Forgot your password?
typodupeerror
Security The Internet

Free Rainbow Tables Looking For New Admin 95

Posted by kdawson
from the all-the-colors dept.
lee writes "After almost three years online, the admin of Free Rainbow Tables has decided to call it a day, citing a lack of time to keep it running. (I'm sure that you all know a rainbow table is essentially a giant list of precomputed hashes.) This is a shame, as the site is a useful resource for those occasions when you really need an existing password exposed, rather than simply changing it. I'm a Windows admin, and this site has come in very handy in the past. The currently computed tables weigh in at well over half a terabyte, are available as torrents from the site, or from a couple of mirrors (and alternatives are available). When the site was active, it featured a downloadable BOINC client to put your idle cycles to work computing ever-greater tables, and a space-saving format for storing the tables. The admin is willing to hand over source code if you wish to take over, though I suspect hosting is not included!"
This discussion has been archived. No new comments can be posted.

Free Rainbow Tables Looking For New Admin

Comments Filter:
  • by goobermaster (1263770) on Friday July 17, 2009 @12:31PM (#28732189)

    The headline 'Free Rainbow Tables' makes you immediately think of a table covered in Skittles

    • Re: (Score:2, Funny)

      wish i could mod this 'tasty'
    • Re: (Score:3, Funny)

      by Em Emalb (452530)

      think of a table covered in Skittles

      Billy Mays here for Free Rainbow Tables dotcom. Have you ever needed a giant list of pre-computed hashes? Have you ever forgotten the password to that old Linux box sitting in the corner of the accounting department's coat closet? Then have I got just the thing for you! All you need to do is, and this part's amazing, is go to freerainbowtables.com, that's freerainbowtables.com, enter your hash-string, and voila, there's your password. It's so easy, a paraplegic blind

      • by slyn (1111419)

        You forgot to yell.

        HI, BILLY MAYS HERE WITH A FANTASTIC NEW PRODUCT....

        Filter fodder: "Filter error: Don't use so many caps. It's like YELLING."

        • Re: (Score:3, Funny)

          by Chyeld (713439)

          Billy Mayes didn't yell. It seemed like it because, just like Chuck Norris, when he spoke the rest of the world knew the STFU.

    • It's good to know I wasn't alone.
    • by cstdenis (1118589)

      It makes me think of smarties you insensitive clod.

    • But if you were hungry, wouldn't you think of actual *food* instead? ^^

  • Support is pending (Score:5, Insightful)

    by 192939495969798999 (58312) <<info> <at> <devinmoore.com>> on Friday July 17, 2009 @12:31PM (#28732193) Homepage Journal

    I am sure that plenty of groups that may "need an existing password exposed" are interested in anonymously donating hosting for this project.

    • Re: (Score:3, Insightful)

      by nametaken (610866)

      Or pay-for-download and/or pay-for-lookup service, and keep the site online.

      • by ebuck (585470)

        They already accept money to buy more credits for heavier access of their service. For those that are unwilling to pay in cash, they offer credits for populating their system with hashes through the use of their client.

        Somehow I think that if money were the issue, they would just say they lack money instead of saying they lack time. Considering that they've had two upsets in the last two months, a lack of time sounds like an honest reason.

      • by jDeepbeep (913892)

        Or pay-for-download and/or pay-for-lookup service, and keep the site online.

        In such a case, they would clearly need to change their SLD name, to not have the word 'free' in it.

    • Re: (Score:3, Insightful)

      by CarpetShark (865376)

      I am sure that plenty of groups...are interested in anonymously donating hosting for this project.

      You think? Personally, I think you'd have to be a glutton for punishment, to want to admin a site for people interested in rainbow tables.

      • by jonadab (583620)
        > Personally, I think you'd have to be a glutton for punishment,
        > to want to admin a site for people interested in rainbow tables.

        If it were theoretical information about rainbow tables, how they're used, what implications they have for security, the effects of salt, which common systems use salt and which ones don't, and so on and so forth, the abuse the admin would take might not be so bad. I mean, you'd have some detractors, sure, but it would hopefully be manageable for the most part.

