Bitcoin Forum

It's amazing how small the market is really, just 60k people. wtf.

It's amazing how small the market is really, just 60k people. wtf.

If they cant get the passwords because they're hashed, then... ummm, how did they do it?

I do not know if this is real or fake. However, this is an direct download link that I hosted. Please comment...

http://bit.ly/kE3Q4D (http://bit.ly/kE3Q4D)

[Edit: Holy shit, this is real. I found my email & password in the CSV. Shit just got real...]

So it's easy to crack hashes passwords, takes a few minutes per password

I hope you guys are interested in buying Viagra and increasing the size of your penis.

I am around 4k!

And I joined in april


Now can someone take that data and calculate how fast bitcoin is growing? (common, let's at least make something useful with the data :/ like, seeing the good side of bad things)

This.

Also, it's pretty scary to see my username, email address and password hash in the big list too but there are still a few questions that remain.

Does anyone with perhaps a hair more experience than myself recognize the format of these hashes? I can recognize base 64 encoded fields with "$" as a delimiter easily enough, but I haven't taken the time to explicitly generate various hashes from my known password, b64 encode them and compare the results. I can do this later today if I've got the time but I'm kind of hoping that someone else already has :)

The above exercise, if nothing matches, could also prove whether Mt. Gox was actually salting their hashes, which seems doubtful looking at the CSV.

Really though I'm with speeder, let's at least identify enough people and their signup dates in this list to imply some good network growth numbers that we might otherwise not have access to.

What do you think Bitcoin miners are doing? Cracking hashes.

What do you think the passwords are protected with? Hashes.

So it's easy to crack hashes passwords, takes a few minutes per password, as long as it takes to crack a new Bitcoin block (about 10 minutes) is how long it takes to crack a hashed password.

Incorrect. The amount of time it takes is related to the complexity of the password. "monkey" will be found in seconds, but something like "efweug#%_#Tsafwef24g" will take years.

This is really bad... I cracked a few passwords using JohnTheRipper...

I am curious, how did they get that DB in the first place?

+1

Incorrect. The amount of time it takes is related to the complexity of the password. "monkey" will be found in seconds, but something like "efweug#%_#Tsafwef24g" will take years.

These fucking clowns should have stuck to selling magic the gathering cards.

Maybe this file is actually a virus/keylogger that will steal your wallet.dat or find your new password once Mt.Gox comes up again? That's the only thing from preventing me from downloading this file.

Really tempted tho...

Or maybe im just stupid/paranoid.

is there a way to "search" this csv list for my username instead of scrolling 60K names?

is there a way to "search" this csv list for my username instead of scrolling 60K names?

so obviously its md5, and the salt is contained within db entry, but what method are they using to get the unicode characters back into hex strings that most password crackers utilize for reversing md5?

Which is why we salt passwords before hashing them. It might take seconds to find "monkey" but it'll take ages to find "monkeyefweug#%_#Tsafwef24g" and the user doesn't have to remember that second part. Really if the database is compromised the salt is in there with the hash so it doesn't help much but it DOES at least make it so that two people using the same password won't both be compromised by simply compromising one of them. It also makes "rainbow tables" (giant tables of common passwords and what they hash to) ineffective.

is there a way to "search" this csv list for my username instead of scrolling 60K names?

so obviously its md5, and the salt is contained within db entry, but what method are they using to get the unicode characters back into hex strings that most password crackers utilize for reversing md5?

On the other hand, if they coded is smartly, they also used extra salt that is only in the source code and not in database  - that one should help indeed.

at least several months ago.

I am not as computer literate as most of you. I have some dumb questions. Please be patient with me.

1. Is the *only* data that has been lost the user names, email and hashed password? Is there any way these people can get at my wallet? (I had nothing at Mt. Gox so I have no worries about that)

2. Can they get at the account from which I sent money to Mt Gox?

3. How could this have happened? I expected a person handling this kind of money would be secured like my bank website. On the other hand, why did everyone trust him?

4. Is Mt. Gox giving any accountability such as taking steps to secure what information has not been lost yet?

5. Luckily I used my Mt Gox password only there. What steps should I take to secure other data I have?

thanks

Need a date, man... That's way too vague.

Does anyone know where i can find a program that encrypts a string using the same method as Mt. Gox did? I genuinely cant remember what password i used on Mt Gox (never actually traded on it) but i know its one of several i can remember, so i want to do trial and error to check which one it is :P thanks.

I should point out that the site made a change to improve password security at least several months ago.  Any passwords set after that time are secure.

Their biggest fault was not forcing users to update their passwords at that time.

Isn't it ironic that bitcoin mining is essentially also cracking a hash?

Almost every person in this forum has the necessary hardware to get crackin.

i changed my pass also yesterday, can someone confirm the hack date???

