[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 18 May 2016 08:05:25 -0400
From: Matt Weir <cweir@...edu>
To: passwords@...ts.openwall.com
Subject: Re: Complete Linkedin breach from 2012 up for sale
While I have no doubt the original password list is out there with
usernames, my gut feeling is that this isn't that list.
Matt's Gut:
1) The LinkedIn breach was for all intents a breach of unique passwords,
(yes there were some duplicates with the hash error). Based on past
breaches I'd expect the full list to be slightly greater than twice as big.
For example, there were around 14 million unique passwords in RockYou with
a total size of 32 million. This means my guess is the full LinkedIn breach
will be around 13 ~ 16 million passwords. This dump is 117 million.
2) The dump we saw in 2012 might not account for all the unique passwords
the attacker stole. That being said, I suspect that the public dump
represents a vast majority of the unique hashes stolen. This is based on
personal experience, (most people I've talked to had their passwords in
that breach), and how the list became public in the first place. Aka the
hackers contracted with a 3rd party to crack the hashes who then posted
them on InsidePro for other people to crack them. The plaintext passwords
don't appear to be a set that was broken up with individual chunks given to
multiple people to crack.
Now I certainly could be wrong. I trust Troy Hunt and he verified some of
the e-mail + password combos in the 1 million sample given to motherboard.
My guess there though is that some subset of those e-mail + passwords were
stolen some other way, (perhaps phishing).
Long story short, the full list is absolutely out there. I expect this list
is mostly fake or a combination of old dumps and the "hacker" is just
trying to make a name for themselves and some money. If the full LinkedIn
list is in fact what's being sold, it was likely combined with other lists
to make it look bigger.
Matt
On Wed, May 18, 2016 at 5:11 AM, Per Thorsheim <per@...rsheim.net> wrote:
>
> http://motherboard.vice.com/read/another-day-another-hack-117-million-linkedin-emails-and-password
>
> Finally (?), the full extent of the 2012 breach appears online. 117
> million emails + unsalted sha-1 up for sale.
>
> Compared to the Rockyou list I would consider this dataset a lot more
> useful for research purposes. Just the ability to do a non-case
> substring search of names / emails in the passwords is very tempting,
> and even in 2012 Linkedin had a stricter password policy than that of
> the Rockyou leak.
>
>
> --
> Best regards,
> Per Thorsheim
> CISA, CISM, CISSP, ISSAP
> Founder of PasswordsCon.org
> CEO of godpraksis.no
> Phone: +47 90 99 92 59
> Twitter: @thorsheim
>
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