        But yeah, a
    • The computer club at Western Michigan University [wmich.edu] is entertaining the idea of hosting these tables, we've been in contact with the admin over there about the data and bandwidth requirements, and it looks like we have the resources needed to host them. Unfortunately we don't have a quorom to vote on the issue until the fall semester begins and the majority of our members are in town.
  • by MoldySpore (1280634) on Friday July 17, 2009 @12:36PM (#28732249)

    Buy the domain, contact LeVar Burton to help promote it, and post video testimonials on how great they work.

    LeVar: "Crack passwords now! But you don't have to take my word for it..." *dun dun dunnn!*

  • If you assume that everyone knows what it means then why are you telling us what it means knowing damned well that probably 99% of the audience doesn't actually know what it means, or cares for that matter. It makes you come across demeaning to the vast majority of people who could give a crap.
    • by Shikaku (1129753) on Friday July 17, 2009 @12:41PM (#28732351)

      News for Nerds.

      • Re: (Score:2, Funny)

        by baka_toroi (1194359)
        Shikaku wa sora, shikaku wa hiroi
        • by geekoid (135745)

          Ok, there must be another meaning besides the literal translation.

          • by Chyeld (713439)

            3.14 [youtube.com] from Cowboy Beebop, the movie. Ed doing what Ed does best, being odd and cute.

        • Re: (Score:2, Informative)

          by Chyeld (713439)

          Maruha medama
          Maruha kirei
          Kuroibudouno
          Amaiagi

          Sankakuha gikan
          Sankakuha hayai
          Sakana no shippono
          Furuekata

          Shikakuha Sora
          Shikakuha Hirui
          Hanawo kandera
          Iinaoi

          3.14159 2653589 7932384
          626433 8327950 28841197 1693993
          751582

          .

          circle is eyeball
          circle is beautiful
          blackberry's sweet taste

          triangle is time
          triangle is fast
          the movement of fish's tail

          square is sky
          square is wide
          it smells good when you smell flowers

          3.14159 2653589 7932384 626433
          8327950 28841197 1693993 751582

          • "amai agi" as in soft "g"? Romanized by an Italian, maybe?

            "hanawo kandara" would be when you bite flowers,
            "hanawo kaidara" would be when you smell them.

            "iina nioi" would be sloppy grammar, but "ii naoi"?

            "ha" and "wo", while not standard, are more literal Romanizations of the two particles.

            Some sort of dialect?

            Author of a manga deliberately breaking rules?

            • by Chyeld (713439)

              Or copied from the only shitty lyrics site I could find that didn't have malware shit going on or a lame javascript protecting the lyrics they ripped off someone else. ^_^

              Attribute all errors to the editor, not the author.

              • Uuum, every tried the option under "settings -> content -> extended..." in Firefox? Disable the right-click menu-hiding functionality, and you're good.

                Oh, and Firebug always helps, when nothing else does.

              • Actually, I was going to rip it apart, but, as I was going through the errors, I realized that the possibilities I suggested were, in fact, possibilities.

                You'd be amazed at the deliberately non-standard Romanization I've seen in use by native Japanese who think it's cool to break rules. (And the particles I mentioned are actually fairly good evidence that it might indeed be cool to break the rules.)

                And, while I don't know of specific dialects in which the odd pronunciations and grammar I pointed out are com

    • by RiotingPacifist (1228016) on Friday July 17, 2009 @12:47PM (#28732423)

      Because slashdot used to be a site for geeks, however recently anytime somebody uses a simple TLA/ETLA people start bitching that they don't know what it meant and they are too lazy to google and/or wikipeida it, so instead you get a stupid thread full of people who have !RTFA commenting on a subject that is of no interest to them, if it was they would have understood the TLA in TFS, this really annoys the few geeks that actually RTFA as it dilutes the comments. As a TFS contains redundant information to prevent people going "what are rainbow tables?", lets be honest if you're the kind of geek that has ever done any 'cracking' you knew what it mean, if you're not then you don't care.

      p.s irony of this post not lost on me!

      • by Obfuscant (592200) on Friday July 17, 2009 @12:58PM (#28732561)
        lets be honest if you're the kind of geek that has ever done any 'cracking' you knew what it mean, if you're not then you don't care.

        Let's be honest, I'm a kind of geek that has done cracking, but I don't devote my life to it. I've never heard the term "rainbow table" applied to the lists of precomputed hashes, so it was nice to have a simple hint that said "precomputed hashes", and I do care.

