After reading, change the password! But I bet you'll never see it through.

Hubble News Channel May 30 today Xiao-bian in the fried egg net found a long article, with the player's words "I ... I've never seen anything so long on a fried egg ... In addition to sidebar ads ... ", this article title" User password thin paper ", after you will believe that the world is now some hackers guess the password will try" The Horse Battery Staple (correcthorsebatterystaple). " For details, please make a transcript for 40 minutes to see below.

Password: Staple for horse batteries (correcthorsebatterystaple)

Previously Summary: Maybe you fried egg friends to see the map and this sentence, will be a bit of a Meng. In fact, "on the horse Battery staple" from XFCD published comic book called "Password Strength":

But...... The comic book clearly underestimates the strength of hackers:

This week, the ARS website invited three hackers to hack more than 16,000 hashed passwords-a success rate of 90%! OK, this may be the most smelly egg in the history of the longest article, translation June for the sake of the body of the patience of your friends, first a truncated version of the matter is clear: the hacker told you that your password is not because it stinks and long on the security, but because no one cares about you, so temporarily safe.

Please come to the hacker to test security

--------------------------------------------------------------------

Cough, and then is dedicated to studious egg friends of the text:

March, blogger Nate Anderson, downloaded a side-leak of the Bauku password table, containing more than 16,000 hash of the real password, after the simple training Baidu know, the results only spent about 3 eggs can fry the kung fu, cracked half of the password. This gives everyone a cautionary tale: if an egg friend without any training can reach this level, think about how much a professional hacker can do.

Do not have to self-brain repair, we invite three professional hackers, use all the tricks, to crack Anderson practiced hand of that password table, launched the ultimate PK. You'll see how long passwords, including numbers, capitalization, and punctuation, are quickly broken out.

There are a total of 16,449 hashes (MD5) in this password list. Any responsible website, will not be stored in plaintext password information, but with MD5 encryption, this encryption process is irreversible, that is, even if the MD5 ciphertext, it is impossible to directly "reverse" out of the original text. For example, "passwd" has been hashed, ciphertext is "5f4dcc3b5aa765d61d8327deb882cf99".

Although Anderson's 47% crack rate has been very good, but for professional hackers, still not a problem. To prove this, we invite them to demonstrate, honestly, they didn't disappoint us. Even the worst of the three--he spent one hours with the weakest hardware, with the smallest dictionary, received an interview in the middle, and 62% of the password, and the best score was 90%.

The three-person Hacking Team includes a password cracking software expert, a security advisor, and an anonymous free hacker. One of the most bull hackers is from S.C.G., using a home computer with a single AMD 7970 GPU, took 20 hours to hack 90%, a total of 14,734 passwords. Free GPU password cracking software oclhashcat-plus (the hacker who participated in the test used this software) development leader, Jens Steube also made a decent grade, he in one hours, with a dual AMD HD6990 GPU Machine, the 13,486 passwords, accounting for all 82%! Another nickname moniker Radix Hacker, with an AMD 7970, took 62% of the password, also nearly spent 1 hours, if not disturbed by our interview, he should be able to achieve better results.

Hackers to break the password used in the "dictionary", including a lot of password plaintext, these commonly used password character combination, from many large web site user data, including such as "123456", "password" and the like, these are weak violent passwords, and slightly better, like "[ Email protected]$ $word "," 123456789j "," LETMEin3 "and so on are also vulnerable. In these dictionaries, you can also find some theoretically strong passwords, such as "Lol1313le", "1368555av", "Oscar+emmy2" and the like:

Shows a combination of passwords in a hacker dictionary. Like this in the PK hack hand dictionary, there are nearly 100 million kinds of common passwords. But passwords such as "Momof3g8kids" and "coneyisland9/" are not spared in their dictionaries, how do they do that? The answer comes from two aspects: the website does not protect the user's password MD5 information, and the user does not use strong enough password.

To the ground, duly

"The password for these weak storms," Radix said, he did not want to reveal the real name, "that they really do not care about their password security, do not use MD5 encryption, which is not difficult for them."

MD5 algorithm, is a fast and simple "message compilation" method, generated by the ciphertext, is also the hacker's favorite practiced hand object, a GPU graphics card, can traverse 800 million character combinations in 1 seconds, compared to see, the encryption process is much more laborious, such as in the Apple Mac OSX system, And most Unix-based systems use the SHA512 encryption algorithm, a plaintext password needs to go through a hash of 5,000 times. This small obstacle also allows a GPU to run less than 2,000 times per second, similar to Bcrypt,scrypt, and PDKDF2.

