Scribd hacked – emails and hashed passwords leaked • Hacker News Board

Re: Scribd hacked – emails and hashed passwords leaked

#61

Post by josephlord » Fri, Apr 05, 2013, 1:43 AM UTC

smartwater wrote: post #47

windsurfer wrote: post #46

Earlier quoted context omitted.

Excuse me for my ignorance if incorrect, but if a unique salt is used for each user, and the salts were not compromised, would it then not be possible for the passwords to be cracked no matter what encryption is used?

Unique salts have to be stored somewhere. A common practice is to just use another piece of information associated with their account. The purpose of a salt is to make various bruteforcing attacks difficult. It doesn't do much if someone has full access to a system.

> Unique salts have to be stored somewhere. A common practice is to just use another piece of information associated with their account. The purpose of a salt is to make various bruteforcing attacks difficult.

All absolutely true.

> It doesn't do much if someone has full access to a system.

Not true. Without salt they can try passwords and if the hash matches ANY in the system they know the password for those accounts. With a big dictionary of likely passwords (or just normal words) many passwords will be discovered very quickly.

With salt you have to try the password dictionary against EACH user (actually each salt value but they should be unique). This makes discovering passwords harder by a factor of the number of users. Yes you can pick any user and run the dictionary and have a good chance of finding the password but you have to expend large computing resource for little reward (possibly worth it to break a bank account but not the average web app).

Re: Scribd hacked – emails and hashed passwords leaked

#62

Post by cheald » Fri, Apr 05, 2013, 2:11 AM UTC

danbruc wrote: post #48

psycr wrote: post #2

Every single time this happens, I immediately wonder: "what was the hashing scheme?" Like many others before it, Scribd disappoints by not addressing this question. Instead we get this: Even though this information was accessed, the passwords stored by Scribd are encrypted (in technical terms, they are salted and hashed). How long was the salt? AFIK, MD5 hashes with an insufficiently long salt can be bruteforced with…

»What hashing scheme do you use?« does not matter for most users. Most users use weak passwords and a substantial part of this passwords is easy to recover using a dictionary attack. It does not really matter if you use MD5, SHA1, SHA2, HMAC, PBKDF2, bcrypt, scrypt or whatever, nor does it matter if you use no salt, the same salt for all users or a unique salt per user. Even for PBKDF2, bcrypt and scypt the cost fact…

Using an in-code secret key (as opposed to the not-secret-by-necessity salt) is commonly referred to as a pepper. It improves security in the cases when an attacker has access to your database but not to your code or filesystem.

Figuring out the hashing scheme used for a given hash is frequently trivial. All an attacker needs to do is hijack his own hashed password and salt and then run combinations of common hashes with salting patterns until he gets a hit. This is going to be hundreds of combinations to test on the high end, and will generally yield results very easily.

Re: Scribd hacked – emails and hashed passwords leaked

#63

Post by shabble » Fri, Apr 05, 2013, 3:53 AM UTC

SkyMarshal wrote: post #43

jasonlotito wrote: post #37

Earlier quoted context omitted.

Why? Honestly asking: what difference does this have on the end result? Now that you know they are using scrypt, how will that impact your actions? You could say that this has a bearing on whether you continue to use the service, but if that were the case, wouldn't it be better to suggest that all services provide this information up front?

>Now that you know they are using scrypt, how will that impact your actions? For one, I'm much less annoyed/pissed off at them now that I know they use scrypt. I'm not about to cancel my account and never use them again. And I'm not freaking out about whether my email and password have been added to a botnet cracking script running against every other website out there. I've gotten so accustomed to hearing of compani…

If I'm understanding kpumuk's comment elsewhere in the thread[1], if you got notified/test positive on their check page[2], then you are at risk if you've reused those credentials, since they were grandfathered hashes with weak protection.

> [...] but small amount of account records have had passwords encrypted with outdated algorithm (basically SHA1 + salt), so we preemptively reset their passwords and sent out emails to all affected users.

> This is how we define "compromised" - people which had their passwords hash with old algorithm, which is relatively easy to crack.

I came up positive on the check, which does make sense since i signed up a long time ago and don't often/ever sign in generally, so they wouldn't have had the opportunity to upgrade my hash after moving to better schemes.

