Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

MacRumors Forums: Security Leak

IA64 said:
I don't understand all this paranoia on this forum. I have already explained it in other thread.... All passwords are Hashed.

Reversing MD5 hash is not really possible, as
1 - there caan be more than one string giving the same MD5
2 - it was designed to be hard to "reverse"

The goal of the MD5 and its family of hashing functions is
- to get short "extracts" from long string
- to make it hard to guess where they come from
- to make it hard to find collisions, that is other words having the same hash (which is a very similar exigence as the second one)

Think that you can get the MD5 of any string, even very long... And the MD5 is only 16 bytes long (32 if you write it in hexa to store or distribute it more easily). If you could reverse them, you'd have a magical compacting scheme.

This being said, as there aren't so many short strings (passwords...) used in the world, you can test them from a dictionary (that's called "brute force attack") or even google for your MD5. If the word is common and wasn't salted, you have a reasonable chance to succeed with rainbow tables.

Even if the hacker dumps the whole database, and, unless your password is hellokitty and it's md5 can be found on google, you're safe. Salting or not is not the question.

Passwords like M4cRumor$ ( with capital,alpha-numeric and symbols ) can never be cracked unless you have enough time; by that I mean > 80,000 years
Click to expand...

MD5 is a very weak algorithm for hashing these days and shouldn't be used at all (read: http://en.wikipedia.org/wiki/MD5#Security). Same with SHA1 hasing; both are susceptible to "collision" attacks and can be reversed within a reasonable amount of time using a high-end AMD GPU (or a few).
 
IA64 said:
Passwords like M4cRumor$ ( with capital,alpha-numeric and symbols ) can never be cracked unless you have enough time; by that I mean > 80,000 years
Click to expand...

Don't spread this nonsense. It's better to randomly *introduce* special characters instead of replacing alphabet characters with special characters or numbers. Dictionary attacks *rely* on the fact that someone just did a basic character replacement.

MacRumors% would be far more difficult to crack than MacRumor$.
 
Well it looks like arn has confirmed to Ars that the lol dude at minimum knows some stuff about the hack.

"The pledge was made in this post by a user who supplied confidential password details that weren't publicly available. Among other things, that information included partial cryptographic hash corresponding to the password of MacRumors Editorial Director Arnold Kim, as well as the cryptographic salt used to increase the time required to crack it. Kim told Ars that those and other confidential details included in the post were "legit." The user went on to defend the hack as a benign undertaking designed to sharpen the skills of both the hacker and the MacRumors administrators.

"We're not logging in to your gmails, apple accounts, or even your yahoo accounts (unless we target you specifically for some unrelated reason)," the user known simply as Lol wrote. "We're not terrorists. Stop worrying, and stop blaming it on Macrumors when it was your own fault for reusing passwords in the first place."

He continued: "Consider the 'malicious' attack friendly. The situation could have been catastrophically worse if some fame-driven idiot was the culprit and the database were to be leaked to the public."

-----------------
http://arstechnica.com/security/201...-860000-passwords-speaks-were-not-terrorists/

----------------

If something isn't done about this there will be lawsuits. By not doing something with this user MR is harboring a known illegal hack.
 
Summary comparison of three password managers


These password managers make it easy to use long, randomly generated passwords that are unique to every site. They store your passwords in a locally encrypted vault and the only password you need to remember is one strong master password. They all support mobile devices, work offline, and have some form of syncing. When generating random passwords, they let you specify the password length and allowed character types so that you can meet the password requirements of a given web site. The developers of these programs DO NOT have access to your data.

LastPass is the most cross-platform. It has extensions for Chrome, Firefox, Safari, Opera, and IE, and mobile apps for iOS, Android, Windows Phone, and even BlackBerry. You can also access it via the web, which still performs the encryption and decryption locally in your browser so that the LastPass company does not have access. It supports various forms of multi-factor authentication, such as Google Authenticator, YubiKey, and the Grid, and also supports one-time passwords. Also syncs secure notes and autofills forms. Downsides: Your locally encrypted password vault is required to sync via LastPass servers, and none of their service has been independently audited for security. Though the JavaScript source code of the web site and some of the browser add-ons is publicly viewable, there are also binary browser plugins which are closed-source. Mobile apps require a $12/yr subscription to LastPass Premium.

