In a compromise such as this, an intruder gains interactive access to the server, usually via aUnix shell or MS-DOS command line. Clearly, this is the most difficult type of heist to pull off, but it also bears the greatest reward. Once insidea server, the cracker has virtually unlimitedpower to bring down the server, steal or modify information, or make use of the server s com- putational power for further wrongdoing. Worse yet, a truly skilled cracker can conceal his orher steps by editing log files and erasing any temporary files he or she has created. Social engineeringSocial engineeringis an often overlooked part of cracking. Sometimes it s easier for crackers toextract information (particularly passwords) from human beings than from computers: Cracker:Hi, John, this is Gary in the IT department. When was the last time you usedyour company account? John:Well, I entered a few new purchase orders about an hour ago. Cracker:Well, John, I m afraid your account has been compromised. Some of the infor- mation in it may have been lost. This could cost the company millions if we don t catchthe intruder quickly. We need to open your account and assess the damage immediately. Can you give me your password? John:Sure, it s . . . Worse yet, sometimes forgetful visitors note their passwords on scraps of paper in their desks! Adetermined cracker can easily find a job as a night janitor and look for such notes. Many famouscrackers were more notable for their social engineering and research skills than their ability towrite code to compromise systems.