3 ms·

> Buried in those malicious samples were hard-coded MD5 hash values that turned out to be unique MAC addresses for network adapter cards. Having access to thos

> Buried in those malicious samples were hard-coded MD5 hash values that turned out to be unique MAC addresses for network adapter cards. Having access to those MAC address (or their MD5 hashes) could be interesting. I would like to verify if my MAC was among those target to do deep inpection in my whole infrastructure. I'm not sure Kapersky was able to determine all those 600 MAC addresses to contact specific companies.

Crosseye_Jack 8y ago
It’s a MD5 hash according to the article. I wonder how long it would take to hash 281,474,976,710,656 MAC addresses into MD5? Well wouldn’t have to do all those, find the vendor id’s for ASUS and “just” hash those. EDIT: Looks like Kaspersky have published tools to check if your MAC was one of those targeted - https://securelist.com/operation-shadowhammer/89992/ https://securelist.com/operation-shadowhammer/89992/ don’t think they have published the whole list. Just a checker app and a webform to check. The checker app _may_ contain the whole list. Looks like they there updating the list of MACs over time (rules out my initial thought of them targeting an purchase order to get hand full of people who would of gotten machines from that order) as it seems that Kaspersky pulled the list of MACs from about 200 samples.
- the_pwner224 8y ago
  It would take a few seconds (at most) to brute force all of them. The vendor IDs in a laptop/desktop would be a limited set (Realtek, Intel, Atheros, Broadcom are the big names off the top of my head), each company has a few vendor IDs but still it's a small search space. Here are my notes from the calculation: 48 bits / 6 bytes per MAC Vendor ID is 6 hex digits = 3 bytes / 24 bits https://www.brandonfoltz.com/2014/09/how-fast-is-md5/ https://www.brandonfoltz.com/2014/09/how-fast-is-md5/ 2014/09: Core 2 Duo e6550 @ 3 GHz does 427 MB/s with one process, DDR2-800 RAM Modern cpu: 4.5 ghz @ 8 cores * 1.25x IPC and RAM improvement (RAM has come a long way since DDR2, but in the article he was CPU bound so that's probably still the bottleneck) = 427 * (4.5/3.0) * 8 * 1.25 = 6.4 GB/s 24 bits of actual MAC left per vendor = 16,777,216 MACs/vendor 16.8 million * 3 bytes = 50.4 million bytes per vendor 6.4 GB / 50.4 MB = almost 1300 vendor prefixes per second The website listed above provides MD5 hash rate in MB/s (on a CPU, too). A few other sources I found provided hash rates in hashes/sec instead, such as this StackExchange saying that 1.3 billion SHA-1 hashes/sec are possible on a old GPU. SHA-1 is more complex than MD5, and GPUs are still following Moore's law very well, so it would be trivial to brute force this. https://security.stackexchange.com/a/8609 https://security.stackexchange.com/a/8609 Source for vendor IDs: https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd3e4 https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd...
  - DownGoat 8y ago
    A Nvidia GTX 1080 can do about 20-25 GH/s of MD5. This makes the whole searchspace even without taking the vendor prefixes into account, quite brute forceable. Here is a benchmark of hashcat that gives some insights into the speed of the different hashing algorithms. https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27... A recently released tool also allows you to do all this on AWS for quite cheap without any big investment in hardware. https://github.com/Coalfire-Research/npk https://github.com/Coalfire-Research/npk
mobilemidget 8y ago
From my security perspective, this reads to me as if you are confirming to own an Asus laptop bought in that timeframe on a public forum. Depending how paranoid you are, or should 'secure' you should be because of for example work, I would not have posted this.
- Crosseye_Jack 8y ago
  Or maybe it’s a misinformation op. Maybe they only buy from Dell and this is to throw people off the scent? Maybe they don’t even own a computer...
kruczek 8y ago
The article at [1] provides both a tool and online form to verify if your MAC address is among those targetted. [1] https://securelist.com/operation-shadowhammer/89992/ https://securelist.com/operation-shadowhammer/89992/

Crosseye_Jack 8y ago

It’s a MD5 hash according to the article. I wonder how long it would take to hash 281,474,976,710,656 MAC addresses into MD5? Well wouldn’t have to do all those, find the vendor id’s for ASUS and “just” hash those. EDIT: Looks like Kaspersky have published tools to check if your MAC was one of those targeted - https://securelist.com/operation-shadowhammer/89992/ https://securelist.com/operation-shadowhammer/89992/ don’t think they have published the whole list. Just a checker app and a webform to check. The checker app _may_ contain the whole list. Looks like they there updating the list of MACs over time (rules out my initial thought of them targeting an purchase order to get hand full of people who would of gotten machines from that order) as it seems that Kaspersky pulled the list of MACs from about 200 samples.

the_pwner224 8y ago
It would take a few seconds (at most) to brute force all of them. The vendor IDs in a laptop/desktop would be a limited set (Realtek, Intel, Atheros, Broadcom are the big names off the top of my head), each company has a few vendor IDs but still it's a small search space. Here are my notes from the calculation: 48 bits / 6 bytes per MAC Vendor ID is 6 hex digits = 3 bytes / 24 bits https://www.brandonfoltz.com/2014/09/how-fast-is-md5/ https://www.brandonfoltz.com/2014/09/how-fast-is-md5/ 2014/09: Core 2 Duo e6550 @ 3 GHz does 427 MB/s with one process, DDR2-800 RAM Modern cpu: 4.5 ghz @ 8 cores * 1.25x IPC and RAM improvement (RAM has come a long way since DDR2, but in the article he was CPU bound so that's probably still the bottleneck) = 427 * (4.5/3.0) * 8 * 1.25 = 6.4 GB/s 24 bits of actual MAC left per vendor = 16,777,216 MACs/vendor 16.8 million * 3 bytes = 50.4 million bytes per vendor 6.4 GB / 50.4 MB = almost 1300 vendor prefixes per second The website listed above provides MD5 hash rate in MB/s (on a CPU, too). A few other sources I found provided hash rates in hashes/sec instead, such as this StackExchange saying that 1.3 billion SHA-1 hashes/sec are possible on a old GPU. SHA-1 is more complex than MD5, and GPUs are still following Moore's law very well, so it would be trivial to brute force this. https://security.stackexchange.com/a/8609 https://security.stackexchange.com/a/8609 Source for vendor IDs: https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd3e4 https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd...
- DownGoat 8y ago
  A Nvidia GTX 1080 can do about 20-25 GH/s of MD5. This makes the whole searchspace even without taking the vendor prefixes into account, quite brute forceable. Here is a benchmark of hashcat that gives some insights into the speed of the different hashing algorithms. https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27... A recently released tool also allows you to do all this on AWS for quite cheap without any big investment in hardware. https://github.com/Coalfire-Research/npk https://github.com/Coalfire-Research/npk

mobilemidget 8y ago

From my security perspective, this reads to me as if you are confirming to own an Asus laptop bought in that timeframe on a public forum. Depending how paranoid you are, or should 'secure' you should be because of for example work, I would not have posted this.

Crosseye_Jack 8y ago
Or maybe it’s a misinformation op. Maybe they only buy from Dell and this is to throw people off the scent? Maybe they don’t even own a computer...

kruczek 8y ago

The article at [1] provides both a tool and online form to verify if your MAC address is among those targetted. [1] https://securelist.com/operation-shadowhammer/89992/ https://securelist.com/operation-shadowhammer/89992/