Date: Wed, 18 May 2016 08:05:25 -0400 From: Matt Weir <cweir@...edu> To: passwords@...ts.openwall.com Subject: Re: Complete Linkedin breach from 2012 up for sale While I have no doubt the original password list is out there with usernames, my gut feeling is that this isn't that list. Matt's Gut: 1) The LinkedIn breach was for all intents a breach of unique passwords, (yes there were some duplicates with the hash error). Based on past breaches I'd expect the full list to be slightly greater than twice as big. For example, there were around 14 million unique passwords in RockYou with a total size of 32 million. This means my guess is the full LinkedIn breach will be around 13 ~ 16 million passwords. This dump is 117 million. 2) The dump we saw in 2012 might not account for all the unique passwords the attacker stole. That being said, I suspect that the public dump represents a vast majority of the unique hashes stolen. This is based on personal experience, (most people I've talked to had their passwords in that breach), and how the list became public in the first place. Aka the hackers contracted with a 3rd party to crack the hashes who then posted them on InsidePro for other people to crack them. The plaintext passwords don't appear to be a set that was broken up with individual chunks given to multiple people to crack. Now I certainly could be wrong. I trust Troy Hunt and he verified some of the e-mail + password combos in the 1 million sample given to motherboard. My guess there though is that some subset of those e-mail + passwords were stolen some other way, (perhaps phishing). Long story short, the full list is absolutely out there. I expect this list is mostly fake or a combination of old dumps and the "hacker" is just trying to make a name for themselves and some money. If the full LinkedIn list is in fact what's being sold, it was likely combined with other lists to make it look bigger. Matt On Wed, May 18, 2016 at 5:11 AM, Per Thorsheim <per@...rsheim.net> wrote: > > http://motherboard.vice.com/read/another-day-another-hack-117-million-linkedin-emails-and-password > > Finally (?), the full extent of the 2012 breach appears online. 117 > million emails + unsalted sha-1 up for sale. > > Compared to the Rockyou list I would consider this dataset a lot more > useful for research purposes. Just the ability to do a non-case > substring search of names / emails in the passwords is very tempting, > and even in 2012 Linkedin had a stricter password policy than that of > the Rockyou leak. > > > -- > Best regards, > Per Thorsheim > CISA, CISM, CISSP, ISSAP > Founder of PasswordsCon.org > CEO of godpraksis.no > Phone: +47 90 99 92 59 > Twitter: @thorsheim > Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.