8 ms·
MtGox salted passwords cracked
- meric 15y agoHmm it isn't complete; My password isn't on there yet. =\
- thaumaturgy 15y agoWell, considering that 292 of the passwords contain mixed case, 79 of them are 12 characters or more (this one's nice: "qwe123QWE!@#"), 59 of them contain non-alphanumeric characters, and 6713 of the 8655 passwords posted are unique ... it's probably only a matter of time. Nice. I think it's time to upgrade all my passwords.
- doublec 15y ago"qwe123QWE!@#" is only nice until you look at the keyboard. First three qwerty letters. First three keys just above them. Then the same shifted.
- thaumaturgy 15y agoYeah, I caught that but it's still decent at meeting the usual password requirements, and it's almost as arbitrary as any other keyboard pattern.
- silencio 15y agoI was surprised at how few randomly generated passwords there were in that list, if any. Like you mention, there's a lot of variants on qwerty/12345/!@#$%: 1qaz2wsx, Zaq1Xsw2, 1qazxsw23e, 1q2w3e, !@#$1234, etc. "ZXasqw12!@" was about as random as it got from a quick scroll-through, and even that is basically just keys directly next to each other. I assume randomness doesn't mean as much as sheer password length does when it comes to crackability, but I wonder if there's anything to be learned from this. Maybe only that random password generators tend to default to a safer (longer) length? :)
- DarkShikari 15y agoRandom passwords are probably not going to be cracked by a run-through of John with a ruleset, which is likely similar to -- or exactly -- what was used to create this list. These are salted FreeBSD MD5s (iterated hash); even with a powerful GPU, you're probably only going to be able to check a few hundred thousand per second at best.
- brs 15y agoFor what it's worth, my password was 8 random alphanumerics, and it's not in the list, while /.,mnbvcxz (12 alphanumerics with symbols) is there. The cracker must have some sort of algorithm that looks for consecutive patterns on the keyboard. It goes to show that the old rules - non-dictionary word, mixed case, etc - really don't cut it anymore. Psychologically, picking a password that has high entropy is quite difficult, and the crackers are only going to develop better algorithms in the future. I think using a good random generator is the only way to ensure you have a decent password these days.
- devinlane 15y agoI dunno, they managed to crack "G7io5639*%V64ioT5h9" -- 19 characters including lowercase, uppercase, numbers, and symbols. It doesn't seem to follow any pattern on a QWERTY layout -- maybe another layout? I wasn't aware they could crack passwords that long though -- wasn't that supposed to take years, even with a GPU?
- shawndumas 15y agoNor mine.
- Jach 15y agoNor mine. Of course mine was only 8 characters, character set of size 72, so only a "mere" 722,204,136,308,736 possible permutations. In any case the couple places that one was reused have been updated already, I'm still waiting for it to show up eventually.
- kayoone 15y agonor mine, and it wasnt particularly secure either
- rakkhi 15y agoYeah mine niether. I have confidence it won't end up there either. The way the difficulty and time hockeysticks up once you hit the low hanging fruit is amazing(<8 char, non complex, simple patterns and common passwords, dictionary words and number / symbol variants). http://www.rakkhis.com/2011/06/i-was-hacked-mtgox-bitcoin-3-reasons-i.html http://www.rakkhis.com/2011/06/i-was-hacked-mtgox-bitcoin-3-...
- flexd 15y agoWhat you mean is that the ridiculously easy passwords have been cracked? Not really a surprise considering they have been out for so long. While I'm glad I do not have a account there they would not have been able to crack my password :-) Edit: I am a fool, salted hashes are probably not in anyones rainbow tables :)
- cipherpunk 15y agoRainbow tables do not exist for randomised salts.
- flexd 15y agoErr, now I feel (more) stupid. Anyway my point being those passwords are not exactly the strongest.
- meric 15y agoBut if the salt is global and its value is "1", it might.
- rmccue 15y agoThe $1$ part of the hash is purely to indicate that MD5 was the encryption algorithm used. The salt used is the first 12 characters, so from "$1$" to the next "$" For example, for "$1$JVf3ep..$uvo634QwxDsAuHMOZlKws1:riprip" the salt is "$1$JVf3ep..$" (although those periods may just be padding, IIRC).
- meric 15y agoAhh. I misunderstood. Thanks.
