|
Title: It look less than 10 seconds to crack more than 300 accounts Post by: klaus on June 20, 2011, 07:56:57 AM http://twitter.com/#!/kaepora/status/82552527555530752 https://uloadr.com/u/CF.txt Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: Chick on June 20, 2011, 08:02:20 AM You know, I tried this too. But it takes AGES to crack the more unique ones. Gave up a few hours later...
Some of the members on that list deserved to hacked with those passwords they have :P Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: LeFBI on June 20, 2011, 08:22:11 AM the snippet you cracked there is from the view simple md5() hashes in the leaked list only. you can't bruteforce a list of +59000 unix_md5() hashes with +59000 different salts within 2s.
also, the accounts for the hashes you cracked can be considered as dead. MtGox switched from simple md5() to unix md5() months ago. the simple md5() hashes are from accounts where no one logged in for months Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: dserrano5 on June 20, 2011, 09:22:35 AM In any case, those accounts are now known to be used by people who are unaware of the importance of having strong passwords. It's not unreasonable to think that the user whose password was "qwertyABC" is going to use a weak password again.
Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: freetx on June 20, 2011, 09:50:34 AM Here is a list of the first few thousand passwords.
http://pastebin.com/r3hYJYLa The first 3000 are apparently using straight md5 with no salt, so they are fairly easy to crack If you appear on that list, please take appropriate precaution. Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: barbarousrelic on June 20, 2011, 10:13:09 AM "love" "sex" "secret" and "god" do not appear anywhere in those passwords. Hackers lied to me.
Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: Swishercutter on June 20, 2011, 10:20:50 AM "love" "sex" "secret" and "god" do not appear anywhere in those passwords. Hackers lied to me. Although, can u use quotes in passwords because "love""sex""secret"and"god" (alloneword) might be a good one to use...lol. Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: Bit_Happy on June 20, 2011, 10:36:22 AM In any case, those accounts are now known to be used by people who are unaware of the importance of having strong passwords. It's not unreasonable to think that the user whose password was "qwertyABC" is going to use a weak password again. So what? If the old account actually comes back, then their new (weak) password will be protected by the improved code and much harder to crack. No online site is able to stop dummies from using a lame password. Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: Cluster2k on June 20, 2011, 10:40:47 AM "love" "sex" "secret" and "god" do not appear anywhere in those passwords. Hackers lied to me. Did Mt Gox go down because they haxxored the Gibson? I bet the hacker used PCI. Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: kjj on June 20, 2011, 11:19:00 AM Here is a list of the first few thousand passwords. http://pastebin.com/r3hYJYLa The first 3000 are apparently using straight md5 with no salt, so they are fairly easy to crack If you appear on that list, please take appropriate precaution. Odd. That appears to be 361 passwords, out of the roughly 1700 that were unsalted. That is an order of magnitude away from your claim of 3000, but let us put that aside for the moment. The more interesting thing is that roughly 80% of the weakly hashed passwords have not yet been cracked, even in today's world of giant rainbow tables and precomputed MD5 databases. Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: freetx on June 20, 2011, 12:17:03 PM Odd. That appears to be 361 passwords, out of the roughly 1700 that were unsalted. That is an order of magnitude away from your claim of 3000, but let us put that aside for the moment. The more interesting thing is that roughly 80% of the weakly hashed passwords have not yet been cracked, even in today's world of giant rainbow tables and precomputed MD5 databases. Meant first 3000 usernames. Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: airdata on June 20, 2011, 01:28:43 PM "love" "sex" "secret" and "god" do not appear anywhere in those passwords. Hackers lied to me. I saw one guy in the list who used ' assrape '. Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: tymothy on June 20, 2011, 01:32:57 PM A lot of these people may have signed up just to see the user interface and used a really weak password that they'll remember even if they don't come back to the site for ages, like 123456. I do that a lot. Hopefully they don't do that on sites with personal information or finances!
Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: BCEmporium on June 20, 2011, 01:56:15 PM I'm one of those easy pickings, in a an account I don't use for ages (and actually had forgot the username, so I opened another one later on).
Lucky me, my ex-girlfriend managed to hack an old email account where I used the same weak password. Just when you believe there's no use for ex-girlfriends, uh? ;D Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: barbarousrelic on June 20, 2011, 04:11:21 PM If your password is a non-dictionary string of seemingly random alphanumerics, how is it possible that someone could brute force your hash into a password? Arent there a great number of alphanumeric strings that can be hashed into a given hash?
Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: anewbie on June 20, 2011, 04:25:44 PM I've not read through all the various threads to see if this has been posted here before, but I imagine that users of this forum would be capable of doing this:
http://mytechencounters.wordpress.com/2011/04/03/gpu-password-cracking-crack-a-windows-password-using-a-graphic-card/ Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: ZEB-DEMON on June 21, 2011, 10:17:24 AM https://uloadr.com/u/CF.txt "Gabushim:masterhacker" looooooooool masterhackered! xD Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: Bezza on June 21, 2011, 10:32:06 AM "jasper:jasper"
Come on Jasper get it together! Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: saqwe on June 28, 2011, 02:53:26 PM "jasper:jasper" Come on Jasper get it together! yeah fuck you jasper another mtgox-spam(twice): From: Jasper <Jasper@gmail.com> Hello, I've found an aweomse opportunity to invest our bitcoin safely. Based on a HYIP concept BitHyip offer upto 150% in return after 5 days. They also provide a daily profit plan ! Please use my referal link to signup. Email me back and i will send my referal bonus to you ! http://www.bithyip.com/?ref=jasper Talk to your friends about this awesome news ! Jasper. Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: BCEmporium on June 29, 2011, 08:34:22 PM Phishing now:
FROM: contact@bitcoin-mining-accelerator.com Hi there, we'd like to invite you to be a beta tester of our awesome new Bitcoin Mining Accelerator program called "Coin Miner". We have been keeping it under wraps developing it for the past few months and are ready to get people to test it out. Basically how it works is that it automatically safely software overclocks your GPU to a stable level for optimum mining performance. This way you don't have to fiddle with BIOS overclocks, MSI Afterburner or any other overclocking software - this does it automatically on the fly. We are currently achieving around a 23% increase in Mhash/s mining speed. Some users have seen even higher gains. (...phishing url follows in the content...) EDIT: How about we create a "My Email was at MtGox's Database Club" at Facebook for exchange spam?... ::) Meanwhile, hacking attempt @ BCM from someone using a Tor exit node Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: BitcoinPorn on June 29, 2011, 08:38:21 PM Phishing now: FROM: contact@bitcoin-mining-accelerator.com (...phishing url follows in the content...) EDIT: How about we create a "My Email was at MtGox's Database Club" at Facebook for exchange spam?... ::) I would look to this http://forum.bitcoin.org/index.php?topic=24437.0 for updates on that specific email. Interesting stuff. Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: elk-tamer on June 29, 2011, 08:41:10 PM "love" "sex" "secret" and "god" Is there anyway to arrange those words that doesn't come out sounding like a Monster Magnet lyric?Title: Re: It look less than 10 seconds to crack more than 300 accounts Post by: BCEmporium on June 29, 2011, 08:54:52 PM I would look to this http://forum.bitcoin.org/index.php?topic=24437.0 for updates on that specific email. Interesting stuff. But the url is formatted as: <a href="something else.org">http://www.Bitcoin-Mining-Accelerator.com</a> So we've a phishing scam about a software scam... 2-in-1... WTG! |