Slashdot Mirror
Online MD5 Cracking Service
toast writes "Did you forget your password but have your /etc/shadow? If so, this site is for you. Submit a MD5 hash and within a few days you'll have an answer. Of course, once Slashdot has its way, you'll have to wait a few years for an answer.. At least now I'll always know what f3789b3c1be47758203f9e8a4d8c6a2a means.."
on page 2 when results are 500, you'll find
;)
"f3789b3c1be47758203f9e8a4d8c6a2a" = "goatse"
So stop submitting it!
Pardon me for actually checking out the site. It seems as though you don't submit an entire shadow file after all. Only the hash of the password.
http://www.rootstrikers.org/
"At the moment we can crack md5 hashes in this character range: a-z;0-9 [8] which means we can break almost all hashes (99.56%) which are created from lowercase plaintext with letters and/or digits up to length of 8 characters." (Emphasis mine)
If your password is under 8 characters and contains only lowercase letters and digits, you deserve to be cracked.
If you use a proper password, then you have nothing to fear from this "service"
This is probably obvious, but you can verify it using:
$ echo -n goatse | md5sum
f3789b3c1be47758203f9e8a4d8c6a2a -
So parent is right.
Just so that its clear, they haven't broken MD5 in the cryptographic sense; they're merely using the fact that the 8 character password space is small enough if you are restricted to lowercase alphabets and numbers (about 3*10^12) to run the whole thing through a brute force search. The nice thing is that they precompute all the plaintext-ciphertext pairs, which means that the actual cracking step is simply a lookup. Lookup can be greatly speeded up if you're looking up lots of things at once, so the /. effect is a very good thing for them, throughput-wise :-)
You are mistaken, sir. A combo that produces the same hash is indeed the right answer.
This is something most people never think about. You actually could have several passwds that work for a given account...anything that hashes to the same thing is a working passwd.
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
As long as you aren't using passwords that are straight out of the dictionary (this is like 3rd grade people) you should be fine even with something like this being available. I suggest quit using passwords, and use passphrases instead. Someone MD5ing phrases will have to look for months not days.. Change your passphrase like every three months and you'll never have a thing to worry about. The only problem is that md5 has a pretty limited key space and "foo" might equal "TheLastStand" so someone may come up with an equivalent key. Regardless, md5 is designed to keep people from being able to easily come up with these passwords or alter a file it is not designed to keep people off of your computer and it is still much better than crypt. Being able to reverse an md5sum isn't going to get someone on your system that hasn't already got in. Make sure root cannot log on to your box and a user cannot su without being in wheel so if someone does crack the md5 they have no hope of getting any more rights than they already have. Configure a script to run to alert you right away if someone attempts to su but gets canned because of not being in the wheel group. Really stuff unix people should have been doing all along
Remember: Don't Panic!
-Mind
It is a time-memory tradeoff. They come up with a "reduction function" R, which maps hashes into keys. It is not a reversal of the md5 algorithm, it just generates some key based on the hash. Then they create sequences of hash, key, hash, key, hash, key... with each key being the reduction function applied to the previous hash, and each hash being the hash function applied to the previous key. They stop their sequences when they reach "distinguished values," which may e.g. have 0's for the first 12 bits. Then they store the start and endpoints of the sequence.
So now they have a list of start and endpoints for these chains of hashes and keys. To crack a hash, they apply the same process to it - reduction function, hash, reduction function, hash, until they reach a value that is in their table of endpoints. Then they begin at the startpoint associated with that endpoint, and regenerate the sequence up to the hash they're trying to crack. Since the key directly before that hash hashes to that hash, they've successfully cracked the hash.
The "rainbow" refers to the recent innovation of using a different reduction function for each step of the sequence, i.e. using R1 on the first hash, R2 on the second, etc. This means that, even if two sequences contain the same hash, they probably won't be exactly the same after that - a significant problem with the older method of having a single reduction function.
If you want to read about this in more detail with math symbols and such, the pdf is linked from the site.
The "salt" is used to change how the password is hashed. If you look at the shadow password file on your computer, you'll see some lines that look like this
root:$1$abcdefge$abcd1234efg789hijklmno:0:0:...
You'll notice that the password field (the stuff after the 1st colon, and before the 2nd colon) is itself divided into 3 fields separated by dollar signs. The purpose of these fields are:
1st field - Identifies hashing method. This allows for future changes to how the password in stored while allowing backward compatability with existing passwords.
2nd field - This contains the salt used to hash the password. In order to verify a new password, this exact salt must be used in the hashing process. Since in this case, it's 8 characters long and each character can be one of 64 values, it means that each possible password my be hashed into one of 2^48 different values. This salt is generated randomly at the time that you set your password. The randomly generated salt is then stored here for use in verifying future authencation attempts.
3rd field - This is the actual hashed password using the salt specified in the previous field. It is 22 characters long, which with base 64 encoding can store 132 bits. Since MD5 only hashes to 128 bits, there are 4 unused bits at the tail end of this value.