-2

Every day the technology around us is getting better and better, and so does security. Almost every-day newspapers headlines are: hackers hacked database of a big company and stole passwords and usernames, for example.

But with my little knowledge I know that passwords are saved encrypted to databases, and that non-encrypted passwords never come to server, and thats all fine.

My question is why are people making so big deal about that hacks? Hackers got emails unencrypted but passwords are safe. What can they do with encrypted passwords? I just don't understand.

  • Usually, they'll get the encryption key at the same time as they get the encrypted passwords. ​ ​ – user49075 Aug 9 '15 at 16:52
  • but usually it is encrypted with md5, and it is almost impossible to decrypt md5, that is one way encryption – Antonio Stipić Aug 9 '15 at 16:54
  • 2
    If it's "one way encryption", then it's definitely not "encrypted with md5". ​ If it's hashed with md5, then the passwords would be found with rainbow tables or by just hashing candidate passwords. ​ ​ ​ ​ – user49075 Aug 9 '15 at 17:00
  • I could send an email with a link to a malware infested website to one of your friends, such that the email looks like coming from you. The probability that this will succeed is then a lot larger than in case of the usual more random fishing attempts. – Count Iblis Aug 9 '15 at 17:11
3

First, a couple points of clarification.

  • Passwords are typically hashed, not encrypted, as was pointed out above.
  • Plaintext passwords are typically sent to the server for the application to hash and compare against what is in the database.

I say typically in both cases, because there are exceptions. For passwords sent to the server, a protocol called SRP can be used to never send the password to the server. But it is not used very often.

What can an attacker do? Attacks against hashing algorithms exist, such as the MD5 discussion linked above, that allow the plaintext passwords to be discovered. Common hashing that applications use include:

  • MD5
  • SHA1
  • SHA256
  • SHA512
  • bcrypt
  • scrypt

Tools are out there that build hashes of known words and compare them against the desired hash. For example:

I want to know what the plaintext value of this hash is: 098f6bcd4621d373cade4e832627b4f6. Given the length of the hash and that it contains only hex characters, I can make the educated guess that it is an MD5 hash. I can then run that hash through any number of tools. For the purposes of demonstration, I have created a file with just this hash in it:

$ cat hashlist.crack myusername:098f6bcd4621d373cade4e832627b4f6

Now I can run a tool against that hash:

$ john hashlist.crack --format=Raw-MD5 Loaded 1 password hash (Raw-MD5 [MD5 128/128 SSSE3 20x]) Press 'q' or Ctrl-C to abort, almost any other key for status test (myusername) 1g 0:00:00:00 DONE 2/3 (2015-08-09 10:26) 100.0g/s 109300p/s 109300c/s 109300C/s test..blazer Use the "--show" option to display all of the cracked passwords reliably Session completed

The plaintext value is test.

Using this tool and other freely-available tools, an attacker can get a list of hashes and crack the plaintext values.

That's why security professionals encourage people to use hashes that are better at resisting cracking, such as bcrypt, as well as encourage the use of strong passwords.

2

Passwords are hashed, not encrypted (well, I would hope so at least)! This question does a great job at explaining everything about password hashing. Unfortunately, hackers are sometimes able to crack passwords when they obtain a database because their target used a weak hashing function such as MD5. However, even if passwords were being hashed by strong hashing functions such as Bcrypt or Scrypt, there are most definitely still some work-a-rounds for the hackers. For example, if the hackers had access to the website's hosting, they could edit the registration/login pages, capture raw logins on the wire via POST variables, and then pass them into a remote database that they owned.

When a hacker gains access to something that could drastically affect the public (such as the Blue Cross database, it is a big deal. In addition, we are finding out that big companies are still using weak hashing functions or not even hashing passwords at all.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.