Fun with MD5 hashes and Google

[giza]

Think that your applications that store passwords as an MD5 hash are secure? Think again:

doug@dmuth ~ $ echo -n "password" |md5sum
5f4dcc3b5aa765d61d8327deb882cf99

Searching for 5f4dcc3b5aa765d61d8327deb882cf99 on Google turns up a number of hits in various password files that are on the web for some reason or another. I don't know whether those accounts are active/current, but I still find that prospect rather frightening.

One solution is to use at least 64 bits Salt when creating a hash based on a password. This in turn will require the attacker to make up to 2^64 hashes for each password that the wish to guess. (flaws in MD5 aside)

Comments

[giza.livejournal.com]

Something I never figured out is why more applications don't use multiple hashes in parallel. The ASR release of Tripwire uses MD5 and and some variant of SHA and throws alerts whenever either hash changes. Even in the unlikely event if both algorithms have exploits available someday, it's high unlikely that the same exploit will apply to both algorithms, which preserves the overall integrity of the application.

[furahi.livejournal.com]

Maybe all that people have the exact same password you do.
passwd uses the password itself as .... uhhh... "key" to encrypt, does it not?

(t'least that's how it was with FreeBSD 4)

[giza.livejournal.com]

I think you're referring to salt used in the crypt() function. That's totally different (and outdated).

[furahi.livejournal.com]

I don't even remember anymore @.@

[kellic.livejournal.com]

I've seen MD5 hashes embedded in URL lines so I'm not overly surprised. Sloppy code begets sloppy secrets.

[unciaa.livejournal.com]

I guess I'm stupid, but what does finding the hash for the string "password" online demonstrate?

[giza.livejournal.com]

Most of those matches are dumps from MySQL databases. A look at the schemas show that some of them appear to be user credentials for some system. Anyone with sufficient motivation could try to figure out what systems those dumps are from (likely on the same server) and do some account hackery. I tried a few other hashes of common passwords and got other matches too.

Moral(s) of the story: 1) (for users) Don't choose simple passwords, and 2) (for admins) Don't put database dumps in a publically accessable location.

[balinares.livejournal.com]

3) Learn some freaking software engineering and salt your hashes already. I mean, gee! :)