Free Rainbow Tables Looking For New Admin

lee writes "After almost three years online, the admin of Free Rainbow Tables has decided to call it a day, citing a lack of time to keep it running. (I'm sure that you all know a rainbow table is essentially a giant list of precomputed hashes.) This is a shame, as the site is a useful resource for those occasions when you really need an existing password exposed, rather than simply changing it. I'm a Windows admin, and this site has come in very handy in the past. The currently computed tables weigh in at well over half a terabyte, are available as torrents from the site, or from a couple of mirrors (and alternatives are available). When the site was active, it featured a downloadable BOINC client to put your idle cycles to work computing ever-greater tables, and a space-saving format for storing the tables. The admin is willing to hand over source code if you wish to take over, though I suspect hosting is not included!"

Comments

You know you're hungry when

[goobermaster]

The headline 'Free Rainbow Tables' makes you immediately think of a table covered in Skittles

Re:You know you're hungry when

[mycologistica]

wish i could mod this 'tasty'

Re:You know you're hungry when

[Em Emalb]

think of a table covered in Skittles

Billy Mays here for Free Rainbow Tables dotcom. Have you ever needed a giant list of pre-computed hashes? Have you ever forgotten the password to that old Linux box sitting in the corner of the accounting department's coat closet? Then have I got just the thing for you! All you need to do is, and this part's amazing, is go to freerainbowtables.com, that's freerainbowtables.com, enter your hash-string, and voila, there's your password. It's so easy, a paraplegic blind deaf-mute could do it. That's Freerainbowtables.com.

I'm Billy Mays, and I say, if you don't use this product, the 5th spawn of the Great Satan himself will come to your house and rape your cat....a lot.

Re:You know you're hungry when

[Chyeld]

Billy Mayes didn't yell. It seemed like it because, just like Chuck Norris, when he spoke the rest of the world knew the STFU.

Support is pending

[192939495969798999]

I am sure that plenty of groups that may "need an existing password exposed" are interested in anonymously donating hosting for this project.

Re:Support is pending

[nametaken]

Or pay-for-download and/or pay-for-lookup service, and keep the site online.

Re:Support is pending

[CarpetShark]

I am sure that plenty of groups...are interested in anonymously donating hosting for this project.

You think? Personally, I think you'd have to be a glutton for punishment, to want to admin a site for people interested in rainbow tables.

Reading Rainbow Tables

[MoldySpore]

Buy the domain, contact LeVar Burton to help promote it, and post video testimonials on how great they work.

LeVar: "Crack passwords now! But you don't have to take my word for it..." *dun dun dunnn!*

Re:OMG is that annoying...

[Shikaku]

News for Nerds.

Re:OMG is that annoying...

[baka_toroi]

Shikaku wa sora, shikaku wa hiroi

Salts?

[Sir_Lewk]

I thought the prevelance of using salts with hashes obsoleted rainbow tables years ago.

Re:Salts?

[six]

Once you've reverted the hash back to salt+plaintext, it's *much* easier to remove the salt (often some string concatenated with the plaintext).

Re:Salts?

[l0b0]

Using salts with hashes obsoleted rainbow tables years ago (if you know what you're doing).

There, corrected it for you.

Re:Salts?

[RiotingPacifist]

The site host/cracked NTLM LM MD5

NTLM is still used in the following situations:
* The client is authenticating to a server using an IP address.
* The client is authenticating to a server that belongs to a different Active Directory forest, or doesn't belong to a domain.
* No Active Directory domain exists (commonly referred to as "workgroup" or "peer-to-peer").
* Where a firewall would otherwise restrict the ports required by Kerberos (of which there are quite a few)

So kids getting their teeth wet on home networks, which probably explains why its not being supported. MD5 is still used by applications that arn't quite sure what they are doing/can't do much more e.g grub, im clients, etc.

Lookup tables are still useful in cracking WPA

Re:Salts?

[zindorsky]

I thought the prevelance of using salts with hashes obsoleted rainbow tables years ago.