        • by quelrods (521005) *
          If you just mentally link rainbow table with precomputed hashes then you have missed the point entirely. Rainbow tables are an entirely new approach to the problem. It isn't simply storing every precomputed hash. It has a few advantages such as much less disk space is needed, much faster due to indexes as well as less to load from disk, etc. It's actually probabilistic in nature and does not guarantee 100% that a given hash is found. You may want to spend the time to read through the FAQ [freerainbowtables.com] if you are int
      • by sunking2 (521698)
        What was annoying was not the information, but the presentation. Modify the wording to be along the lines of 'For those unfamiliar, blah blah blah' and the summary changes from demeaning/belittling to those unfamiliar, to informative. This is the sort of thing that keeps the nerd in the corner by himself at a party :)
      • by b4dc0d3r (1268512)

        People start bitching because it's a knee-jerk reaction at this point. We're trying to convince people that it takes less time for them to type 2-3 words explaining it than for thousands of people to Google it and figure out which of the many results are applicable based on context. Would you agree or disagree with this statement?

        Also, just because I'm not familiar with it doesn't mean I won't find it interesting. Especially if I'm interested in it, and used them lots before someone invented a new name f

        • by quelrods (521005) *
          Please see my comment [slashdot.org] on the matter of "a new name for it for no reason."

          If it was nothing but precomputed hashes then indeed it would not be very interesting as it is nothing new. However, it's quite a bit different as the lookups are probabilistic, not 1:1 look ups for is the hash there yes/no.

          For that matter educating people to learn how to use salts with their hash for storing passwords is no where near complete even among savy geeks.
  • Salts? (Score:5, Informative)

    by Sir_Lewk (967686) <sirlewk@gmai l . com> on Friday July 17, 2009 @12:47PM (#28732421)

    I thought the prevelance of using salts with hashes obsoleted rainbow tables years ago.

    • Re: (Score:3, Informative)

      by six (1673)

      Once you've reverted the hash back to salt+plaintext, it's *much* easier to remove the salt (often some string concatenated with the plaintext).

      • That would be true but with something like a 20 character salt the required rainbow tables to cut down the time to a reasonable level would take a ridiculous amount of storage. You could of course compile a set of rainbow tables for that specific salt but then you may as well give up on rainbow tables.

        • by ebuck (585470)

          Perhaps that's why they are offering to sell the entire set of indexed hashes for just under $600? (shipped on a 1.5 TB usb disk drive). Considering their relative lack of mark-up on the 1.5 TB usb disk drive, I don't get the impression that these guys were in it for the money.

          • by Otto (17870)

            Lack of markup? Last I checked, a USB 1.5TB drive was around $150, tops. Not $600.

            http://www.newegg.com/Product/Product.aspx?Item=N82E16822148406 [newegg.com]

          • No the tables they are selling on those disks would not cope with a 10 character password. They have a 12 character table listed but that is for pure numeric, the rest have a maximum of 9 characters. Using the calculator http://www.insidepro.com/rainbow.php [insidepro.com] you can see that to get tables for a 16 character password (which is still a lot less that a password + 20 character salt) you would need more hard disk space than you could expect to be able to buy (several orders of magnitude more). So that leaves t

      • Re:Salts? (Score:5, Insightful)

        by zindorsky (710179) <zindorsky@gmail.com> on Friday July 17, 2009 @01:14PM (#28732795)

        Once you've reverted the hash back to salt+plaintext, it's *much* easier to remove the salt (often some string concatenated with the plaintext).

        Often? That's the definition of salt.

        Also, rainbow tables don't revert the hash back to salt+plaintext. Rainbow Tables don't work if salt was (correctly) used. Well, I guess you could make a set of RTs for every possible salt value ... if you have an ice age or two to wait.

    • Re: (Score:3, Informative)

      by l0b0 (803611)

      Using salts with hashes obsoleted rainbow tables years ago (if you know what you're doing).

      There, corrected it for you.

