New Online MD5 Hash Database

Gravix writes with a shameless plug for his new site "Sporting over 12 million entries, project GDataOnline is one of the largest non-RainbowTable based MD5 crackers on the internet. The database spans over 7 languages, 35 topics, and contains common mutations to words that include numbers and capitalization. Average crack time for 5 hashes: .04 seconds. No more waiting weeks for your results!" Shameless plug aside, the site still seems worth a closer look.

So what?

[kasperd]

Any system using plain md5 to hash passwords is broken anyway. Include a salt - and any database over hashes will become useless. Besides if people choose good passwords, they are most likely not in the database. That is already two reasons why people should be protected, do we need anymore?

For many other uses of cryptographic hashes the input is much more than a single word, and typically you don't really worry about keeping the input a secret anyway.

Re:Doesn't seem very useful

[VeryProfessional]

You wouldn't by any chance be using the md5sum command line utility and typing a newline after the word? I just tried my own name, which turned out to be in the database. Could you give just a few examples of the hash values you submitted, and the word you expected it to return?

Oops, right you are, that's exactly what I was doing... tried the same words with echo -n and they were in fact in the database.

/me wipes egg off face

Re:Linux

[arodland]

Linux distros these days use MD5 by default -- but they use it in a way that's not so horribly stupid as to be broken by this attack.

Re:Hmmm...

[Anonymous Coward]

I thought I might try explaining it, but Wikipedia would probably do a better job:

http://en.wikipedia.org/wiki/Salt_(cryptography) [wikipedia.org]

Re:Downloadable database form?

[Janitha]

You can create it, actually if you asked that a few months ago I had 100GB worth of md5 0-8 alpha-ALPHA-num every combination for sale (which I later made free if you sent me DVD's) but I deleted since no one was much interested and it was much needed space for other stuff. I used rainbowcrack (http://www.antsight.com/zsl/rainbowcrack [antsight.com]) for some reason the linux client seems to work much faster than the windows one (although it made no sense to why)

Re:wow

[FLAGGR]

thats why the made a form for you to add words. Crazy ain't it. Although they should've made some automatic leetspeak adding script.

MD5 is nice but...

[nmb3000]

What would be really nice is to see this grow past a simple MD5 database. If you're going to get traffic, you really should get an NTLM database up and start populating it as soon as possible.

A few other places have these, in differing amounts. Rainbowcrack [rainbowcrack.com] has tons of them, but require you to submit some before being allowed to query the system. I did submit a few NTLM hash tables, but it took the better part of a week to get my query back (it's supposed to be a lot faster than that).

There's also Ophcrack [lasecwww.epfl.ch] which uses tables similar to rainbow tables. It has a web interface to query NTLM hashes for simple passwords.

With these pre-computed hash tables, basic password security is starting to take a hit and it's becoming more and more worthwhile to use a simple but long password rather than a short and complex one. If you're on Windows, it's also VERY worthwhile to read about forcing Windows to store only the NTLM hash and drop the LM hash [microsoft.com]. It breaks old compatibility with Win 9x but is very worth it if you don't need that. This helps against precomputed attackes but has an even bigger impact agains brute-force attacks.

Re:Linux

[spitefulcrow]

Any modern Linux distribution worth its salt (pardon the pun) uses at least an MD5-based salted password storage system. Wikipedia will tell you more about salting. [wikipedia.org] What it boils down to is that using enough bits of salt can make it infeasible for Joe Hacker to store a database of passwords, salts, and their hashed values that would encompass all combinations and allow dictionary attacks against MD5-protected passwords. If your Linux system doesn't use a salted hash to store passwords in /etc/shadow, you may have an issue if untrusted users have access to your system. Then again, if untrusted users have enough access to read /etc/shadow, you have a bigger problem than someone cracking your normal user passwords.

For those that don't know

[Sycraft-fu]

To call LM weak would be an understatement. LM takes passwords up to 14 charackets in length, fine you think until you realise that the way tey did it is to hash 2 7-character strings. This means for any password, you have to crack a max of 7 characters. Oh, and did I meantion it's case insensitive?

There are existing ranbowtables covering basically the entire LM space but, really, you don't need it. A fast dual core chip will crack it in less than a day.

The parent is correct in that in all cases you can you should set Windows to only use NTLM, or better yet NTLMv2. We are (finally) getting to do that at work as we purged the last NT and 98 systems from the domain.

Re:Crypto experts... SHA1?

[Anonymous Coward]

It is not an attack, it is just a dictionary.
It works for any hash function.

Re:Crypto experts... SHA1?

