Random Rants

[louisbosco]

i'm not worth enough to be hacked…

[Snowy]

Modern password cracking isn't done (generally) by trying to log in as you onto a website over and over. It's done trying to authenticate/spoof your identity. It's knowing your name and address, then calling a telco, finding out they tell you the last 4 digits of your credit card by mistake. Then you call up Yahoo who authenticate you using the last 4 digits you now have. Then your gmail account or whatever, you can now do a password reset, as you've set that password to reset to the yahoo account. Game over man.

^Is a real attack that has/does get used it's how a lot of the celeb icloud hacks happened.

The modern form of password cracking itself is now usually done offline. They aim to get the database and crack it offline. Most cracks don't look to work out the password, they have 1-time pre-computed hashes up front. They hire these huge instances from cloud providers and one time work out every password ever. It costs a few thousand dollars.

Then they hack into a company like Yahoo, Tumblr and pull the entire database of passwords. They figure out how the password was stored in the database, then run their precomputed matching against it. That's the annoying attack. It's not targetted at you, but you've still lost all your shit. Or the details here will be kept/sold and re-used YEARS later, for something else..

An example of the precomputed password stuff;

Say my password is "hello world";
1)The computer when it saves to the database would save that as "5eb63bbbe01eeed093cb22bb8f5acdc3" if I was using MD5 as a checksum.
2)When I try log in, it generates a MD5 checksum of what I type in to make sure it matches "5eb63bbbe01eeed093cb22bb8f5acdc3".
3)If it does, it knows that I typed in the right password as ONLY "hello world" can generate that string (within reason).

So the hackers have a DB with all these MD5 checksums, what they then do is generate every possible word and combination ahead of time like;

MD5 ("a") = 0cc175b9c0f1b6a831c399e269772661
MD5 ("b") = 92eb5ffee6ae2fec3ad71c777531578f
MD5 ("c") = 4a8a08f09d37b73795649038408b5f33
MD5 ("..") = 58b9e70b65a
MD5 ("Hello World") = b10a8db164e0754105b7a99be72e3fe5
MD5 ("Hello w0rld") = e7a9e19587c07e67b205ae2d94cbad13
MD5 ("h3llo w0rld") = 0dedd75e7d5b93afef109aae6a3e73a5

When they get the password database, what they do is run it through the dictionary, if they get a match, they know your password. This takes under a day and only a few hundred dollars. Password complexity is not a thing anymore. Single factor is NOT secure. Hopefully you guys don't have your credit cards or bank accounts behind just a single password. And hopefully your bank password is not the same as your e-mail account. And hopefully the password reset for your bank isn't the same as the email address that was cracked above :o. 2 factor is mandatory for any business  IMO.

Some of the larger breaches of the database style attacks can be seen @ https://haveibeenpwned.com/ The website owner downloads every release hack and keeps the emails on file. DO put in your e-mail and subscribe to the service to let you know if you get owned. The owner of that website is one of the most vocal IT security guys in the game (Troy Hunt).

#'s of DB hacks in last few years;
359,420,698 MySpace accounts 
234,842,089 NetEase accounts 
164,611,595    LinkedIn accounts 
152,445,165 Adobe accounts 
112,005,531 Badoo accounts 
93,338,602 VK accounts 
91,436,280 Rambler accounts 
68,648,009 Dropbox accounts 
65,469,298 tumblr accounts 
58,843,488 Modern Business Solutions accounts

My name is Snowy and I have worked and continue to work around the Information Security Industry.

[organisys]

Which is why owners of sites need to salt their hashes. 

[Snowy]

^yah, and you want to make damn sure it's a good salt. Have seen some examples where the salt is statically coded as well :(.

BTW the password lookup DB is called a Rainbow Table. I forgot the term, just came back to me. (https://en.wikipedia.org/wiki/Rainbow_table).

The world is an interesting place.

[ROman]

I really can't believe my current job is in Washington DC. Looking forward to my next one in Houston.

[ROman]

One of the news stories on the day after I arrived, which was 1/12/17, was that a man was running around NW DC groping women.

[Giles]

Trump or Clinton?

[louisbosco]

@Giles:

Trump or Clinton?

trump, clinton or me?

[Megatron1505]

@Giles:

Trump or Clinton?

[ROman]

No name was mentioned but I thought someone got to town early. Seul gets credit for the post from earlier.

[ROman]

[mikebarhoot]

met her in a bar down in north soho…

[Sam]

The new photobucket site (if you can call it that, it's more like a screen shot of a site) makes you want to smash you computer and go live in the woods.

[Seul]

My feelings exactly…

[Chris]

It is truly terrible. The app is equally horrible.  I've used photobucket for the last five years or so, but it's basically dead to me now.

[Seul]

The shit you have to do when you wanna change the maximum size for a picture…

[louisbosco]

hmm funny. i've never had problems with photobucket.

[Sam]

How much are they paying you @louisbosco 

[louisbosco]

hahaha. just about enough $500,000 a post to make that statement every now and then

but honestly, i was using imageshack or something years ago when i first started posting, then that sucked and i switched to photobucket. it annoys me occasionally with the sorting of the library and stuff, but i've enjoyed it so far.. 5 years now i think, that i've been using them..

[Chris]

I didn't have any problems with it until the "upgrade" about a month ago.  That ruined the easy posting from my phone and made going to the website a browser crashing exercise in frustration.  But the previous five years were nice…