    • Re:Salts? (Score:5, Insightful)

      by RiotingPacifist (1228016) on Friday July 17, 2009 @01:09PM (#28732713)

      The site host/cracked NTLM LM MD5

      NTLM is still used in the following situations:
      * The client is authenticating to a server using an IP address.
      * The client is authenticating to a server that belongs to a different Active Directory forest, or doesn't belong to a domain.
      * No Active Directory domain exists (commonly referred to as "workgroup" or "peer-to-peer").
      * Where a firewall would otherwise restrict the ports required by Kerberos (of which there are quite a few)

      So kids getting their teeth wet on home networks, which probably explains why its not being supported. MD5 is still used by applications that arn't quite sure what they are doing/can't do much more e.g grub, im clients, etc.

      Lookup tables are still useful in cracking WPA [renderlab.net]

      • Re: (Score:1, Informative)

        by Anonymous Coward

        NTLMv1 maybe, but NTLMv2 closed that hole and doesn't use LM hashes.

        It took a few years for the default to be *not* to send the v1 hash, but it has been now since 2003 server (which is why you used to get the problem that early samba implementations don't work with newer windows domains.. the 'workaround' given was to shaft the security of the network, although these days I'd just upgrade samba).

        • by quelrods (521005) *
          AFAIK Vista is the first windows to completely remove LM hashes as the default. Other than that you had to use a password of a certain length to prevent LM hash creation, 16 characters if memory serves me correctly.
      • by SPBesui (687868)
        "Getting their teeth wet"? I think you mean "getting their feet wet" or "cutting their teeth." Or this is some new expression I'm not familiar with.
      • by quelrods (521005) *
        "im clients, etc."

        Ha! Seems IM clients tend to just store the passwords plaintext so even unsalted MD5 would be an improvement over the status quo.
    • by Chabo (880571)

      Just because better security exists does not mean that people use it.

      I use a properly secure passphrase on my credit card's website, but on accounts that aren't as critical (Slashdot), I use a simpler password.

      P.S.: It's "hunter2".

    • Re:Salts? (Score:5, Informative)

      by zindorsky (710179) <zindorsky@gmail.com> on Friday July 17, 2009 @01:10PM (#28732737)

      I thought the prevelance of using salts with hashes obsoleted rainbow tables years ago.

      True. Correctly salting your password hashes will make rainbow tables useless.

      But ... Guess which system still doesn't salt passwords? Windows!

    • MMMM Salty Hasssssh
    • IIRC up to XP (which is still the most common version in buisnesses afaict) windows was still generating relatively weak lm hashes by default.

    • by quelrods (521005) *
      Unfortunately not. Programmers and sysadmins alike only sort of seem to know what a salt is. Look at how often an application stores passwords plaintext or with a simple md5 and you'll be happier not knowing. For that matter I seem to recall that buffer overflows were discovered decades ago and yet plenty of new code continues to suffer from the flaw.

      One very interesting place that unsalted hashes seem to stick around are old LDAP directories. I've seen ones with combinations of: MD5, SMD5, SHA, SSHA
  • Only MD5/LM/NTLM? (Score:5, Informative)

    by AmiMoJo (196126) <{ten.3dlrow} {ta} {ojom}> on Friday July 17, 2009 @12:48PM (#28732435) Homepage

    I was expecting more tables than just MD5 and two types of Windows passwords. You can already download the Ophcrack DVD to do Windows passwords with rainbow tables.

    Renderlab offer wifi WPA rainbow tables: http://www.renderlab.net/projects/WPA-tables/ [renderlab.net] . I hope whoever takes over takes note of projects like that, and tries to expand the range of tables available.

    • by quelrods (521005) *
      There is some SHA1 as well via the download mirrors in TFA.

      Though, I agree and wouldn't mind to see some old style mysql hashes for instance. It's amazing how few databases actually use the new form. The new form is SHA1 twice with no salt. (Hey more unsalted fodder for rainbow tables.) I don't know if anything else uses this method but I know bad things (TM) can happen when people just create new schemes like double hashing or double encryption. (3DES was suppose to be 168 bits (56 * 3) but turns o
  • by sammyF70 (1154563) on Friday July 17, 2009 @12:52PM (#28732477) Homepage Journal
    If you need a password to access an account in windows (or linux for that matter), just use Kon-boot [piotrbania.com] instead of messing around with rainbow tables.
    • by NiteMair (309303)

      Thanks for the eyestrain - after staring at that page for a few minutes I have a headache.

