7

This is regarding a web application where a user has to login with their personal email as the ID, and a password they have chosen personally.

If an attacker somehow gained access to a credential store with a list of all the PBKDF2 hashes with the email addresses, to what extent could this be used maliciously?

  • When you say “a list of all the PBKDF2 hashes”, do you mean to imply that the list would also include the email address corresponding to each hash, which is the most likely scenario, or do you mean just the hashes? – Mike Scott Sep 10 '18 at 8:49
  • They would also include the email addresses. – deltzy Sep 10 '18 at 8:58
  • Is this web application using Peppers and Salts? – Matthieu M. Sep 10 '18 at 16:12
  • This is a well-known scenario, and I'm pretty sure there's a duplicate of this question somewhere - aren't you basically asking "what's the consequences of a database breach with correctly hashed passwords" ? – Riking Sep 11 '18 at 16:33
9

The attacker would have to crack the hashes in order to obtain the original passwords. Since PBKDF2 does multiple iterations of the same hash function, the act of cracking them would be significantly slower. The end result is that even weaker passwords are less likely be revealed, leading to a significantly lower percentage of successfully cracked passwords in the credential list.

  • 3
    Lists of hundreds of millions of previously-compromised passwords are freely available, and it’s perfectly feasible to run the whole of such a list against a few thousand leaked hashes. Experience shows that this will reveal 80% to 90% of all passwords. troyhunt.com/86-of-passwords-are-terrible-and-other-statistics – Mike Scott Sep 10 '18 at 8:54
  • 3
    @MikeScott Quite a few are indeed terrible, but 80% or 90% is a lot more than it really is. Just compare a leaked MD5 hash list with a leaked bcrypt hash list. The former may have almost 50% cracked, whereas the latter may have under 10% cracked! – forest Sep 10 '18 at 8:57
4

Assuming the attacker got the salts as well as the hashes, they could run a list of known previously used passwords against the list of hashes and get the passwords of most of the users, since the majority of users use passwords whose plain text has already been compromised somewhere. They couldn’t recover long well-chosen passwords that have never been used before.

  • While true, I'm not sure if this is especially applicable, as the attacker could just as easily take those leaked password lists and simply login to the website itself. The only thing they would really need to do that is the list of email addresses, so in this case the actual useful information from the leak would be the list of registered email addresses. The passwords themselves would actually be less valuable. It is true that offline cracking would be easier to setup and faster than attempting logins on the live site, but I don't think it would be a dramatic difference. – Conor Mancone Sep 10 '18 at 12:53
  • 10
    There is indeed a dramatic difference between online and offline attack. Offline, you can quickly guess triillions (fast hashes) or hundreds of thousands / millions (slow hashes) of candidate passwords against a single account, discover original plaintext, and use it to immediately log into the site without triggering any alarms. Online, if targeting a single user, your IP address(es) and/or the target user's account is likely to get locked out after relatively small number of guesses. Password spraying can help in an online attack, but it's still massively less stealthy than offline attack. – Royce Williams Sep 10 '18 at 13:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.