Happily it was a 1-tiem/throwaway password though, but bit scary that it's the first list (that I'm aware of) I'm actually on.

[1] https://news.ycombinator.com/item?id=5493536

[2] http://www.scribd.com/password/check

Re: Scribd hacked – emails and hashed passwords leaked

#64

Post by shabble » Fri, Apr 05, 2013, 4:02 AM UTC

gingerlime wrote: post #51

I received this email, but it landed in my spam folder as suspected phishing... Be careful with this message. Similar messages have been used to steal people's personal information. Unless you trust the sender, don't click on links or reply with personal information. I thought this was the hackers that got my email off scribd trying to phish my password.

That was my immediate reaction upon seeing it as well, although in this case I noticed that it was sent to me+scribd@example.com, which was indeed the mail that I signed up with. Whilst it's mostly useful for filtering/labelling or figuring out which company sold you to a spam list, it's quite useful in this case as a basic 'yep, not just a scattershot phishing attempt' indicator.

Not foolproof, of course; the people who stole hashes & emails would be the obvious choice to attempt a quick phish, and they now have all the account emails. I wonder if I'll see an uptick in spam...

Re: Scribd hacked – emails and hashed passwords leaked

#65

Post by A1kmm » Fri, Apr 05, 2013, 4:37 AM UTC

kpumuk wrote: post #5

psycr wrote: post #2

Every single time this happens, I immediately wonder: "what was the hashing scheme?" Like many others before it, Scribd disappoints by not addressing this question. Instead we get this: Even though this information was accessed, the passwords stored by Scribd are encrypted (in technical terms, they are salted and hashed). How long was the salt? AFIK, MD5 hashes with an insufficiently long salt can be bruteforced with…

We use scrypt for passwords hashing. This is modern hard to crack password hashing algorithm. We do have database access logs, so it was pretty straightforward to identify which users were affected.

Can I suggest you also share what parameters you use with scrypt? Scrypt is parametric and you can choose weak or strong choices for parameters depending on how long you want to spend validating passwords.

Re: Scribd hacked – emails and hashed passwords leaked

#66

Post by pixelcort » Fri, Apr 05, 2013, 6:18 AM UTC

kpumuk wrote: post #11

MattBearman wrote: post #7

Earlier quoted context omitted.

Thanks for clarifying, good to see you're using a decent hashing algorithm :) I'm still a little unsure of how you are able to know some users had their password compromised. Is it a simple case of finding successful log in attempts from the same IP address as attack?

Compromised != Hacked. To clarify: no accounts were accessed by the hackers, but small amount of account records have had passwords encrypted with outdated algorithm (basically SHA1 + salt), so we preemptively reset their passwords and sent out emails to all affected users. This is how we define "compromised" - people which had their passwords hash with old algorithm, which is relatively easy to crack.

For the future, I wonder how useful it would be to run old hashed passwords through a newer system such as scrypt. This way those users who haven't logged in in awhile could also benefit from the safer hashed passwords.

    scrypt(hmac_sha1(password, salt), salt, cpumemargs)

In the future, you could even do it again with more cpu and memory requirements for scrypt, upgrading older users' hashes again with another run of scrypt.

Re: Scribd hacked – emails and hashed passwords leaked

#67

Post by icebraining » Fri, Apr 05, 2013, 9:49 AM UTC

beachstartup wrote: post #59

harshreality wrote: post #55

Earlier quoted context omitted.

Salts make cracking a list of N password hashes take roughly N times as long, but if a password is cracked anyway (because it's common and/or because the hash is not using very many rounds, or because an attacker only cares about one particular account), and the password is reused elsewhere, the fact that it was salted doesn't matter anymore. GP is right; if owners of the leaked accounts [email, hash] pairs are reusi…

yeah if you simply know what a password is, of course it's compromised, but you're not supposed to easily break a salted hashed password.

Salts only really protect against rainbow tables; if the attacker is willing to use a dictionary or brute force attack against a single password, they're not of much use.

