[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 2 Sep 2015 23:40:18 -0500
From: JimF <jfoug@....net>
To: john-users@...ts.openwall.com
Subject: Re: Anyone looked at the Ashley Madison data yet?
Thank you for the link. There are several on this list which have been
working this
data in a more gray matter manner, and will be pushing the 1 million
cracked hashes
in the very near future. My goal is to get to 10% (3.6 million), then
15%, then 20%.
I am pretty sure 10% is achievable by a single person with a couple
decent desktop
computers (no GPU needed). 15% 'may' be achievable, but 20% is likely a
hard target
to obtain, simply due to the slowness of the hashes overall, without
teaming up to
throw more serious hardware at the task.
The words you list are pretty much what I have seen. By far 123456
123456789
then 12345 and password. The top 3 or 4 will crack about 3% of the user
accounts.
I have about a hundred thousand of just 123456 and 123456789
By far the best method of attack on a wordlist that is this extensive is
to use a sniper
method, that targets each specific hash using only information known
about that
hash (such as the user id, email, zip code, phone number, etc). That
type of pinpoint
accurate attack will crack a very surprising number. Then a 2nd method
still is very
targeted, is to search using ONLY the absolute best words possible
against all hashes,
just a minimal amount of words at a time. The minimal amount is the
minimum that
the software can test at one time using the current CPU (or GPU).
Hopefully that number
can be small (such as 3). 3 words tested against the entire set of
hashes is about
500 hours (at 60/s) or about 20 days.
Shotgun searching, just letting a cracker blindly go on is really going
to spend a lot of
time heating up your room ;) without a lot of ROI I started running
the top 150 words
from the rocku dump (ordered by number of occurrences on rock-u), taking
out some
of the rock-u words. It quickly became apparent that after the first
few words, the
returns drop off very quickly. One thing I did see is that names on
rock-u were much
more likely to be used, but on AM there are names used, but much less
frequently.
Also, the word 'password' was pretty popular for very early user
accounts on AM,
but in the more recent user accounts it is becoming less and less likely
to be seen.
On 9/2/2015 9:09 PM, Christian Heinrich wrote:
> On Wed, Aug 26, 2015 at 3:49 PM, Solar Designer <solar@...nwall.com> wrote:
>> Actually, for a likely top 100 list from a 100k sub-list, you don't need
>> a community effort. This can be done by one person using one machine in
>> a few days. Just take a few hundred top passwords from existing such
>> lists, add four lines:
>>
>> ashley
>> madison
>> Ashley
>> Madison
> Below is the wordlist of the 20 most popular passwords after 1 week of
> effort with the Ashley Madison dump quoted from
> http://www.pxdojo.net/2015/08/what-i-learned-from-cracking-4000.html
>
> 123456
> password
> 12345
> qwerty
> 12345678
> ashley
> baseball
> abc123
> 696969
> 111111
> football
> fuckyou
> madison
> asshole
> superman
> fuckme
> hockey
> 123456789
> hunter
> harley
>
>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