- getsat 15y ago> Not really a surprise considering they have been out for so long. Not really a surprise considering they were hashed using one of the fastest/weakest common hashing algorithms.
- jake_morrison 15y agoSo the entire user community is people with lots of hardware resources waiting to brute force passwords. What could possibly go wrong? :-)
- OoThah7o 15y agoHere are the plain text passwords combined with their respective mail addresses: http://pastebin.com/RhheV8Gj http://pastebin.com/RhheV8Gj
- romland 15y agoI guess you can argue that no more harm can be done to the poor users of Mt. Gox but I disagree. Why would you post this? If someone really wanted to pair them up, they could have but that at least would have taken -some- determination. Obviously you knew you were pushing it since you even went out of your way to create a new handle. For the "lulz"? Troll.
- leon_ 15y agosome determination? it's one invocation of john to pair them up. releasing the cracked passwords at first was stupid and doesn't show any skill. it only shows that you have a strong cpu.
- sunchild 15y agoThe horse is out of the barn. All of these users need to change their passwords everywhere – yesterday.
- thadeus_venture 15y agoWhat kind of impact would having used something like sha-512 with a 128 bit salt have had over md5? How many more cycles do those take to generate? I assume the attacker had to brute force the salt from a known password as well, if that's sufficiently random that should provide some security as well shouldn't it?
- getsat 15y agoI'm pretty sure this article[1] is posted daily on HN. General purpose hashing functions are all fast (which, for a password storage system, is synonymous with bad). [1] http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/
- tzs 15y agoA lot of them are just 6 characters. Even a random 6 character password can be brute forced in a few minutes. Many of the short ones were just single dictionary words, so wouldn't even get past the initial check for stupid passwords--they would fall in seconds. Most of the longer ones seem to be simply combinations of a couple dictionary words, or a word and a number, or similar fairly low entropy combinations that would come early in a brute forcer's search. Most of the ones that aren't like that are based on simple patterns on the keyboard, which would also be in a brute forcer's list of things to check early.
- dekz 15y agoHot damn some people have horrible passwords: 123456 -> 199 results. password -> 118 results. Who would use such weak passwords for an account with potential monetary value?
- DougBTX 15y agoWell, since they are bitcoin users: probably techies.
- BCM43 15y agoOn occasion when signing up for an account that I'm just testing out, I don't feel like creating a random password for it, so I just use a simple one. If it turns out I want to use the service, I will change it to a more complex one. This could be what happened here.
- pbreit 15y agoPeople who just registered to take a look around and had no intention of actually trading?
- pavel_lishin 15y agoIt's okay, Bitcoins don't have any potential monetary value! If I were to sign up for MtGox, I don't know if I'd use anything above my standard "don't care" password, at least until I decided to get serious about it. Typing "shifty3rd" is easier than generating a LastPass password - and I only use it for accounts when I don't care if they're compromised.
- riffraff 15y agothe salt seems to be the same for all of the password. Not exactly useful this way, is it?
- gvb 15y agoThe purpose of salting is to prevent the use of "rainbow tables" (precomputed hashes). With salted passwords, the attacker has to compute the password hash for every password he tries (takes time), he cannot use pre-computed hash tables and just compare the password hash to the precomputed hashes (a simple string compare). Using one salt defeats rainbow tables. Using multiple salts does not defeat it any better. Using multiple salts would seem to help defeat brute forcing or dictionary attacks, but that is only true if the salts are secret... the problem is that they are not secret because the at this point the attacker access to everything, including the salts. http://en.wikipedia.org/wiki/Salt_%28cryptography%29 http://en.wikipedia.org/wiki/Salt_%28cryptography%29
- beaumartinez 15y agoNormally you use a different salt for each password—having the same salt for all passwords makes a rainbow table for that salt actually useful in cracking your hashes.
- sorbits 15y agoI accidentally up-voted parent, so felt I had to reply since this part is somewhat wrong: > Using multiple salts would seem to help defeat brute forcing or dictionary attacks, but that is only true if the salts are secret If I have a dictionary of common passwords, I need to hash this with the salt used by MtGox and then I can test the hashes against all the passwords from MtGox. Had they used a different salt for each password, my work would be n times as expensive (n being the number of passwords to test against).
