4 ms·

The passwords look like this: pbkdf2_sha256$12000$zhMKabMgayvK$iniviUCcX9y2PYJcm0AoB3MhybRA1z2Cec1DZnLWxWc= I do not know how much time it would take to b

The passwords look like this: pbkdf2_sha256$12000$zhMKabMgayvK$iniviUCcX9y2PYJcm0AoB3MhybRA1z2Cec1DZnLWxWc= I do not know how much time it would take to bruteforce these. Can any experienced HNers weigh in?

seefoma 12y ago
This is actually about as good as it gets for password hashes, so kudos to eBay. Since these are salted and require 12000 iterations, cracking individual passwords will be quite time consuming. The preferred method in this case, though, is to go after low hanging fruit. The way one would do this is to try something like the 500 most common passwords against all entries in the table. This won't take very long (compared to trying to brute force a bunch of individual passwords), and will probably yield a ton of passwords.
thefreeman 12y ago
I am not an expert by any means, but I believe pbkdf2 is a recommended key stretching function for a hashing method (which looks to be sha256). http://en.wikipedia.org/wiki/PBKDF2 http://en.wikipedia.org/wiki/PBKDF2 I think cracking difficulty depends on how many "iterations" they use though.
- tmorgan 12y ago
  I assume 12000 iterations by the looks of that $ delimited string, I assume they're storing the parameters as, hash_func$iterations$salt$derived_key
- bfish510 12y ago
  The iterations are listed as 12000. This value is supposed to double every two years and is around 128k I believe currently.
  - peterwwillis 12y ago
    This is probably to try to offset Moore's law, by keeping the hash cracking difficulty in line with technology progrss. But it's funny how this works. If you think about Moore's law, it's basically describing the number of transistors on an IC, those doubling every two years. But it doesn't address expansion in the ways we use our technology. If new machines come out which allow us to stack even more GPUs into a single machine, performance capacity per cracking host will rise even farther than double per year. One person estimated an 8-GPU cracking machine two years ago at about 539 billion hashes per minute. At 128k hashes for one password, you could make about 70,182 attempts per second. But here[1] is a five-machine cluster from a year and a half ago with 25 GPUs. Its speed? 63 billion per second against SHA1. This results in 492,187 attempts per second. Assuming SHA256 is about 50% slower, this would be around 246,093 per second. Some password dictionaries contain millions of words. But if your password is '0Password', it'll probably be cracked in a couple of seconds on modern hardware. [1] http://arstechnica.com/security/2012/12/25-gpu-cluster-cracks-every-standard-windows-password-in-6-hours/ http://arstechnica.com/security/2012/12/25-gpu-cluster-crack...
phpnode 12y ago
it's going to be computationally difficult but not impossible to break an individual password, but breaking all of them is unlikely in our (solar system's) lifetime. However, if you were targeting a specific user and they didn't use a particularly strong password, it's possible that you could brute force it.
surreal 12y ago
Looks to me like the $ signs are acting as delimiters, and that that hash is made up of: cipher/hash: pbkdf2_sha256 cost factor: 12000 salt: zhMKabMgayvK hash: iniviUCcX9y2PYJcm0AoB3MhybRA1z2Cec1DZnLWxWc= This exact technique (pretty much) is described here: http://exyr.org/2011/hashing-passwords/ http://exyr.org/2011/hashing-passwords/. It's a decent, secure way to hash passwords. Cost factor of 12000 seems solid to me (depends on the hardware they're running on but I'd say brute forcing your way through that would be pretty impossible)
- ctz 12y ago
  Let's do the math: A PBKDF2 cost factor/iteration count of 12000 and 32-byte output means each candidate passphrase costs 12002 SHA256 blocks. I can buy a crappy bitcoin miner which will do 2GH/s for about USD19. Let's say we're going to use the Gawker leak as our dictionary. That's ~200,000 candidate passwords. For a given user, I can therefore find their password (if it exists in the Gawker set) in 12002 * 200000 = 2.4GH SHA256 applications. That will take 1.2 seconds. So for all 125 million eBay users, that's about 4 years. This work is trivially parallelisable, so buying more or faster hardware is brutally effective. Note: there is obviously, and hopefully, a non-negligible probability that a user's password isn't in that set. Brute force of (say) the whole 8 printable-ASCII character password space would take longer but would be guaranteed to find to find about 50% (from Adobe leak) of user's passwords.
  - nwh 12y ago
    Bitcoin miners can not be re-purposed. They take a header input and output only nonces, not hash results.
    - gnoway 12y ago
      I think the point is that if there's a bitcoin miner doing 2GH/sec for $19, the operation is cheap.
      - nwh 12y ago
unfunco 12y ago
<algorithm>$<cost>$<salt>/<encrypted_password> It's more than I expected from eBay, I think because of the likes of LinkedIn and their user credential leak, I expected bad habits from larger companies. Rainbow tables can't be used against the passwords, so each one will need to be computed individually to either find the result or a collision. That's likely why the seller is only asking for $1000.

