6.5 Million LinkedIn Password Hashes Leaked

Post by jlgreco » Wed, Jun 06, 2012, 1:25 PM UTC

jere wrote: post #84

jlgreco wrote: post #67

Earlier quoted context omitted.

To be clear, MD5 (or SHA1 as these apparently are) is a problem. Passwords should be stored using a cryptographic hash function that is designed to hash passwords (read: be slow), not a generic cryptographic hash function (which are designed to be fast ). This is exactly the problem that bcrypt was created to solve (among others).

I think people are missing the point that SHA2 is light years ahead of MD5. MD5 has had known security flaws for years . >Do not use the MD5 algorithm Software developers, Certification Authorities, website owners, and users should avoid using the MD5 algorithm in any capacity. http://www.kb.cert.org/vuls/id/836068 This is from over 3 years ago.

Post by djbender » Wed, Jun 06, 2012, 1:26 PM UTC

pimeys wrote: post #37

mkjones wrote: post #22

Earlier quoted context omitted.

Those just look like hashes - are there usernames / salts somewhere? They do indeed seem to be salted.

No they're not. I tried the following: > irb > require 'digest/sha1' > Digest::SHA1.hexdigest 'my_password' => hash_string Then I searched the file with the hash string and found my password. I really hope they don't also have the usernames somewhere.

Post by leif » Wed, Jun 06, 2012, 1:28 PM UTC

revelation wrote: post #68

madsr wrote: post #58

What riddles me though, is how come 6.5 million? LinkedIn has what, 150M users? Did they not post the entire load (and are in fact sitting on _all_ the hashes?) Is the dump an old backup or breach from when they had fewer accounts? Is it just one DB partition / file that's been lost, an archive?

Given that these hashes are not salted, running a 'uniq' on the list of all users' password hashes would probably already cut it by half, if not more. Then you eliminate all the easy ones from wordlists, and post the remains on the internet for people with excess computing power to bruteforce.

Post by rplnt » Wed, Jun 06, 2012, 1:29 PM UTC

jere wrote: post #89

tazzy531 wrote: post #80

Good Guy Startup Founder would cross reference this password list with their own password system and force those that match to reauthenticate and change their passwords. This wouldn't be difficult to do and your users would appreciate it.

How would one cross-reference this list unless you're storing the plain text passwords?

Post by romaniv » Wed, Jun 06, 2012, 1:30 PM UTC

avar wrote: post #12

judofyr wrote: post #6

> - With a computer of 8,000 NOK (~ 1400 USD), you can do a few hundred million attempts per second. Are you kidding me? LinkedIn stored their passwords using (salted) SHA1 using no iterations? Jesus.

To expand on that, to store passwords don't just use salt+sha1, or try to do your own nested sha1, just use bcrypt: http://en.wikipedia.org/wiki/Bcrypt