[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <BLU0-SMTP417DFAC9AB4D5110F31CCCAFDF30@phx.gbl>
Date: Thu, 7 Jun 2012 09:30:52 +0200
From: Frank Dittrich <frank_dittrich@...mail.com>
To: john-users@...ts.openwall.com
Subject: Re: JtR to process the LinkedIn hash dump
On 06/07/2012 03:37 AM, magnum wrote:
> On 06/07/2012 01:59 AM, Solar Designer wrote:
>> On Wed, Jun 06, 2012 at 06:10:49PM -0500, jfoug wrote:
>>> You will note that 'most' of them that you crack will have 00000 as the
>>> first bytes of the hash (if you are using the rock-u words, and
>>> nothing more
>>> than 'rules' from JtR). This shows that whomever released this, that
>>> they
>>> are using 00000 as a 'already cracked' signature.
>>
>> Not necessarily. Another possibility (and I am not the first one to
>> suggest it) is that whoever released these hashes did not figure out how
>> to crack the ones with 00000's, so he/she left them in this released
>> uncracked hashes dump. This would explain why the hashes with 00000's
>> correspond to weaker passwords (on average) than those without. The
>> reason for this public release might have been to crowdsource cracking
>> of the relatively more difficult hashes, which happened to be both those
>> with 00000's (not attacked for real at all) and those for somewhat more
>> complicated passwords (than average in the original/full database, which
>> we haven't seen so far).
>
> Another observation is that if you zero the first 20 bits of the
> complete hashes, you'll end up getting >63000 dupes. That is a little
> puzzling.
This really suggests that the 00000 hashes are in some way "deactivated".
It also supports the theory that the released hashes just contain the
uncracked hashes, and that a lot more than those 6.5 million hashes have
been stolen.
But I wonder what attacks have been tried prior to releasing the
uncracked hashes.
Even the rockyou list without any mangling rules cracked 93 hashes out
of those not beginning with '00000'.
This suggests, that prior to releasing the uncracked hashes, just
ascii-only rainbow tables have been used.
Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