- gvb 15y agoUsing multiple salts makes it more expensive, but it doesn't defeat an attack unless it makes the attack impossibly expensive. My contention is is that multiple salts by themselves will not make the attack impossibly expensive. Better encryption, e.g. bcrypt http://en.wikipedia.org/wiki/Bcrypt http://en.wikipedia.org/wiki/Bcrypt attempts to make it impossibly expensive to crack passwords. Part of their technique is to use per-password salts to increase the time for all passwords, but the key is to have an encryption algorithm that takes an "impossibly" long time per password as well. Key is that it is "an adaptive hash: over time it can be made slower and slower so it remains resistant to specific brute-force search attacks against the hash and the salt." Rainbow tables are O(1). Salts are O(n). Bcrypt is O(big), where "big" can be increased to keep it bigger than a "practical" attack will be willing to attempt.
- andrewcooke 15y agoi suspect some people here don't really know in any detail how password cracking works. you start with a dictionary. a good dictionary combines multiple passwords, slang, common patterns of keys on the keyboard, and old, known, passwords (so all the entries here will be added, for example). but that's just the start. the cracking programs also have rules. in simple terms these can be "shift to upper case" or "combine two words from dictionary" or "reverse word" or "replace "e" with "3". and there are common sets of rules that people develop (and test) that do standard transformations like automatically making passwords "leet", or extending with common sequences (123), etc. and you can automate this. so something like hashcat will generate random rules and apply them to the dictionary. because the rules are written so that they can be composed this is surprisingly powerful and probably explains some of the "harder" cracks on this list. the only way to beat this, then, is to use random passwords (for example, as generated by keepass) and to make them large enough that just running through every combination doesn't work. on size: what is important is the number of available combinations. systematic cracking - trying every possible combination - still uses common characters first so "size" is a combination of character variety and number of characters. again, something like keepass makes this easy. finally, note that on some old or poorly maintained systems, you may be restricted (perhaps without knowing) to 8 characters. then using a wide range of characters is critical. i know this is obvious to many, but some of the comments about "hard" passwords made me think it might be useful...
- loy22 15y agoCorrect me if I'm wrong: you mean that in the real world, salted passwords have only one advantage over plain text passwords, which is to buy you some time ? (albeit it's a strong advantage)
- deleted 15y ago[deleted]
- deleted 15y ago[deleted]
- 15y ago
- chmike 15y agoWhat about public-private key authentication ? Isn't this demonstration enough ?
- mukyu 15y agoA few people seem to be commenting that the salt used for all of the passwords is the same. This is not the case. These are crypt(3) strings and the $1$ at the beginning signifies the hash scheme used, not the salt--$scheme$salt$hash. The 1 means that FreeBSD-MD5 is the algorithm used, which is basically MD5 with the salt iterated 1000 times.
- snorkel 15y agoYour comment that this is MD5 x 1000 is very informative and got me searching for the FreeBSD MD5 crypt function, and I found this gem from /usr/src/lib/libcrypt/crypt-md5.c: /* * and now, just to make sure things don't run too fast * On a 60 Mhz Pentium this takes 34 msec, so you would * need 30 seconds to build a 1000 entry dictionary... */ for(i = 0; i < 1000; i++) { MD5Init(&ctx1); if(i & 1) MD5Update(&ctx1, (const u_char *)pw, strlen(pw)); ... ... which seems to still be the default implementation in FreeBSD. I'd guess it's time to increase the iterations to 200000.
- arundelo 15y agoEase of increasing how long it takes to compute the hash is the main idea behind bcrypt: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/
- benatkin 15y agoYeah, it's pretty easy to change this in Devise, a popular auth library for rails that uses bcrypt by default, and to have a custom value to speed up unit tests: https://github.com/plataformatec/devise/wiki/Speed-up-your-unit-tests https://github.com/plataformatec/devise/wiki/Speed-up-your-u... config.stretches = Rails.env.test? ? 1 : 10
- moondistance 15y agoAnyone have a bitcoin exchange recommendation?
- seanp2k 15y agoTradehill is the new MtGox. They even copied the site design pretty much exactly.
- cel 15y agoMy password isn't on that list, but it's on a different list. I found it by googling my email address. :/
- pavel_lishin 15y agoI wonder how many people google their password to check if it's been cracked.
- seanp2k 15y agoYeah dude, mine was on the bigger list. It's a 10chr semi-random password (all lower case tho). I pick passwords based on easy things to type and the memorize the pattern / commit it to muscle memory. I also try to use obscure but pronounceable patterns somewhere in the pass.