1Password has a nice user interface and optionally syncs via Dropbox, iCloud, or WiFi. Downsides: The Mac, Windows, and iOS apps cost money (relatively pricey). The Android app is free, but it's only a viewer and can't add or edit entries. No Linux app, no support for mobile OSes beyond iOS and Android, and no multi-factor authentication. 100% proprietary and closed source. I'm not aware of any independent security audit having happened for 1Password.

KeePass is free and open source, so outside developers have full access to the source code, allowing anyone to confirm for themselves that KeePass follows good security practices and that nothing fishy is going on behind the scenes. Optionally syncs via Dropbox or FTP. There are various third party programs and browser add-ons to support a variety of platforms and browsers. Can be run as a portable app from a flash drive. Supports a variety of plugins to add functionality. Downsides: Not sure. Would someone who has used this app comment on its downsides? There doesn't seem to be multi-factor authentication or web access.

---

Disclosure: I have only used LastPass, so my knowledge of the other two is limited. If you have corrections or additions you'd like to make, please comment.

Note: I originally posted this in a Reddit discussion of this breach.
 
If anybody else encountered strange activity with their accounts (before they changed their passwords), please post it here. I'm trying to figure out if lol actually logged into anything.
 
elistan said:
From what I've read, a password like M4cRumor$ would actually be very EASY to crack. At its base is two dictionary words, mac and rumors, and then the only transform on it is leet speak and common capitalization, which apparently are common rules to check for when cracking.

Ars: Anatomy of a hack: How crackers ransack passwords like “qeadzcwrsfxv1331”

So not only does one need a password that uses uppers, lowers, numbers and symbols, but it also needs to be a long password (say, 13 characters or more) without contain any dictionary words, nor any dictionary words changed with common substitutions...

My thought these days is that a proper password is a long (16-character? 12?) random string, unique to only that one account, handled properly (ie, not written down, not passed out, etc.) used only on sites that don't utilize MD5 (SHA256 is good enough?) Unfortunately it can still get compromised if it's just an MD5 hash, due to weaknesses that have been found over the years, but it wouldn't fall to some of the quicker methods of cracking, plus some sites don't allow long passwords, or don't allow all possible characters.

At the moment, seems like password cracking techniques (both via sheer computation power, plus more sophisticated guessing mechanisms) are improving faster than users and sites making use of passwords. :)
Click to expand...

coolfactor said:
Don't spread this nonsense. It's better to randomly *introduce* special characters instead of replacing alphabet characters with special characters or numbers. Dictionary attacks *rely* on the fact that someone just did a basic character replacement.

MacRumors% would be far more difficult to crack than MacRumor$.
Click to expand...

You missed the point. The word macrumors was an example. Using a password with alpha-numeric, symbols and capital letter will make it much harder to crack it. Heck, my password was only small letters "mloukhiyeh". Think you can find it using rainbow tables ? heh...
 
Peace said:
You're not missing anything. A real hacker could use the info and try to get into bank accounts etc. But they would need more than an email and birthdate.

As far as I know MR doesn't ask for or store social security numbers.

This whole thing is being blown out of proportion.

But lol just hung himself if he is the culprit.
Click to expand...

pretty sure lol is using someone elses username and password... he does have ALL OF THEM.
 
IA64 said:
You missed the point. The word macrumors was an example. Using a password with alpha-numeric, symbols and capital letter will make it much harder to crack it. Heck, my password was only small letters "mloukhiyeh". Think you can find it using rainbow tables ? heh...
Click to expand...

You should really read that Ars Technica article.
 
IA64 said:
You missed the point. The word macrumors was an example. Using a password with alpha-numeric, symbols and capital letter will make it much harder to crack it. Heck, my password was only small letters "mloukhiyeh". Think you can find it using rainbow tables ? heh...
Click to expand...

I used a password with alpha-numeric, symbols, and capital/small letters, so is it crackable?
 
IA64 said:
You missed the point. The word macrumors was an example. Using a password with alpha-numeric, symbols and capital letter will make it much harder to crack it. Heck, my password was only small letters "mloukhiyeh". Think you can find it using rainbow tables ? heh...
Click to expand...

thats bs , its password size that makes it solid, i have rainbow tables can can give me passwords under 15 chars in less than a hour, ANY PASSWORD.


don't give advice on stuff you have NO experience in.


just so you know , that password you posted would have taken 37 minutes to get using my crappy 8 core server.
 