Another loophole is that users themselves, choose a good memory of the word as a password, good memory represents easy to be broken, such as "Momof3g8kids" looks good to remember and difficult to guess, but in fact, "Mom", "kids" are every hacker in the hands of the necessary cracked vocabulary. More and more hardware and software, can make it easy for hackers to constantly try the various combinations of these words, unless the user carefully designed, otherwise good remember the password is in the hands of hackers.

And it must be pointed out that the three hackers did not know which website the code was from, which is tantamount to banning one of their skills. In general, when you get a hash of the password list, their first step is to "go to that site to see their password setting requirements and intensity," Radix said, if hackers know the password strength of the site and other conventions, which greatly reduces their intensity of work, so that hackers can be targeted to take a crack strategy.

Crack steps

To explain how they crack strong passwords, it is necessary to their three people's methods and strategies for comparative analysis, because their hardware and methods are not the same, and can not say which person's level is higher, for example, this is a game customs clearance, then a close than a difficult, the first round of crack, generally can handle 50% of them Password, the subsequent success rate is less, to the final stage, they can only rely purely on luck, get hundreds of password plaintext.

For example, in the first stage of Goseney hands, it took only 16 minutes to kill 10,233 hash ciphertext, that is, 62% of the appearance. He used a 6-bit password to open the circuit, using brute force method to deal with 1~6 characters password combination of 95 characters, including 26 lowercase, 26 uppercase, 10 digits, 33 symbols. After guessing round such permutations (956 + 955 + 954 + 953 + 952 + 95), it took 2 minutes and 32 seconds to get 1,316 correct results.

When the password is more than 6 bits long, Gosney starts to change the strategy, using a carefully selected dictionary to carry out the exhaustive. As the length of the password increases, the character combination exponentially number of levels. All 6-bit passwords can be handled in 1 hours, but it can take weeks, even years, to traverse a longer password. So, for the brute force to crack the method, there is a statement called: "Length of the Firewall":

Brute force is a good way to deal with 6-bit passwords, but for more than 8 passwords, even Amazon's EC2 cloud computing can do nothing.

Hackers of course do not go to the black one way, Gosney the next brute force will only be for 7~8 bits, all lowercase letters. This will greatly reduce the time required for poor lifting, but also a lot of harvest, successfully cracked 1,618 passwords. Then he went on to try the case of 7~8, and got 708 results. Because their permutations are 268+267, each step is allowed for only 41 seconds. Finally, he tries all the numbers to make up the length from the 1~12 bit, getting 312 passwords, which takes 3 minutes and 21 seconds.

Using the above entry-level brute force hack, the hacker Gosney This only began to pull posture, take out their own years of experience in the "dictionary", through the Hashcat software built-in "best64" rule (a code based on password statistics crack behavior mode), he can in 9 minutes 04 seconds, ran out 6, 228 hash cipher, then he uses the previous step to crack all the plaintext password, through another group called "d3ad0ne" the rule filter to get "character combination feature", let him in a second, and got 51 password plaintext.

"Under normal circumstances, I first use the brute force method, complete the 1~6 bit password crack, because it is a single GPU, can almost instantaneously complete with MD5 encrypted password." Gosney explained in the Mail:

　　 Because this step will be completed very quickly, my dictionary is almost 6-bit cipher combinations. This allows me to save a lot of disk space, but also can take advantage of the GPU brute force, speed up my later with the dictionary crack speed. For the combination of numbers also, I can quickly crack the password of a pure number, so in my dictionary there is no number composed of a password, and then my dictionary file +bast64 rules file. Our aim is to pick the soft persimmon first.

Starting with a simple password is especially useful for passwords that are "salt-doped" (cryptographic salt). "Salt mixing" is used to deal with hackers "rainbow table" (a kind of plaintext and ciphertext corresponding to the table) and similar dictionary technology, salt is in the user password, plus random characters, and then hash of the technology. In addition to defending the Rainbow Watch, salt also slows down the speed of brute force-poor lifting.

However, the key to "salt mixing" is that the speed of cracking can be slowed down only when different salt (characters) are added. This means that the effect of salt mixing will gradually decrease with the cracking. The hacker can eliminate the interference of salt gradually by cracking the result of simple password. Of course, the password used in the PK activity is not mixed with salt.