I should point out that the site made a change to improve password security at least several months ago.  Any passwords set after that time are secure.

Their biggest fault was not forcing users to update their passwords at that time.

Does anyone know where i can find a program that encrypts a string using the same method as Mt. Gox did? I genuinely cant remember what password i used on Mt Gox (never actually traded on it) but i know its one of several i can remember, so i want to do trial and error to check which one it is :P thanks.

Can someone try to crack user 16139 please?

I would like to know how strong the password is. I believe it is pretty strong but I could be wrong.

No, they are not secure.  They're slightly MORE secure, assuming good, long, semi-random password with lots of special characters.   Seeing the kinds of passwords a trivial cracking attempt busted I'd say a good portion of the userbase are NOT computer security experts and are NOT picking secure passwords.  Those kinds of people are likely to be re-using the passwords elsewhere and are now going to be in a world of hurt thanks to mtgox.

No, they are not secure.  They're slightly MORE secure, assuming good, long, semi-random password with lots of special characters.   Seeing the kinds of passwords a trivial cracking attempt busted I'd say a good portion of the userbase are NOT computer security experts and are NOT picking secure passwords.  Those kinds of people are likely to be re-using the passwords elsewhere and are now going to be in a world of hurt thanks to mtgox.

MTGOX BREAKING NEWS

We will do one hour with the TradeHill guys LIVE via Skype.... at 9pm to 10pm ET tonight.

Then, we will do one hour with the MtGox guys LIVE via telephone from Tokyo.... at 10pm to 11pm ET tonight.

Go to http://onlyonetv.com and click the "Watch Live" button now... and join in the Live Chatroom.

See All Time Zones here:  http://goo.gl/ZqQRq

Anybody check that csv file for viruses? Or did we just get compromised again?

I'm trying to figure out why you think it is acceptable to keep posting this in every thread.  Did you get dropped on your head a lot as a child?

My Gmail account reported suspicious activity and I had to reset my password there. I'm using http://howsecureismypassword.net/ to determine the strength. >600yrs to crack on a normal PC it says. So maybe 60 yrs on a mining rig, good enough for now!

Mine says 7 decillion years

My Gmail account reported suspicious activity and I had to reset my password there. I'm using http://howsecureismypassword.net/ to determine the strength. >600yrs to crack on a normal PC it says. So maybe 60 yrs on a mining rig, good enough for now!

You are using http://howsecureismypassword.net/ and entering your password there?

Let's keep finger crossed the admin of that site is not logging the requests anywhere!  Or his hosting, or possible his and your ISP and all ISP in between if this checker is in http instead https. And people able to buy forged SSL certs for MITM attacks even if it is https.

Does anyone with perhaps a hair more experience than myself recognize the format of these hashes? I can recognize base 64 encoded fields with "$" as a delimiter easily enough, but I haven't taken the time to explicitly generate various hashes from my known password, b64 encode them and compare the results. I can do this later today if I've got the time but I'm kind of hoping that someone else already has :)

The above exercise, if nothing matches, could also prove whether Mt. Gox was actually salting their hashes, which seems doubtful looking at the CSV.

Really though I'm with speeder, let's at least identify enough people and their signup dates in this list to imply some good network growth numbers that we might otherwise not have access to.

Wow, glad I changed my password to "efweug#%_#Tsafwef24g" just 2 days ago!

You are using http://howsecureismypassword.net/ and entering your password there?

Let's keep finger crossed the admin of that site is not logging the requests anywhere!  Or his hosting, or possible his and your ISP and all ISP in between if this checker is in http instead https. And people able to buy forged SSL certs for MITM attacks even if it is https.

Isn't it ironic that bitcoin mining is essentially also cracking a hash?

[Update - 2:06 GMT] What we know and what is being done.

    It appears that someone who performs audits on our system and had read-only access to our database had their computer compromised. This allowed for someone to pull our database. The site was not compromised with a SQL injection as many are reporting, so in effect the site was not hacked.
    Two months ago we migrated from MD5 hashing to freeBSD MD5 salted hashing. The unsalted user accounts in the wild are ones that haven't been accessed in over 2 months and are considered idle. Once we are back up we will have implemented SHA-512 multi-iteration salted hashing and all users will be required to update to a new strong password.
    We have been working with Google to ensure any gmail accounts associated with Mt.Gox user accounts have been locked and need to be reverified.
    Mt.Gox will continue to be offline as we continue our investigation, at this time we are pushing it to 8:00am GMT.
    When Mt.Gox comes back online, we will be putting all users through a new security measure to authenticate the users. This will be a mix of matching the last IP address that accessed the account, verifying their email address, account name and old password. Users will then be prompted to enter in a new strong password.

What do you think Bitcoin miners are doing? Cracking hashes.