IA64 said:
You missed the point. The word macrumors was an example. Using a password with alpha-numeric, symbols and capital letter will make it much harder to crack it. Heck, my password was only small letters "mloukhiyeh". Think you can find it using rainbow tables ? heh...
Click to expand...

Ah, gotcha, the "M4cRumor$" was simply a bad example. :)

I've never run them, but I wonder if somebody with hashcat, the RockYou dictionary and the best64 rules could generate the MD5 of "mloukhiyeh" quickly... And how long it would be compared to "M4cRumor$" and, say, "mAc4rumOrs%" and "macapplerumorsstaple".

Anybody here got hashcat set up?
edit - thanks MacModMachine :)

By the way, how much storage space does a rainbow table for the MD5 hashes of all 15-character passwords take up? Assuming 26 lowers, 26 uppers, 10 digits, and 30 symbols, that's 92^15 = 2.86*10^29 hashes, at 16 bytes each, that's, uhh, a couple hundred thousand yotabytes. Did I misinterpret something in your post or mess up my math?
 
Last edited:
MacModMachine said:
thats bs , its password size that makes it solid, i have rainbow tables can can give me passwords under 15 chars in less than a hour, ANY PASSWORD.


don't give advice on stuff you have NO experience in.


just so you know , that password you posted would have taken 37 minutes to get using my crappy 8 core server.
Click to expand...

Mine was 21 characters long. How long would it approximately take?
 
djtech42 said:
Mine was 21 characters long. How long would it approximately take?
Click to expand...

don't know , depends on the password (he posted his old one).

i would guess a very long time , once you get past 15-16 char it goes up exponentially,


foreign chars only add minutes to password cracking.
 
MacModMachine said:
thats bs , its password size that makes it solid, i have rainbow tables can can give me passwords under 15 chars in less than a hour, ANY PASSWORD.


don't give advice on stuff you have NO experience in.


just so you know , that password you posted would have taken 37 minutes to get using my crappy 8 core server.
Click to expand...

I am sorry to inform you that I've been studying/working with network security since 1982. A simple google search... and...

Rainbow tables and other precomputation attacks do not work against passwords that contain symbols outside the range presupposed, or that are longer than those precomputed by the attacker. However tables can be generated that take into account common ways in which users attempt to choose more secure passwords, such as adding a number or special character but because of the sizable investment in computing processing it's quiet difficult and might take forever. So,choosing a password that is longer than fourteen characters or containing special characters may force an attacker to resort to brute-force methods.
 
IA64 said:
I am sorry to inform you that I've been studying/working with network security since 1982. A simple google search... and...

Rainbow tables and other precomputation attacks do not work against passwords that contain symbols outside the range presupposed, or that are longer than those precomputed by the attacker. However tables can be generated that take into account common ways in which users attempt to choose more secure passwords, such as adding a number or special character but because of the sizable investment in computing processing it's quiet difficult and might take forever. So,choosing a password that is longer than fourteen characters or containing special characters may force an attacker to resort to brute-force methods.
Click to expand...

LOL , rainbow tables contain all the characters(a real security experts does).

you have not worked in security since 1982, this is very common knowledge in the security world.

google whatever you want son, if you relying on google instead of experience then you never really worked in computer security.
 
To arn,

May I recommend setting the forums to force everyone to change their password on next login?

It's pretty standard (and should be expected) that when a security breach is discovered everyone is forced to change passwords.
 
elistan said:
In case you didn't see my previous post - I'm curious, how big is the rainbow table of all 15-character passwords?
Click to expand...

the one i use most is 17.4 tb. (forgot this is only 14....not sure on 15...would be a lot more)

it covers foreign and is compressed , it uses a php script.
 
MacModMachine said:
the one i use most is 17.4 tb. (forgot this is only 14....not sure on 15...would be a lot more)

it covers foreign and is compressed , it uses a php script.
Click to expand...

Makes sense, thanks.

Adding an additional character, with, say, 96 possibilities implies a file 96 times larger (before compression) - so somewhere between 100 to 200 TB, I guess?
 
elistan said:
Makes sense, thanks.

Adding an additional character, with, say, 96 possibilities implies a file 96 times larger (before compression) - so somewhere between 100 to 200 TB, I guess?
Click to expand...

exactly...it goes substantially....when you get into 20+ chars you would be long dead before the computer got the password.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back