After the first round of Cuikulaxiu, 10,233 hash cipher has been broken, into the second phase, the hacker began to use "mixed crack strategy." As with the game-passing metaphor mentioned earlier, as the difficulty increases, the second phase will take more time, and the outcome will be reduced, and accurately, only 2,702 passwords are broken, taking 5 hours and 12 minutes.

Just like the name "mixed-hack", combining the two ways of brute force and dictionary cracking, which greatly expands the range of combinations covered by dictionaries, and controls the number of combinations in acceptable ranges. The first round, the hacker at the back of all dictionary entries, plus two random characters including symbols and numbers, so in 11 minutes and 25 seconds, there are cracked 585 passwords. The second round plus 3 random characters, took 58 minutes to get 527 results, third round, plus four random numbers, 25 minutes to get 435 cipher plaintext, fourth round, plus four random characters including a number and three lowercase letters, and then scored 451 password plaintext.

In the face of impressive results, Gosney that it only took a GPU card.

"You notice that we've only added two or three lengths of random characters, but to 4 lengths, we can only use numbers, because only 1 graphics GPU, want to run out + 4 random characters and numbers of the combination will take a long time, so I can only give up." ”

There is no doubt that the Gosney, who has been using the 25GPU fire-fighting monster machine for a longer password, revealed in last October the name "Radium Pond" machine:

Because the GPU's parallel computing power grows linearly with the increase in the number of computing units, this allows Gosney to make good use of these resources, allowing him to get 35 billion operations per second to challenge Microsoft's NTLM encryption algorithm.

In the second phase, Gosney continued to take similar tactics. At the end of this phase, he scored 12,935 passwords in plaintext, that is, 78.6% of the hack work, a total of 5 hours and 28 minutes.

Many hackers know that there is an interesting phenomenon, that is, under the same site, the user's password will be very similar ... Although these users are far apart, they do not know each other. By already getting most of the password, the hacker began to analyze the password characteristics of this unknown website, to imitate the behavior of the site users, to crack the remaining password. By Markov Chains (a statistical model), hackers generated a new cipher dictionary with Hashcat, Gosney that the dictionary was highly optimized and intelligent, greatly reducing the number of character combinations required.

The primary violence-exhaustive dictionary contains combinations such as "AAA", "ABB". But after Markov chains-trained dictionary, through the analysis of the existing password plaintext, listed the most likely password combination. "Markov crack", you can reduce the 7-character combination difficulty from 957 to 657, probably save 7 hours. Generally speaking, the character combination has "the initial capitalization, the middle lowercase, the number in the tail" and so on prominent characteristic, the Markov crack method's hit rate, can almost be as high as the violent poor lift hit rate.

"This makes your hack more targeted, because you have specific goals for specific sites," Gosney says, and when you get these combination features, you can destroy Huanglong.

Gosney spent 14 hours and 59 minutes, completed the third phase of the hack work, got 1699 passwords. Interestingly, at this stage, the first 962 passwords took about 3 hours, but the following 737 passwords took 12 hours.

Hacker Radix Hand has 2009 years, the line game service provider rockyou by SQL injection attack, the database, contains 1.4 million password plaintext, in addition there is a genuine larger password dictionary, but the magician will not easily reveal the authority, PK in Radix also did not take out the dictionary.

Hunt Hash

Light with rockyou Bauku data, Radix can get and novice Anderson almost the record, get 4,900 password plaintext, probably accounted for 30% of the total. Then, he used the data, cut off after four, plus four random numbers, Hashcat estimated to take 2 hours to run out, which is longer than radix expected, but he ran 20 minutes later, also got 2,136 password plaintext. Then he tried the combination of the number of digits and got 259 results again.

"Analysis, intuition, and a little bit of magic," Radix said, "Extract the model, test the mix, put the results into the dictionary and keep trying, and so on", if you know the source of the ciphertext in your hand, you'll be able to guess the words in the field of that site and then you'll get the results you want.

So radix from the 7,295 password analysis has been obtained, found some obvious features, such as One-third of the password is composed of 8 characters, 19% is 9 characters, 16% has 6 characters, 69% by the "Letter + number" Composition, he also found that 62% of the password is all lowercase letters and numbers.

This information gave him the ladder to continue to crack. Later, he uses "mask crack", which is quite similar to the previous "hybrid hack", but to save a lot of time than brute force, try "all lowercase + number" 1~6 bit cipher combination, get 341 passwords. But the 8-bit "all lowercase + number" combination takes time, or exceeds radix's expectations, although the complexity is reduced from 528 to 268, which is the difference between 6 hours and 1 hours on the machine at hand, but he skipped this step.

