Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 2 Sep 2015 23:40:18 -0500
From: JimF <>
Subject: Re: Anyone looked at the Ashley Madison data yet?

Thank you for the link. There are several on this list which have been 
working this
data in a more gray matter manner, and will be pushing the 1 million 
cracked hashes
in the very near future.  My goal is to get to 10% (3.6 million), then 
15%, then 20%.
I am pretty sure 10% is achievable by a single person with a couple 
decent desktop
computers (no GPU needed).  15% 'may' be achievable, but 20% is likely a 
hard target
to obtain, simply due to the slowness of the hashes overall, without 
teaming up to
throw more serious hardware at the task.

The words you list are pretty much what I have seen. By far 123456 
then 12345 and password.  The top 3 or 4 will crack about 3% of the user 
I have about a hundred thousand of just 123456 and 123456789

By far the best method of attack on a wordlist that is this extensive is 
to use a sniper
method, that targets each specific hash using only information known 
about that
hash (such as the user id, email, zip code, phone number, etc). That 
type of pinpoint
accurate attack will crack a very surprising number.  Then a 2nd method 
still is very
targeted, is to search using ONLY the absolute best words possible 
against all hashes,
just a minimal amount of words at a time.  The minimal amount is the 
minimum that
the software can test at one time using the current CPU (or GPU). 
Hopefully that number
can be small (such as 3).  3 words tested against the entire set of 
hashes is about
500 hours (at 60/s) or about 20 days.

Shotgun searching, just letting a cracker blindly go on is really going 
to spend a lot of
time heating up your room ;)  without a lot of ROI    I started running 
the top 150 words
from the rocku dump (ordered by number of occurrences on rock-u), taking 
out some
of the rock-u words.  It quickly became apparent that after the first 
few words, the
returns drop off very quickly.  One thing I did see is that names on 
rock-u were much
more likely to be used, but on AM there are names used, but much less 
Also, the word 'password' was pretty popular for very early user 
accounts on AM,
but in the more recent user accounts it is becoming less and less likely 
to be seen.

On 9/2/2015 9:09 PM, Christian Heinrich wrote:
> On Wed, Aug 26, 2015 at 3:49 PM, Solar Designer <> wrote:
>> Actually, for a likely top 100 list from a 100k sub-list, you don't need
>> a community effort.  This can be done by one person using one machine in
>> a few days.  Just take a few hundred top passwords from existing such
>> lists, add four lines:
>> ashley
>> madison
>> Ashley
>> Madison
> Below is the wordlist of the 20 most popular passwords after 1 week of
> effort with the Ashley Madison dump quoted from
> 123456
> password
> 12345
> qwerty
> 12345678
> ashley
> baseball
> abc123
> 696969
> 111111
> football
> fuckyou
> madison
> asshole
> superman
> fuckme
> hockey
> 123456789
> hunter
> harley

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.