10 Days to crack 11 Million Ashley Madison hashed passwords

Ashley Madison – A group of hackers which calls itself CynoSure Prime has cracked more than 11 Million hashed passwords protected with Bcrypt. How?

Last month hackers breached the popular adultery website Ashley Madison and leaked online a dump containing data belonging to 37 Million users, including 37 Million of encrypted password.

News of the day is that a group of hackers which calls itself CynoSure Prime, has cracked more than 11 Million user hashed passwords just in the past 10 days.

The hashed passwords were protected by the cryptographic algorithm Bcrypt, the algorithm implements “salting” of the hashed password to protect them against rainbow table attacks.

How does the team crack the hashed passwords?

The team has analyzed the dump leaked online by the attackers and it has discovered a security issued in the login tokens used by the website.

The flaw, which included users’ hashed passwords, the source code of the website and executive e-mails, is related to the use of the weak MD5 hashing algorithm.

Basically, the experts reviewed the code and identified a couple of functions that could be exploited to accelerate the cracking of the hashed password.

“We identified two functions of interest and upon closer inspection, discovered that we could exploit these functions as helpers in accelerating the cracking of the bcrypt hashes.”

The idea behind the attack is to bruteforce the MD5 tokens of Ashley Madison accounts instead trying to crack the Bcrypt algorithm.

Through the two insecure methods of $logkinkey generation observed in two different functions, we were able to gain enormous speed boosts in cracking the bcrypt hashed passwords. Instead of cracking the slow bcrypt hashes directly, which is the hot topic at the moment, we took a more efficient approach and simply attacked the md5(lc($username).”::”.lc($pass)) and md5(lc($username).”::”.lc($pass).”:”.lc($email).”:73@^bhhs&#@&^@8@*$”)  tokens instead. Having cracked the token, we simply then had to case correct it against its bcrypt counterpart.
The $loginkey variable seemed to be used for automatic login, but we didn’t spend much time investigating further. It was generated upon user account creation and was re-generated when the user modified their account details including username, password and email address.”

By adopting this strategy, the Password Cracking team obtained 11.2 Million passwords in clear. As explained by the researchers, the process could be applied only for a portion of the accounts because the MD5 hashing algorithm was only introduced on June 2012.

The experts estimated that nearly 15 million Ashley Madison accounts could be compromised with this technique.

Ashley Madison users urge to change their password now, taking care to change it if they used the same login credentials on other websites.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Password craking, hacking)

[adrotate banner=”13″]