3 ms·

It’s a MD5 hash according to the article. I wonder how long it would take to hash 281,474,976,710,656 MAC addresses into MD5? Well wouldn’t have to do all those

It’s a MD5 hash according to the article. I wonder how long it would take to hash 281,474,976,710,656 MAC addresses into MD5? Well wouldn’t have to do all those, find the vendor id’s for ASUS and “just” hash those. EDIT: Looks like Kaspersky have published tools to check if your MAC was one of those targeted - https://securelist.com/operation-shadowhammer/89992/ https://securelist.com/operation-shadowhammer/89992/ don’t think they have published the whole list. Just a checker app and a webform to check. The checker app _may_ contain the whole list. Looks like they there updating the list of MACs over time (rules out my initial thought of them targeting an purchase order to get hand full of people who would of gotten machines from that order) as it seems that Kaspersky pulled the list of MACs from about 200 samples.

the_pwner224 8y ago
It would take a few seconds (at most) to brute force all of them. The vendor IDs in a laptop/desktop would be a limited set (Realtek, Intel, Atheros, Broadcom are the big names off the top of my head), each company has a few vendor IDs but still it's a small search space. Here are my notes from the calculation: 48 bits / 6 bytes per MAC Vendor ID is 6 hex digits = 3 bytes / 24 bits https://www.brandonfoltz.com/2014/09/how-fast-is-md5/ https://www.brandonfoltz.com/2014/09/how-fast-is-md5/ 2014/09: Core 2 Duo e6550 @ 3 GHz does 427 MB/s with one process, DDR2-800 RAM Modern cpu: 4.5 ghz @ 8 cores * 1.25x IPC and RAM improvement (RAM has come a long way since DDR2, but in the article he was CPU bound so that's probably still the bottleneck) = 427 * (4.5/3.0) * 8 * 1.25 = 6.4 GB/s 24 bits of actual MAC left per vendor = 16,777,216 MACs/vendor 16.8 million * 3 bytes = 50.4 million bytes per vendor 6.4 GB / 50.4 MB = almost 1300 vendor prefixes per second The website listed above provides MD5 hash rate in MB/s (on a CPU, too). A few other sources I found provided hash rates in hashes/sec instead, such as this StackExchange saying that 1.3 billion SHA-1 hashes/sec are possible on a old GPU. SHA-1 is more complex than MD5, and GPUs are still following Moore's law very well, so it would be trivial to brute force this. https://security.stackexchange.com/a/8609 https://security.stackexchange.com/a/8609 Source for vendor IDs: https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd3e4 https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd...
- DownGoat 8y ago
  A Nvidia GTX 1080 can do about 20-25 GH/s of MD5. This makes the whole searchspace even without taking the vendor prefixes into account, quite brute forceable. Here is a benchmark of hashcat that gives some insights into the speed of the different hashing algorithms. https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27... A recently released tool also allows you to do all this on AWS for quite cheap without any big investment in hardware. https://github.com/Coalfire-Research/npk https://github.com/Coalfire-Research/npk

the_pwner224 8y ago

It would take a few seconds (at most) to brute force all of them. The vendor IDs in a laptop/desktop would be a limited set (Realtek, Intel, Atheros, Broadcom are the big names off the top of my head), each company has a few vendor IDs but still it's a small search space. Here are my notes from the calculation: 48 bits / 6 bytes per MAC Vendor ID is 6 hex digits = 3 bytes / 24 bits https://www.brandonfoltz.com/2014/09/how-fast-is-md5/ https://www.brandonfoltz.com/2014/09/how-fast-is-md5/ 2014/09: Core 2 Duo e6550 @ 3 GHz does 427 MB/s with one process, DDR2-800 RAM Modern cpu: 4.5 ghz @ 8 cores * 1.25x IPC and RAM improvement (RAM has come a long way since DDR2, but in the article he was CPU bound so that's probably still the bottleneck) = 427 * (4.5/3.0) * 8 * 1.25 = 6.4 GB/s 24 bits of actual MAC left per vendor = 16,777,216 MACs/vendor 16.8 million * 3 bytes = 50.4 million bytes per vendor 6.4 GB / 50.4 MB = almost 1300 vendor prefixes per second The website listed above provides MD5 hash rate in MB/s (on a CPU, too). A few other sources I found provided hash rates in hashes/sec instead, such as this StackExchange saying that 1.3 billion SHA-1 hashes/sec are possible on a old GPU. SHA-1 is more complex than MD5, and GPUs are still following Moore's law very well, so it would be trivial to brute force this. https://security.stackexchange.com/a/8609 https://security.stackexchange.com/a/8609 Source for vendor IDs: https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd3e4 https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd...

DownGoat 8y ago
A Nvidia GTX 1080 can do about 20-25 GH/s of MD5. This makes the whole searchspace even without taking the vendor prefixes into account, quite brute forceable. Here is a benchmark of hashcat that gives some insights into the speed of the different hashing algorithms. https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27... A recently released tool also allows you to do all this on AWS for quite cheap without any big investment in hardware. https://github.com/Coalfire-Research/npk https://github.com/Coalfire-Research/npk