EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Lobsters·Jul 28·5 min read
The Cipher Behind QSYRUPWD: Reconstructing IBM i Password Hashes
✦ Why It Matters
Review your use of QSYRUPWD to ensure compliance with current security standards.
Key Takeaways
- Understand the implications of QPWDLVL settings on password hash formats.
- Use custom tools to analyze QSYRUPWD outputs for compatibility.
- Review and update password policies to align with security best practices.
- Consider the limitations of existing cracking tools with newer password formats.
Full Summary
QSYRUPWD is an IBM i API that retrieves encrypted user password data, crucial for administrative tasks without exposing plaintext passwords. During penetration testing, it was found that the output format of QSYRUPWD varies significantly with different QPWDLVL settings, particularly levels 2-4, which do not align with the expected formats used by cracking tools like John the Ripper.
A custom CL program was developed to analyze the API's behavior and output across these levels. Additionally, a call trace was generated to investigate the internal workings of QSYRUPWD, revealing that cryptographic operations are delegated to lower-level routines.
The analysis highlighted that while legacy password levels are compatible with existing tools, newer levels introduce complexities that hinder practical password strength testing.