What is Digg?Sponsored by Dragon Age: Origins
Can't get enough Dragon Age: Origins? Play the flash game. view!
DragonAgeJourneys.com - Play the free companion flash game to Dragon Age: Origins.
49 Comments
- AcidBath, on 10/12/2007, -0/+10FTA: "Until now, the terabytes of storage needed to write the tables haven't been available. "
While you can have tables that big and some people are making them that big and larger, a table of 3 GB or so in size is usually enough to crack most of the shorter hashes.
And in case anyone missed it last time it hit Digg:
http://www.md5lookup.com/?category=main&page=search
A 1.6 TB table on the web with a MySQL backend - LordSkywalker, on 10/12/2007, -3/+12abc123
- OfARevolution23, on 10/12/2007, -2/+10Your forgot love, secret, sex and god.
- Qazzian, on 10/12/2007, -0/+7I used to work somewhere that advised you store all your passwords in one word document and then use MS encryption to protect them. I laughed at the instructor when they said it.
- inactive, on 10/12/2007, -2/+8Why would you use word to encrypt something that important in the first place? :P
- AcidBath, on 10/12/2007, -0/+4"And it only really works if you only do a single pass of the hash, avoid using salt characters, hash only the password string, disobeying pretty much any book you care to name on the topic."
And that is why stuff like this works. Because 99% of users didn't read the book. Hell, they didn't even go to the library. - Snakedal337, on 10/12/2007, -3/+7I can crack any none-geek password. It's easy.
"password"
or
"123456..."
whatever the minimum char requirement is - sporkwitch, on 10/12/2007, -0/+4Rainbow tables have been in active use for several years now. One of the very first episodes of SploitCast even talked about Rainbow Crack Online, a site that hosts something like 7TB (last I heard) of tables and started off as a guy and his buddy saying, "let's start storing these and share them" and now they charge for use of their tables.
Marked as innacurate, as this is hardly recent. - netdroid9, on 10/12/2007, -3/+7Depends on what your cracking and where it's from. If you have physical access to, say, a company server, you could copy a word document containing trade secrets or the like and decrypt it at a later date.
For the most part this is probably Proof of Concept though. - chris9902, on 10/12/2007, -4/+7that's great and all but the sort of people who have stuff worth hacking aren't the sort of people who use Windows password, you know.
- calorifer, on 10/12/2007, -1/+4some people use windows as routers and servers, don't underestimate the trust people have in windows
- kozie, on 10/12/2007, -1/+4It's not 1996 anymore... people are, on average, 49% lazier.
- sporkwitch, on 10/12/2007, -1/+3"Will Her Holiness be so kind as to change her password?"
- grumpyrain, on 10/12/2007, -0/+1It is indeed brute force by another name, the main difference is that once you work out that 'ABC' maps to 'DEF, you store that fact in a database with an index on the results. Then at a later stage, you may query the database saying that I have the hash 'DEF', what strings could have generated it. You can then try a dictionary attack using that significantly smaller subset of possibilities.
The point the article was attempting to make is that in the past the idea that you could compute and store such a database was not feasible because of the price of the required storage. Now that storage is cheaper.
But the implementation is nothing new. There have been reverse lookup tables for donkeys ages, generally restricted to a dictionary of common words and patterns. - SatanicPengiuns, on 10/12/2007, -0/+1abc123
qwerty
football
baseball
blowme
blue123
diamond
cocacola
Charon
C-Force
Bruteforce
= Free pr0n passwords f0e life. - grumpyrain, on 10/12/2007, -0/+1I am pleased that someone has finally bothered to comment. One thing I hate about Digg is that too many folk simply mod down without giving a argument to counter the point they object to.
@Acid Bath
I totally agree that most people do not read the book, and unfortunately (as SuperCow points out), it is actually the developers who could have prevented it by not using a straight public hashing function on the text and by enforcing a minimum password length and complexity (or at the very least generate a warning that this password is easy to crack).