[chialea]

They're just precomputing hashes, from what I can see. There's nothing that stops you from doing it for a very large number of inputs and storing the results. If you want to get a collision using that precomputation, however, it'll be a lot harder on SHA-1 than on MD-5, even given the new attacks on it. (If you're curious about the attacks, look at this years' CRYPTO papers. Professor Wong and her team have come out with some great stuff.) Preimage attacks will probably still be difficult on SHA-1, as the new results don't signifigantly impact the property of preimage-resistance (from what I saw of the attacks in the talks).

The upshot is: (1) yes, you can do this, it's just brute-force; (2) it's not as easy with MD-5.

Lea

Re:Downloadable database form?

[Janitha]

With multiple programs working on seperate parts (assuming you broke your whole project into many tables) it can be done pretty fast. Specially if you have access to many computers. The rainbowcrack will automatically pick up and resume work if interupted in the middle, and skips over if the asked table is already created, so its perfect for the job of spanning across multiple machines.

Re:Hmmm...

[jurt1235]

MD5 is a hashing method, and ofcourse you can look up the hashes again. It is just a quick and dirty way of encoding your passwords in php, or to check if a file is really that file which you were expecting. It is not for real password encryption use.

Anyway: MD5 hashes over a certain dataset are not unique. Two datasets can result in the same MD5 hash, assuming a fixed has length. This database could point those out too.

As last remark: This kind of database use has been done before by chess engines. By just storing most succesful board setups, the next moves could be executed more effectively and a lot faster.

Re:Compression Algorithm

[Anonymous Coward]

MD5 hashes aren't unique. There are around 2^105 (around 10^32, or 10 decillion) 10 MB files with the hash '498b4ddc9f957eca6473923163dd117f', for example. There's also a five-letter word that coincidentally hashes to that value AND describes you, but you can find it yourself.

Trojan alert

[Anonymous Coward]

Visiting this site (md5 one) resulted in pop-ups which were loaded with the StartPage Trojan which fortunately F-Secure spotted.

Re:oh, i get it!

[Saeger]

$ echo -n "first post" | md5sum
6436a55a08760c5b94dbed4476f83fcd -

Re:Hmmm...

[Tobbe Starfield]

If you just store the hashes of passwords they are vulnerable to dictionary attacks. If you also add some random data, "salt", to each password before hashing, you get a salted hash. Even if you store the "salt" and salted hash right next to each other, it gets much harder to attack. (Of course this may well have other applications than password storage.)

Re:You might expect that...

[baadger]

This is lightly salted.

"slashdot.org<my password>" will render any generic databases like GData useless for Slashdot password searching. It means someone has to build up a Slashdot specific database using a dictionary first. That is all a salt is really for, to inconvenience a dictionary attack.

"slashdot.orgbaadger<my password>" (<site><username><password>) would be better as it means the cracker has to build a database specific to slashdot and my username.

So yes these passwords are salted, using the domain just saves the plugin having to save random salts somewhere.

Re:Trojan alert

[Anonymous Coward]

I just spent the last hour removing one of the trojans. For anyone else that gets caught out here's the instructions to remove it. http://www.androidworld.com/prod91.htm [androidworld.com]

Re:quick

[TheRaven64]

It didn't have my password (hash: ae5799ed7235ff7d43a19073c74f4667), which was quite a surprise. It's the deeply insecure password I use for boxes with no remote services enabled (systems in VirtualPC, my Windows laptop) - it's only useful to a local attacker, and they have much easier ways of gaining access.

Re:Hmmm...

[karmatic]

> I wonder if it's possible to grep the likes of MySQL's storage files for MD5 hashes (thereby bypassing the databases authentication)?

Yes, but you need shell access to do it.

Re:Downloadable database form?

[Thundersnatch]

It's called a password "salt", and many applications use them. It's much better to use a large random value stored in the clear than the username.

Microsoft, of course, is screwed by the need to provide backward compatibilitty, and does not salt the (MD4-based) NTLMv2 hash stored on Windows systems. They encrypt the whole hash database instead to prevent offline attacks, but this is ineffective as the decryption key is also "hidden" on the system's disk unless you want requrie a diskette/CD/floppy at boot that contains the decryption "syskey".

Re:Hmmm...

[stewby18]

If you think about it hashing your passwords in a database is almost an admittance [tha] you're database will probably be comprimised

No, it's a recognition of the fact that it's at least theoretically possible that your database might be compromised at some point in the future. And anyone who isn't an idiot will design their systems in such a way as to minimize the damage that can be caused by a single point of failure. That's not an admission of incompetence, it's plain common sense.

Another Reason....

[HopeOS]

3) the system administrators need reasonable deniability from user's claims of password theft.

If the user's password is stored in plain text, they can claim that you, the system administrator, have access to it. This increases your liability as the user can now disclaim responsibility for actions taken with that password, on any other system where it is used -- after all, they could have been impersonated, and they can accuse you of being the culprit.

-Hope