So radix changed the strategy, using the Hashcat built-in 5,120 special rules, such as "E" to replace "3", delete the first letter of each word, or every other letter plus a number ... Within 38 seconds, another 1,940 passwords were broken.

"That's the fun of hackers," he said, "like hunting, but you're not looking for animals, but Hashimi." But he also admits that the dark side of password cracking technology, walking in the moral border, if one more step, serious consequences.

When another hacker Steube found a combination of passwords: "Momof3g8kids", he could not help saying: "This is the user's password logic, but we do not know this logic, which gives me some inspiration, this is why we have to stare at the screen results".

"Momof3g8kids" was cracked because Steube used a "dictionary combination crack", he used a number of dictionary of the species of the combination of entries, found this password, wherein, "momof3g" in a 11.1 million of the large dictionary included, and "8kids" in another smaller dictionary.

"This is so cool!" "He quoted the first of this article, XKCD's famous comic book, said:" Tell the horse battery staple, this is not the spirit. "

PK process, the most amazing is some cracked password plaintext, including: "K1araj0hns0n", "sh1a-labe0uf", "apr!1221973", "Qbesancon321", "dg091101%" ... It even includes a password like "All of the Light" that contains spaces. Steube also saw "philippians4:6-7" and "qeadzcwrsfxv1331" in the results, saying: " it is impossible to guess these passwords without brute force ."

After the GPU universal computing appeared, very few hackers used "rainbow table" (Rainbow Tables) in the attack, this obsolete party needs the huge capacity of the table file.

When Reputation.com saw the user's information leaked after the attack from his website, it appeared that the user's password encryption information could not be cracked, but we immediately informed the user to change their password.

All companies should realize that even if a user's password is hashed, the user should change the password immediately after the information leaks, especially those users who have the same password on different websites. Hackers are usually able to decipher 60%~90% passwords from the Bauku ciphertext.

It must be admitted that the use of "salt-doped" hash user password of the site can indeed slow down a large number of hash information is cracked speed, but "salt" does not block the single hash ciphertext and a small amount of ciphertext hack, in other words, if the hacker is targeted at a specific account, such as bank manager, a celebrity, "salt-doped" Can do nothing.

The three hackers ' superb skills also point to the need for users to strengthen their password protection awareness. Many of the world's top 500 companies have strict rules for employee email accounts and passwords to access corporate networks, which greatly increases the difficulty of hacking.

"It's not easy in the corporate sector," Radix said, "When I did a password security vulnerability check for a business, I could run for three days and three nights without a single character." ”

If the Web site can take the same security policy as those of large enterprises, then the user password will be much safer. But it's a bit painful for users to remember 11-bit random passwords.

Hackers crack the efficiency of the hash cipher, and the website learned that the user information was leaked after the reaction, forming a sharp contrast. Just last month, LivingSocial disclosed that hackers breached their database, breaking out 50 million user names, address and password information hash content, but the site owner obviously underestimated the risk.

Website CEO Tim said: "Although the user's password has been encrypted, and it is difficult to crack, our preventive measures can also ensure that the user's data is safe, but we still notify you, update their website password."

In fact, there is little that can stop hackers from decrypting hash messages. LivingSocial used by the SHA1 algorithm, in front of the hacker vulnerable. Although they also promote the user's hash is "salt-doped", which can not guarantee the security of user information.

From this, Intel recently launched a website, claiming to be able to test your password strength, is how unreliable, it is to evaluate that "BandGek2014" takes 6 years to be cracked, it is ridiculous that the password may be in the hands of hackers, presumably is the first to win. The key to the problem is that the password strength requirements of most websites fall within the scope of the hacker's capabilities.

"As you've seen, we've cracked 82% passwords in 1 hours, meaning 13,000 people didn't choose a good password, they always thought they chose a good password, but on the contrary, those passwords were too bad."

Just change the code, you old-age.

Edit summary:

I believe that there are not many people watching each paragraph, many people want to know immediately conclusion: how can I set the password to be safe? Summary of the small sum:20 characters above is very safe . As for the more than 20 characters are common terms, or random characters have little effect. And the combination of the 6-8-digit "letter + case + symbol + number" that brains came up with is really fragile and fragile. The user name and password stored in the site will not be used in clear text (directly displayed), but in an encrypted way to save, even so, a few high-level hackers can completely in a few hours to crack 90% user's password, you began to change the password?

After reading, change the password! But I bet you'll never see it through.