[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 6 Jun 2012 20:10:33 -0400 (EDT)
From: "Brad Tilley" <brad@...ystems.com>
To: john-users@...ts.openwall.com
Subject: Re: JtR to process the LinkedIn hash dump
> On Wed, Jun 06, 2012 at 06:10:49PM -0500, jfoug wrote:
>> You will note that 'most' of them that you crack will have 00000 as the
>> first bytes of the hash (if you are using the rock-u words, and nothing
>> more
>> than 'rules' from JtR). This shows that whomever released this, that
>> they
>> are using 00000 as a 'already cracked' signature.
>
> Not necessarily. Another possibility (and I am not the first one to
> suggest it) is that whoever released these hashes did not figure out how
> to crack the ones with 00000's, so he/she left them in this released
> uncracked hashes dump.
The 00000 hashes are very easy to crack. Since patching, I've cracked more
than 2 million of them with word machine and John alone. I have no way of
knowing for sure, but the 'already cracked' theory seems more plausible to
me.
> This would explain why the hashes with 00000's
> correspond to weaker passwords (on average) than those without. The
> reason for this public release might have been to crowdsource cracking
> of the relatively more difficult hashes, which happened to be both those
> with 00000's (not attacked for real at all) and those for somewhat more
> complicated passwords (than average in the original/full database, which
> we haven't seen so far).
The normal sha1 hashes in the release (the ones not overwritten with five
zeros at the front) are easily cracked too, but don't seem to contain
nearly as many simple, common passwords such as 'password1' or 'secret20',
etc. They are still very crackable though. They don't seem to have tried
to brute force anything. Six char lower letters and numbers is very
productive as well.
Brad
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
