[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <58210.108.15.198.116.1305744247.squirrel@webmail.tuffmail.net>
Date: Wed, 18 May 2011 14:44:07 -0400 (EDT)
From: brad@...ystems.com
To: john-users@...ts.openwall.com
Cc: john-users@...ts.openwall.com
Subject: Re: Help with 14 - 16 digit CC's stored in MD5 hash
> Can anyone direct me to optimal configuration settings for JtR when
attempting to reverse credit card information that is stored in MD5
hashes? The numbers are assumed to be 14-16 digits in length.
>
> Theory associated with what I would like to accomplish is can be found
here.
> http://www.integrigy.com/security-resources/whitepapers/Integrigy_Hashing_Credit_Card_Numbers_Unsafe_Practices.pdf
>
> The paper mentions several techniques as well as rainbow tables. I am
looking for anyone that has actually generated tables specifically
geared
> toward this attack or for anyone that can offer configuration tips for
JtR. Helping John make more efficient guesses would be the key,
> implementing logic from the paper would be quite useful.
>
> Thanks
> -KF
A list of IINs (Issuer Identification Number) would cover the first six
chars of the numbers. The remaining 10 or 8 digits, depending on the card
type, would have to match-up with the IINs in such a way that the whole
number (IIN + remaining digits) would be Luhn validateable.
I do not believe that IINs are public data. The American Bankers
Association is the keeper of the IIN list. Also, it may be illegal (not
sure ask your lawyer before proceeding) to read or access a list of valid
IINs without permission or some sort of merchant access/agreement in
place. Talk to you lawyer now, it's very easy to get in trouble with
credit card information and you don't want to do that. Just be certain
what you are doing is legal before proceeding.
Major Industry Identifiers (MIIs) (the first digit) are public information
and would be a good starting point to narrow things down if your legal
counsel advises you to not use IINs for this purpose, but still feel it is
legal for you to try to reverse the CC hashes.
Some trivia... 16 digit CCs are the most common, you'll get the most bang
for your buck by focusing on that. 15 are more rare (Amex mostly in the
U.S.) and 14 are too. Old Visa's used to be 13.
Again, be very careful in what you are doing and be certain you don't
break the law while doing so.
Brad
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