- devinlane 15y agoThanks for the heads up on this, I found mine as well. For reference, here's a much longer list of cracked passwords: https://www.nanaimogold.com/microlionsec.txt https://www.nanaimogold.com/microlionsec.txt
- dlikhten 15y agoI take it straight up dic attack, i see no gen password with 32 chars in it. Guess this teaches you a lesson, 32 character generated password (or max pass size) as a requirement for 99% of sites. Now if only windows had a standard password storage API which programs can access using special rules and special admin programs can manage this way just like the web browser we can have password stores for windows + sync to cloud.
- pavel_lishin 15y agoDoes Windows not have something equivalent to OS X's keychain?
- rprasad 15y agoWindows does have a password keychain (and has since XP), but AFAIK the only programs that use it are Microsoft programs. Internet Explorer uses the Windows keychain to store saved passwords.
- seanp2k 15y agoKeePassX + Dropbox bro. It's only an alt-tab and a right-click -> log in to site on whatever you want to get into, once you enter your master password and/or present your password file.
- pbreit 15y agoCould someone help this newbie understand why proper salting doesn't make this hard enough? And how does the cracker know they have the right password? Wouldn't they need to check it against the authentication mechanism or figure out the algorithm?
- birken 15y agoIf the crypto method being used is strong enough, then there is no need to obscure the authentication algorithm or the salted value. That just provides a little bit of security through obscurity, it doesn't actually harden the passwords anymore. Thus, modern password hashing libraries just put the algorithm and salt information in the password string itself, so that the string of data you store in the database contains 3 pieces of data: The algorithm used to hash the password, the salt, and the password hash. The benefit of this is convenience: Different platforms/languages can all create/authenticate various password hash types with ease as long as everybody sticks to this format. And because of this, if you choose a weak crypto method to hash your passwords (which is what MtGox did), then an attacker conveniently has the 3 things they need to attempt to crack the password: The algorithm, the salt and the hashed value all in the same place. However, if a strong crypto is used (IE a computationally intensive and slow hash), then the fact that the algorithm, salt and hashed value are in the same place doesn't really weaken the passwords. With an expensive enough hash, even if the attacker has all the information about how to crack the password right in front of them, actually performing the necessary computation would be so expensive that a brute force attack is effectively protected against. You can see more details about the format of the password strings and where the 3 parts of data are stored here: http://php.net/manual/en/function.crypt.php http://php.net/manual/en/function.crypt.php (the PHP page had the best explanation of my quick search, though this isn't just PHP specific)
- forensic 15y agoneither of my accounts are in the list, because i used long random passwords this list is just the low hanging fruit
- SeoxyS 15y agoThis is a brute force / dictionary attack. Only "bad" passwords have been cracked. My password isn't on the list—it's a randomly generated 17-char string of alphanumeric and mixed case character. Btw, you should all check out 1Password. Automates the process, syncs with all my devices and dropbox, and integrates with all the major browsers.
- AndyKelley 15y agoIt looks windows-only. Not going to work for me.
- alanh 15y agoUm it most certainly isn't Win-only. 1Password has fantastic Mac and iOS apps.
- bradleyland 15y agohttp://agilebits.com/products/1Password http://agilebits.com/products/1Password Mac is the first platform listed.
- seanp2k 15y agoLooks great but no Linux support. Since I use Ubuntu on my work (and home) laptop and netbook, this is largely useless for me. KeePassX + Dropbox is a great way to go, but it's kind of more "DIY"-ish. Still not hard to set up, keeps all my passwords in sync, and KeePassX has some great features like "auto-type" which basically is a one-click website login. I now use the max-length passwords on all the sites I use, and they're all crazy random ones. I don't memorize any of them because it's so easy to reset a password if I lost my KeePassX access (unlikely since it's on Dropbox + 4 computers + CrashPlan backups).
- doogle88 15y agoMy MtGox password was only 8 reasonably random characters and is also not on the list. I always use unique passwords so I don't care that much if it gets broken.
- pandrew 15y agoCouldnt find mine.. thats a comfort. =) Unfortunately most web based system ive encountered has 20char as most for key. My new passphrase model is based on 128 char key using two values piped through sha512. It works... but friendface probably wont accept it :)