@opello
You are right to say that collisions occur. According to information theory, there is a minimum amount of space that is required to store a piece of data (a ceiling to lossless compression for a given piece of data). So by definition, if you have an infinite number of strings that you need to hash into a fixed length string. Not only is that a many to one mapping but also an infinite to one mapping. Or in english, for every hash there is an infinite number of binary strings that could have generated that exact hash.
Again, where rainbow tables work is where you simply take the password and use that as a hash. They are not feasible if you need to calculate an entire table for every possible implementation. For example, where salt techniques are used ( http://en.wikipedia.org/wiki/Salt_%28cryptography%29 ), or even extended to not be at a fixed location but rather at a location in the hash determined by the password itself, you would need to generate a new set of tables for each attack. - XSforMe, on 10/12/2007, -0/+1Cracking MS Word passwords? Man, there are easier ways to get access to the content of the document. Just insert the word file into a new word document. Voila!
I know people who would password protect their documents and then forget about the password, they solely depended on this technique to get access to them. Works in Word 2K, I have not tested it in more recent versions. - MrViklund, on 10/12/2007, -0/+1Smart people don't password protect their Word-files, tbh, I have never heard of anyone using the Protection in word. Smart people encrypt their files.
- ddiigggg, on 10/12/2007, -0/+1so you're doing your bit to keep 'em ignorant
- eclectro, on 10/12/2007, -0/+1Maybe smart people will RTFA and chage to 128 bit encoding with 12 chAAARRRacter passwords.
- sporkwitch, on 10/12/2007, -1/+2Ummm, you're saying you've used it to open a passworded file, now you're saying you haven't, which is it? Either test or don't post. At least some people wait till their SECOND post to contradict themselves...
- WorldGroove, on 10/12/2007, -1/+2Where I work.... I found out that the company was emailing around SSNs, bank-routing numbers, salaries *outside* the intranet.... and it was a password-protected Excel file.
Seriously, you don't know how much sensitive data out there is flying around in password-protected MS files. MS would do us a favor if they just stopped offering that feature. Because all it does is lead people into a false sense of security. You can download crackers for all MS-Office files off eMule in 10mins. I keep crackers of MS-Office files on my USB-KeyChain at all times. - Taromsn, on 10/12/2007, -0/+1Please explain...
- wthnow, on 10/12/2007, -2/+3you used to be able just to open word files with an ascii viewer since text wasnt encrypted dunno if will still work today
- SuperCow1127, on 10/12/2007, -0/+1@AcidBath
The problem here is developers, not users.
@opello
The collisions won't be of any help when desiging a rainbow table. In fact, if one were to take collisions into account on a perfect table, many hashes would index several different strings. Remember that the strings are generated first, then the hash. - sporkwitch, on 10/12/2007, -0/+1It is, in a way. But at the same time as it's misleading, it's also not, at the same time. Though it does still take time to generate hashes, because the tables are stored, it's a simple database call to bring up the hash, and then just input its corresponding plain text password. Thus where before you'd have to crack it, now it just takes as long as your database call.
- Exploit, on 10/12/2007, -1/+2Forgive him O Lord. He knows not what he is saying.
- ostracize, on 10/12/2007, -1/+1This is misleading. They claim to hack a word file in mere seconds but in the previous sentence they say it requires a pre-computed table listing. Depending on the password, this could take a long time to "pre-compute"
Sorry but this just sounds like another version of brute force hacking. It just doesn't require live authentication. - .Steven, on 10/12/2007, -1/+1So how do you do it for word and excel?
- data4ensicnerd, on 10/12/2007, -0/+0can this be done with lm hashes or would you need a ms word hash set. help? I always knew of the sites out there that will crack it, but i never knew how they worked the hash sets. how would one do this?
- Jams, on 10/12/2007, -1/+1You also forgot all of the above, but backwards.
"drowssap" etc. - volatileacid, on 10/12/2007, -1/+1If the point isn;t raised here, where is it raised.
Please people, don't be so gullible. It could be that this was promoted to the front page by the digg site crew.