True. Correctly salting your password hashes will make rainbow tables useless.

But ... Guess which system still doesn't salt passwords? Windows!

Re:Salts?

[zindorsky]

Once you've reverted the hash back to salt+plaintext, it's *much* easier to remove the salt (often some string concatenated with the plaintext).

Often? That's the definition of salt.

Also, rainbow tables don't revert the hash back to salt+plaintext. Rainbow Tables don't work if salt was (correctly) used. Well, I guess you could make a set of RTs for every possible salt value ... if you have an ice age or two to wait.

Re:OMG is that annoying...

[RiotingPacifist]

Because slashdot used to be a site for geeks, however recently anytime somebody uses a simple TLA/ETLA people start bitching that they don't know what it meant and they are too lazy to google and/or wikipeida it, so instead you get a stupid thread full of people who have !RTFA commenting on a subject that is of no interest to them, if it was they would have understood the TLA in TFS, this really annoys the few geeks that actually RTFA as it dilutes the comments. As a TFS contains redundant information to prevent people going "what are rainbow tables?", lets be honest if you're the kind of geek that has ever done any 'cracking' you knew what it mean, if you're not then you don't care.

p.s irony of this post not lost on me!

Only MD5/LM/NTLM?

[AmiMoJo]

I was expecting more tables than just MD5 and two types of Windows passwords. You can already download the Ophcrack DVD to do Windows passwords with rainbow tables.

Renderlab offer wifi WPA rainbow tables: http://www.renderlab.net/projects/WPA-tables/ . I hope whoever takes over takes note of projects like that, and tries to expand the range of tables available.

why Rainbow Tables when there is KonBoot?

[sammyF70]

If you need a password to access an account in windows (or linux for that matter), just use Kon-boot instead of messing around with rainbow tables.

Re:why Rainbow Tables when there is KonBoot?

[Rich0]

I can't imagine that a tool like this would allow you to authenticate to the domain controller. Cracking the hash cached on the local system would.

Unless windows is so insecure that the domain controller just takes the local workstation's word that you successfully logged in. I can't imagine such a design lasting this long. If it did you could get the machine's key off the local hard drive and then authenticate as anybody over the network.

Re:why Rainbow Tables when there is KonBoot?

[silent_artichoke]

The local machine caches the credentials. We see this with laptop users. They have to be connected to the network here to log on the first time, then they can take it home and log in just fine without a network connection. If they change their password on their work desktop, the laptop still uses the old one until they try to log into the account again while connected to the network. So, the domain controller does not take the local machine's word for it, but the local machine does not necessarily check in with the domain controller.

Re:why Rainbow Tables when there is KonBoot?

[querist]

Granted, EFS (Encrypted File System - the "encrypt" option on NTFS) isn't the greatest, but it's there, it's included with Windows (and thus, perceived as "free as in beer"), and people use it.

Kon-Boot will grant you access to the account, but not to anything that the user encrypted using EFS. I have just tested this today to be sure before posting.

That is one reason why people would want to know the current password rather than just bypass the password, though Kon-Boot certainly still has its uses.

Re:OMG is that annoying...

[Obfuscant]

lets be honest if you're the kind of geek that has ever done any 'cracking' you knew what it mean, if you're not then you don't care.

Let's be honest, I'm a kind of geek that has done cracking, but I don't devote my life to it. I've never heard the term "rainbow table" applied to the lists of precomputed hashes, so it was nice to have a simple hint that said "precomputed hashes", and I do care.

Whoops

[neokushan]

Slashdotting the site really isn't helping to keep it online.

rainbow table?

[spottedkangaroo]

I'm sure a huge precomputed hash database is handy and everything, but are we sure that's what a rainbow table is? I tried very hard to make sense of the Oechslin paper on rainbow attacks and it doesn't mention anything about pre-computing individual hashes. It's about reconstructing cipher chains (or something like that). Perhaps the term has just become diluted over the years. Seems wrong to me.