      • by sammyF70 (1154563)
        No problem. At least it's not a white font on a black screen :P Not that I have anything to do with Kon-Boot anyway.
    • Re: (Score:3, Informative)

      by Rich0 (548339)

      I can't imagine that a tool like this would allow you to authenticate to the domain controller. Cracking the hash cached on the local system would.

      Unless windows is so insecure that the domain controller just takes the local workstation's word that you successfully logged in. I can't imagine such a design lasting this long. If it did you could get the machine's key off the local hard drive and then authenticate as anybody over the network.

      • Re: (Score:2, Informative)

        The local machine caches the credentials. We see this with laptop users. They have to be connected to the network here to log on the first time, then they can take it home and log in just fine without a network connection. If they change their password on their work desktop, the laptop still uses the old one until they try to log into the account again while connected to the network. So, the domain controller does not take the local machine's word for it, but the local machine does not necessarily check in
        • by sammyF70 (1154563)

          Yep. As far as I understand it, Kon-Boot will only allow you to gain root to any computer to which you have *physical* access. So no domain controllers

        • by Rich0 (548339)

          Does the local machine actually cache the network credentials between sessions? I thought that it only kept a hash so that it could verify that a password is valid, but that unless the password itself were supplied it couldn't log into the domain controller.

          If it did cache the actual credentials, then why would we need to crack hashes in the first place? Why not just use the stored credential?

          • One more time with paragraph breaks...

            I think you are correct. The users are able to log into the laptop with the old password as long as they want until they connect to a network. Then the laptop tries to authenticate the password with the domain controller. If it is not the same password as on the domain controller, you get the usual bad username/password error. If you know the old password, you can log in at any time as long as you don't connect to a network. As a bonus, if you connect to a network that

    • Re: (Score:3, Informative)

      by querist (97166)

      Granted, EFS (Encrypted File System - the "encrypt" option on NTFS) isn't the greatest, but it's there, it's included with Windows (and thus, perceived as "free as in beer"), and people use it.

      Kon-Boot will grant you access to the account, but not to anything that the user encrypted using EFS. I have just tested this today to be sure before posting.

      That is one reason why people would want to know the current password rather than just bypass the password, though Kon-Boot certainly still has its uses.

  • The currently computed tables weigh in at well over half a terabyte

    Is that actually a lot? I mean that's half of one cheap hard drive, unless it's purely the computational time to generate 500GiB of Rainbow Tables that's impressive here, and if that's the case would it not be better advertising it as such?

  • Whoops (Score:5, Insightful)

    by neokushan (932374) on Friday July 17, 2009 @01:11PM (#28732761)

    Slashdotting the site really isn't helping to keep it online.

  • rainbow table? (Score:3, Informative)

    by spottedkangaroo (451692) * on Friday July 17, 2009 @01:16PM (#28732837) Homepage
    I'm sure a huge precomputed hash database is handy and everything, but are we sure that's what a rainbow table is? I tried very hard to make sense of the Oechslin paper on rainbow attacks and it doesn't mention anything about pre-computing individual hashes. It's about reconstructing cipher chains (or something like that). Perhaps the term has just become diluted over the years. Seems wrong to me.
    • You have to pre-generate and store the chains.
    • by quelrods (521005) *
      Yes, the paper is not very clear. The FAQ on freerainbowtables.com comes complete with some diagrams. You are certainly correct that rainbow tables are not just huge precomputed hash databases. Unfortunately, it seems most slashdotters cannot be bothered to actually educate themselves and just like to state that its a term to describe something very basic and old.
  • Not exactly (Score:1, Informative)

    by Anonymous Coward

    (I'm sure that you all know a rainbow table is essentially a giant list of precomputed hashes.)

    The whole point of a rainbow table is that it's not a giant list of pre-computed hashes, though those do exist also. It is a large table, but it's not simply a one-to-one dictionary of plaintext and hashes.

    Anyhoo, though RTs are still valid, they are becoming much less useful as an attack method.

  • Resorb Networks, Inc ( www.resorb.net [resorb.net] ) would donate hosting...
    • by resorb (952476)
      nvm, I doubt we would have the computing power to accomplish this enormous task.

Work without a vision is slavery, Vision without work is a pipe dream, But vision with work is the hope of the world.

Working...