10 Days to crack 11 Million Ashley Madison hashed passwords

Ashley Madison – A group of hackers which calls itself CynoSure Prime has cracked more than 11 Million hashed passwords protected with Bcrypt. How?

Last month hackers breached the popular adultery website Ashley Madison and leaked online a dump containing data belonging to 37 Million users, including 37 Million of encrypted password.

News of the day is that a group of hackers which calls itself CynoSure Prime, has cracked more than 11 Million user hashed passwords just in the past 10 days.

The hashed passwords were protected by the cryptographic algorithm Bcrypt, the algorithm implements “salting” of the hashed password to protect them against rainbow table attacks.

“The bcrypt is an adaptive function: over time, the iteration count can be increased to make it slower, so it remains resistant to brute-force search attacks even with increasing computation power.” explains Wikipedia. The Bcrypt function is the default password hash algorithm for many OS, including BSD and some Linux distributions.

How does the team crack the hashed passwords?

The team has analyzed the dump leaked online by the attackers and it has discovered a security issued in the login tokens used by the website.

The flaw, which included users’ hashed passwords, the source code of the website and executive e-mails, is related to the use of the weak MD5 hashing algorithm.

Basically, the experts reviewed the code and identified a couple of functions that could be exploited to accelerate the cracking of the hashed password.

“We identified two functions of interest and upon closer inspection, discovered that we could exploit these functions as helpers in accelerating the cracking of the bcrypt hashes.”

The idea behind the attack is to bruteforce the MD5 tokens of Ashley Madison accounts instead trying to crack the Bcrypt algorithm.

Through the two insecure methods of $logkinkey generation observed in two different functions, we were able to gain enormous speed boosts in cracking the bcrypt hashed passwords. Instead of cracking the slow bcrypt hashes directly, which is the hot topic at the moment, we took a more efficient approach and simply attacked the md5(lc($username).”::”.lc($pass)) and md5(lc($username).”::”.lc($pass).”:”.lc($email).”:73@^bhhs&#@&^@8@*$”) tokens instead. Having cracked the token, we simply then had to case correct it against its bcrypt counterpart.
The $loginkey variable seemed to be used for automatic login, but we didn’t spend much time investigating further. It was generated upon user account creation and was re-generated when the user modified their account details including username, password and email address.”

By adopting this strategy, the Password Cracking team obtained 11.2 Million passwords in clear. As explained by the researchers, the process could be applied only for a portion of the accounts because the MD5 hashing algorithm was only introduced on June 2012.

The experts estimated that nearly 15 million Ashley Madison accounts could be compromised with this technique.

Ashley Madison users urge to change their password now, taking care to change it if they used the same login credentials on other websites.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Password craking, hacking)

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.