What do you think the passwords are protected with? Hashes.

So it's easy to crack hashes passwords, takes a few minutes per password, as long as it takes to crack a new Bitcoin block (about 10 minutes) is how long it takes to crack a hashed password.

Is it possible to get the list of names etc in alphabetical order?

I hope you guys are interested in buying Viagra and increasing the size of your penis.

on this site you can create your md5 hash if you are not sure which pw you used or just want to check if it is in there:

http://www.insidepro.com/hashes.php?lang=eng

newer hash starting with $1$:
enter password and salt. you will find your hash at "MD5(Unix)"

salt is between the second and the third $ character:
$1$/gKxns/A$42b18btDR4VVUJR8hOEqW0

hash goes after the third $ character:
$1$/gKxns/A$42b18btDR4VVUJR8hOEqW0

I am in not affiliated in any way with the site and can not tell if they are trustworthy. So only check if your password is weak or you have changed it everywhere else.

It appears that someone who performs audits on our system and had read-only access to our database had their computer compromised. This allowed for someone to pull our database. The site was not compromised with a SQL injection as many are reporting, so in effect the site was not hacked.

When the Gox problems first came up a few days ago I went in and changed my password. They have the *new* password. I have $4.65 in Gox and the new password is unique to Gox. It feels spooky but I guessed I dodged a bullet...unless the hoodlums have more info Gox isn't talking about.

Thanks for posting that link.

I changed my password around 8:30PM USA west coast time June 16, so it was after that they got the data.

I hope you guys are interested in buying Viagra and increasing the size of your penis.

I changed my password around 8:30PM USA west coast time June 16, so it was after that they got the data.

That puts its between Sunday the 12th and 16th that the data was stolen.

i woke up this morning to see my email account was taken over.. everyone on that list should assume the passwords have been compromised - i have since retaken over my account

http://blog.zorinaq.com/?e=55 says "...Contrary to previous claims from the MtGox owner, this indicates that many accounts had been compromised for at least days, if not weeks, before today's attack. This may explain some of the reports of Bitcoins being stolen from MtGox accounts in the previous days and weeks, as reported on the forums."

Something doesn't add up. My password on the posted .csv was created on the evening of June 16 west coast time. If blog.zorinaq.com is correct, then there were at least two separate seizures or losses of user lists from Gox, the first being long before Friday's release.

Salts should include something unique for the site! Im not sure this is the case here, it would alleviate the problem with re-using password-hashes between many sites.

The salt should have a random part per user stored in the database and a static part per site stored in some include file.
The first part prevents massive parallelization, rainbow tables etc.
The second part keeps the password secure when only the database is leaked (ex. a SQL injection that does not escalate to code execution). In the case of MtGox it wouldn't have helped since the read-only account probably had source access too.

Extending this idea, email can be stored using reversible encryption. Thus a simple database leak is not sufficient to compromise all emails, you need local access to the source.

But, if an attacker can brute force two passwords with static salt, they then know the static salt, and it offers no more protection

If you take the time to read my post carefully you will see I've acknowledged that the static part does not improve protection against brute force. It ensures that to even attempt brute force, the attacker must have read access to the source, not just the database. That's a different class of attack, a significant speed-bump for the attacker from a layered security perspective.

It's amazing how small the market is really, just 60k people. wtf.

No, the attacker does not need the static extra secret.  The brute force attack will reveal it right along with the password.  All it does is make the first two attempts harder, possibly a lot harder.  After that, it has no value.

Why do you keep the file up? So more hackers can try to crack the password and steal everything? To make our emails more public then they are now?

If hackers want this list, they will find their way to it elsewhere. There's no stopping them with removing the link.

I believe that this shouldn't be kept secret, it is a P2P currency. :P

Srsly. Here, let me illustrate:

OMG! All my horses have escaped! Why is the barn door still open?!?

Well, went to login to my google account this morning and had to make a new password because of "suspicious activity" trying to access the account I guess...

Google got the list and got all gmail accounts to reset their password.

Is that confirmed? I had to reset mine, but I just figured my MtGox password was cracked.

This information is important.  
I'm just trying to get it out to everyone as quickly as possible.  
Sorry if I'm repeating myself, but there are so many threads on this same topic..  I don't want anyone to miss it.
 
Today at 2pm ET we'll be interviewing LIVE.... the man behind the $5,000,000 trade....
...  The man who bought the Bitcoin at $0.01 each....

Then later this evening, at 10pm ET, we will have Mark Karpeles,  the owner of MtGox...  personally ...  LIVE ... to answer all of your questions in the Chatroom.  

http://forum.bitcoin.org/index.php?topic=19641.msg245983#msg245983

Srsly. Here, let me illustrate:

OMG! All my horses have escaped! Why is the barn door still open?!?