Live data from Hacker News

6.5 Million LinkedIn Password Hashes Leaked

translate.google.com

321–330 of 547 posts

Re: 6.5 Million LinkedIn Password Hashes Leaked

#321

Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…

My password also doesn't appear to be in the list, so I doubt it is the complete/current file. I used this python to check, in case anyone else wants to use it:

    from hashlib import sha1
    f = "combo_not.txt"
    hashes = [x[0:40] for x in open(f)] # [0:40] to stripe off \n

    # From another comment
    def check_pass(plaintext, offset=5):
        hashed = sha1(plaintext).hexdigest()
        return (hashed, '0' * offset + hashed[offset:])

    print check_pass("linkedin")[0] in hashes # -> False
    print check_pass("linkedin")[1] in hashes # -> True (sanity check)

    myHash, myHashBroken = check_pass("plaintextoflinkedinpassword")
    print myHash in hashes # -> False
    print myHashBroken in hashes # -> False

Re: 6.5 Million LinkedIn Password Hashes Leaked

#322
post #31

I know a lot of companies just keep your account including your password in there database while you removed your account. Can I be sure my account was totally removed when I removed my LinkedIn account? Because the "please change your password as soon as possible" won't help me much.

As long as:

1. They do not have a mechanism to resurrect your account and 2. You do not use the same password elsewhere

then it should not matter.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#323

Um, pardon the obvious question, but does someone have a direct link to the hash file?

From a slashdot comment: https://disk.yandex.net/disk/public/?hash=pCAcIfV7wxXCL/YPhO...

I can confirm that my long-lived randomly generated single-use 12-character password hash is in the file, but not 00000-prefixed (apparently not broken).

A more recent 20 character single-use randomly generated password was not, but the file doesn't comprise the full 6.5 million hashes noted in stories.

I've since changed both for rather longer randomly generated single-use passwords.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#324
post #276

Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…

I have found one case where both types are present. grep `echo -n l1nked0ut | shasum | cut -c6-40` combo_not.txt 000000afef5f2ba94b104126d04db1837f423816 e7bf10afef5f2ba94b104126d04db1837f423816

How many hashes are present in both stripped and unstripped form?

  $ cat combo_not.txt |cut -c7-40 |sort |dups |wc -l
  670781
That's ~10% of the total.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#325
post #220

Given they haven't confirmed they've found and closed the leak, is it wise for everyone to be changing their passwords already?

I'm not sure what you're implying. How have they 'closed the leak'? If you find your hash in the list, you should change your password. If you don't, you should change your password. I use LastPass to manage my passwords so I just generated another random 20+ char password and forgot about it.

The point is that LinkedIn haven't even confirmed they know how the passwords were stolen (they haven't even confirmed they were stolen, yet).

In that case, when you change your password and feel all secure again, what's to say the hackers haven't just lifted your new hash as well?

Re: 6.5 Million LinkedIn Password Hashes Leaked

#326

Earlier quoted context omitted.

For the security novices amongst us: I had no idea how to do this so I figured out a quick python script to test it: >>> from hashlib import sha1 >>> def check_pass(plaintext, offset=5): hashed = sha1(plaintext).hexdigest() return (hashed, '0' * offset + hashed[offset:]) >>> check_pass("linkedin") ('7728240c80b6bfd450849405e8500d6d207783b6', '0000040c80b6bfd450849405e8500d6d207783b6') Edit: I'm pretty sure JtR refers…

Obligatory perl one-liner: perl -MDigest::SHA -le '$h = substr( Digest::SHA::sha1_hex($ARGV[0]) , 5 ); open F, " )' password (for people without shells)

Shorter and, IMHO, a bit simpler Perl one-liner:

    perl -MDigest::SHA=sha1_hex -le '$h = substr( sha1_hex(shift), 5 ); open F, "' password
Or:

    perl -MDigest::SHA=sha1_hex -lne 'BEGIN {$pw = shift} $h = substr( sha1_hex($pw), 5 ); print "found $_" if /$h/' password combo_not.txt

Re: 6.5 Million LinkedIn Password Hashes Leaked

#327

Earlier quoted context omitted.

Obligatory shell one-liner: grep `echo -n password | shasum | cut -c6-40` hacked.txt

Prefix the whole command with a space to avoid dumping your password into your bash history: " grep `echo -n yourpassword | shasum | cut -c6-40` SHA1.txt"

Only if HISTCONTROL is assigned 'ignoreboth' or 'ignorespace'.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#328
post #245

Earlier quoted context omitted.

My complex unique password is also on this list (full hash no 5 0's). So nope, not a hoax. Unbelievable/insulting they didn't even bother to salt.

Do you remember when you first used this password at LinkedIn? It could help narrow the dates of the breach. Especially useful would be the presence of a strong password in the list that was subsequently changed. That might help determine its freshness, if the new password isn't present (although this may be an incomplete list from an ongoing breach).

I'm thinking this list is from closer to a year ago, I changed my password shortly after the MtGox hack last year and this hash is for my old password that was compromised during that time period.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#329

Earlier quoted context omitted.

Obligatory shell one-liner: grep `echo -n password | shasum | cut -c6-40` hacked.txt

Here's node.js: $ echo linkedin | xargs node -e "var x = require('crypto').createHash('sha1').update(process.argv[1]).digest('hex'); console.log([x, '00000' + x.substring(5)]);" 7728240c80b6bfd450849405e8500d6d207783b6 0000040c80b6bfd450849405e8500d6d207783b6

Or you could just feed "sha1 " to the duckduckgo.com search box and it will give the result.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#330

Earlier quoted context omitted.

Let's forget about bcrypt for a second. What prevents developers from adding a large DB-wide salt (in addition to normal salt) to every password? Wouldn't that prevent bruteforce attacks regardless of the hashing algorithm?

Random nonces have very little to do with what makes SHA1 insecure and bcrypt secure. Developers have a very weird and totally misplaced faith in the ability of random "salts" to secure passwords.

We're speaking about a very specific attack here: bruteforce. And I'm speaking about a very specific type of "salt" (which could probably be called something else, since it's not the same as normal unique-per-password salt): large, database-wide string of random bytes.

If every password is padded with such a string before hashing, computing the hash would be slower. Obviously, it would be slower because you would have to process more data. An interesting question is whether this would also make it less parallelizable by the virtue of having more information than would fit into GPU cache.

Post reply on HN