seefoma 12y ago

This is actually about as good as it gets for password hashes, so kudos to eBay. Since these are salted and require 12000 iterations, cracking individual passwords will be quite time consuming. The preferred method in this case, though, is to go after low hanging fruit. The way one would do this is to try something like the 500 most common passwords against all entries in the table. This won't take very long (compared to trying to brute force a bunch of individual passwords), and will probably yield a ton of passwords.

thefreeman 12y ago

I am not an expert by any means, but I believe pbkdf2 is a recommended key stretching function for a hashing method (which looks to be sha256). http://en.wikipedia.org/wiki/PBKDF2 http://en.wikipedia.org/wiki/PBKDF2 I think cracking difficulty depends on how many "iterations" they use though.

tmorgan 12y ago
I assume 12000 iterations by the looks of that $ delimited string, I assume they're storing the parameters as, hash_func$iterations$salt$derived_key
bfish510 12y ago
The iterations are listed as 12000. This value is supposed to double every two years and is around 128k I believe currently.
- peterwwillis 12y ago
  This is probably to try to offset Moore's law, by keeping the hash cracking difficulty in line with technology progrss. But it's funny how this works. If you think about Moore's law, it's basically describing the number of transistors on an IC, those doubling every two years. But it doesn't address expansion in the ways we use our technology. If new machines come out which allow us to stack even more GPUs into a single machine, performance capacity per cracking host will rise even farther than double per year. One person estimated an 8-GPU cracking machine two years ago at about 539 billion hashes per minute. At 128k hashes for one password, you could make about 70,182 attempts per second. But here[1] is a five-machine cluster from a year and a half ago with 25 GPUs. Its speed? 63 billion per second against SHA1. This results in 492,187 attempts per second. Assuming SHA256 is about 50% slower, this would be around 246,093 per second. Some password dictionaries contain millions of words. But if your password is '0Password', it'll probably be cracked in a couple of seconds on modern hardware. [1] http://arstechnica.com/security/2012/12/25-gpu-cluster-cracks-every-standard-windows-password-in-6-hours/ http://arstechnica.com/security/2012/12/25-gpu-cluster-crack...

phpnode 12y ago

it's going to be computationally difficult but not impossible to break an individual password, but breaking all of them is unlikely in our (solar system's) lifetime. However, if you were targeting a specific user and they didn't use a particularly strong password, it's possible that you could brute force it.

surreal 12y ago

Looks to me like the $ signs are acting as delimiters, and that that hash is made up of: cipher/hash: pbkdf2_sha256 cost factor: 12000 salt: zhMKabMgayvK hash: iniviUCcX9y2PYJcm0AoB3MhybRA1z2Cec1DZnLWxWc= This exact technique (pretty much) is described here: http://exyr.org/2011/hashing-passwords/ http://exyr.org/2011/hashing-passwords/. It's a decent, secure way to hash passwords. Cost factor of 12000 seems solid to me (depends on the hardware they're running on but I'd say brute forcing your way through that would be pretty impossible)

ctz 12y ago
Let's do the math: A PBKDF2 cost factor/iteration count of 12000 and 32-byte output means each candidate passphrase costs 12002 SHA256 blocks. I can buy a crappy bitcoin miner which will do 2GH/s for about USD19. Let's say we're going to use the Gawker leak as our dictionary. That's ~200,000 candidate passwords. For a given user, I can therefore find their password (if it exists in the Gawker set) in 12002 * 200000 = 2.4GH SHA256 applications. That will take 1.2 seconds. So for all 125 million eBay users, that's about 4 years. This work is trivially parallelisable, so buying more or faster hardware is brutally effective. Note: there is obviously, and hopefully, a non-negligible probability that a user's password isn't in that set. Brute force of (say) the whole 8 printable-ASCII character password space would take longer but would be guaranteed to find to find about 50% (from Adobe leak) of user's passwords.
- nwh 12y ago
  Bitcoin miners can not be re-purposed. They take a header input and output only nonces, not hash results.
  - gnoway 12y ago
    I think the point is that if there's a bitcoin miner doing 2GH/sec for $19, the operation is cheap.
    - nwh 12y ago

unfunco 12y ago

<algorithm>$<cost>$<salt>/<encrypted_password> It's more than I expected from eBay, I think because of the likes of LinkedIn and their user credential leak, I expected bad habits from larger companies. Rainbow tables can't be used against the passwords, so each one will need to be computed individually to either find the result or a collision. That's likely why the seller is only asking for $1000.