No doubt, i'm glad they did, if they did, was an interesting read. - TritonX, on 10/12/2007, -0/+0In excel sheet you can protect data so that you can`t even copy it, from MS Excel. It`s what I meant, sorry for confusion. I know it`s not exactly the same protection as the password needed to open a file, the point I wanted to make was at how easy it was to bypass that protection by using an other office suite. Digg me as deep as you want if you don`t get it.
- popna, on 10/12/2007, -0/+0Let's hope people smart'en up...
http://www.iwantmyess.com/?p=102 - johnbcm99, on 10/12/2007, -0/+0qwerty
- OmegaNine, on 10/12/2007, -4/+3I think the admins ***** with us and promote a random story to front page just to throw us off ;-P
But this was a good story, got a digg from me. - Smuuv, on 10/12/2007, -1/+0"Your forgot love, secret, sex and god."
Uhhhh, I guess I'd better change my Domain Admin password. - sporkwitch, on 10/12/2007, -3/+2Especially at the corporate level. Unless you're dealing with a security, financial, or just a company with enough tech-savvy people near the top (and even then, not so much in some cases), most will say "hey, it comes with it, why should I buy extra? Not to mention, they take some security from the fact that the laws for prosecuting computer crimes are excessive, to say the least.
Hell, friend of mine just had breakfast with some suits the other day because someone did something and his private shell server was one of the boxes the twerp bounced it off of. Worst part is that even though the kid broke into my friend's shell to bounce it off it, the laws are written in such a way that he could still get charged, not to mention, would you really put it past our current gov to throw some of their own files on there to trump up some charges? They're kinda hurting for "real" terrorists to go after these days.... - opello, on 10/12/2007, -1/+0But not with a hash, as it's a fixed length. You'll hit all possible hash values eventually (foreseeable space and time limits ignored, of course), and still have more strings to use. Enter: Collisions and Type II errors...
- dopyoman, on 10/12/2007, -2/+0What we need then is a different form of encryption even if we use stronger encryption computer technology is just going to get cheaper.
- Exploit, on 10/12/2007, -3/+1Nothing new. I'm surprised it has received 348 diggs, as of now. Shows how ignorant people are regarding to security and hacking/cracking.
Story buried. - OfARevolution23, on 10/12/2007, -3/+1For some business' budgets it's called, "good enough".
- grumpyrain, on 10/12/2007, -3/+1The good old 'we can store a reverse lookup from all the hashes of known combinations' argument. The problem for them is that the longer the key, the exponentially larger it becomes to store the tables, and the exponentially more resource it takes to calculate these tables. In fact for some of the stronger algorithms you would need thousands upon thousands of computers calculating all the possible combinations in a distributed fashion.
And it only really works if you only do a single pass of the hash, avoid using salt characters, hash only the password string, disobeying pretty much any book you care to name on the topic. - OfARevolution23, on 10/12/2007, -12/+8Rainbow tables and memory trade-off is nothing new but applying the technique to words files seems redundant to me. There are better passwords to be cracked than those to word documents. Even if there were anything valuable in those documents, the files themselves would be stored on an encrypted partition, probably off-site.
- cuzican, on 10/12/2007, -5/+1I won't dispute the confusion sometimes, but just have a little faith knowing that a lot of work is going into handling these situations..
Also, I haven't been able to be on digg for the past 10hrs so I am glad that this was still on the front page since it always reminds me that security is not a product it's a process... - Jeffrey903, on 10/12/2007, -7/+2Because it is slightly easier to have word encrypt it then to save it as a normal doc file and encrypt it with TrueCrypt.
- TritonX, on 10/12/2007, -5/+0I`ve used an even easier method to circumvent password protected data inside a Excel sheet. Open it with OpenOffice ;). I`m curious if it works to open passworded files, I`m just too lazy to try now.
- Settra, on 10/12/2007, -15/+8Does it ***** matter? Either digg it or not, who gives a ***** about the circumstances of going to the front page.
- Royal0rleans, on 10/12/2007, -12/+4Digg confuses me sometimes, this has 35 diggs, and was submitted 10 hours ago. NOW it hits front page.
Browsing Digg on your phone just got easier with our enhancements to the 
© Digg Inc. 2009
— Content created and posted by Digg users is