Re: Scribd hacked – emails and hashed passwords leaked

#68

Post by gingerlime » Fri, Apr 05, 2013, 5:29 PM UTC

shabble wrote: post #64

gingerlime wrote: post #51

I received this email, but it landed in my spam folder as suspected phishing... Be careful with this message. Similar messages have been used to steal people's personal information. Unless you trust the sender, don't click on links or reply with personal information. I thought this was the hackers that got my email off scribd trying to phish my password.

That was my immediate reaction upon seeing it as well, although in this case I noticed that it was sent to me+scribd@example.com, which was indeed the mail that I signed up with. Whilst it's mostly useful for filtering/labelling or figuring out which company sold you to a spam list, it's quite useful in this case as a basic 'yep, not just a scattershot phishing attempt' indicator. Not foolproof, of course; the people…

hehe, same here. My email address was completely randomized, and only used for scribd too (something like f9xl203js@mydomain.com), so I was very sure it was either scribd, or it fell into the wrong hands. When the email ends up in the spam folder and mark as potential phishing as well - my gut feeling was therefore that my email was indeed leaked.

The irony is that the email itself was generated by scribd itself, and not by any spammers.

Re: Scribd hacked – emails and hashed passwords leaked

#69

Post by jervisfm » Fri, Apr 05, 2013, 6:16 PM UTC

danbruc wrote: post #48

psycr wrote: post #2

Every single time this happens, I immediately wonder: "what was the hashing scheme?" Like many others before it, Scribd disappoints by not addressing this question. Instead we get this: Even though this information was accessed, the passwords stored by Scribd are encrypted (in technical terms, they are salted and hashed). How long was the salt? AFIK, MD5 hashes with an insufficiently long salt can be bruteforced with…

»What hashing scheme do you use?« does not matter for most users. Most users use weak passwords and a substantial part of this passwords is easy to recover using a dictionary attack. It does not really matter if you use MD5, SHA1, SHA2, HMAC, PBKDF2, bcrypt, scrypt or whatever, nor does it matter if you use no salt, the same salt for all users or a unique salt per user. Even for PBKDF2, bcrypt and scypt the cost fact…

> It does not really matter if you use ... a unique salt per user.

I agree with the other points that you make on this aspect but I do not quite understand this particular point (quoted above) can be true. If you use a strong unique salt for each user's password, then you are padding the length of actual password hashed and thereby effectively reducing the possibility of a successful dictionary attack to virtually zero. If this is so, then how could one mount a successful dictionary attack ?

Re: Scribd hacked – emails and hashed passwords leaked

#70

Post by danbruc » Fri, Apr 05, 2013, 10:55 PM UTC

jervisfm wrote: post #69

danbruc wrote: post #48

Earlier quoted context omitted.

»What hashing scheme do you use?« does not matter for most users. Most users use weak passwords and a substantial part of this passwords is easy to recover using a dictionary attack. It does not really matter if you use MD5, SHA1, SHA2, HMAC, PBKDF2, bcrypt, scrypt or whatever, nor does it matter if you use no salt, the same salt for all users or a unique salt per user. Even for PBKDF2, bcrypt and scypt the cost fact…

> It does not really matter if you use ... a unique salt per user. I agree with the other points that you make on this aspect but I do not quite understand this particular point (quoted above) can be true. If you use a strong unique salt for each user's password, then you are padding the length of actual password hashed and thereby effectively reducing the possibility of a successful dictionary attack to virtually ze…

It is common to store per user salts together with the hashes, often even as a single string formed by concatenating the salt and the hash. Therefore getting hold of the hashes usually means getting hold of the slats, too.

But the other case I mentioned - using the same salt buried deep in your code for all users (what is called a pepper as I learned recently) - will do what you describe until the attacker is able to figure out the pepper used by either stealing the code or brute forcing it.

Finally note that just using a pepper is no good idea and even when combined with a salt needs some careful thoughts. Just using a pepper will yield equal hashes for equal passwords while using a unique per user salt will avoided this. The other problem is that with a pepper you are reusing the same secret for each user. Therefore an attacker has thousands or even millions of samples and may be able to extract information if the scheme is not designed carefully. Combining password, salt and pepper must essentially avoid the same pitfalls as keyed hash functions when combining the key and the message. See for example the design principles behind HMAC [1].

[1] http://en.wikipedia.org/wiki/Hash-based_message_authenticati...