Recovered | Percent | ||
Total | 360,213,049 | ||
Usable data | 359,005,905 | 355,886,686 | 99.13% |
Unique | 116,822,086 | 113,830,176 | 97% |
Salted hashes | 68,494,253 | ||
Salted pairs | 66,099,059 | 47,120,453 | 71.29% |
non-user pass | 14,412,299 | 5,831 | 0.04% |
meaningful passes | 51,686,760 | 47,114,622 | 91.15% |
When we obtained the Myspace data, we didn’t think too much of it for several reasons. In addition to being a fairly old data-set, the passwords were also truncated to length ten and converted to lowercase prior to being hashed with the SHA-1 algorithm. This means that some of the passwords recovered would be ambiguous and incomplete. This is no longer the case for roughly 68M of the hashes.
The total data-set of roughly 360,213,049 lines contained 359,005,905 usable hashes. This data was de-duplicated to 116,822,086 SHA-1 hashes. Roughly 97% of these hashes were recovered by our group, totaling to 113M hashes. As the passwords were all pre-processed before hashing, the plain-texts which we recovered did not exceed length ten and were all lower-cased.
Since the plain-text passwords aren’t in their original form, they are not as interesting as it does not allow us to gather that much useful information from them. Being truncated, they do give us a glimpse of some longer passwords we may have previously not been able to recover.
Interestingly, user ‘frekvent’ over at the hashes.org forum made an amazing discovery. It appears that for some users there exists an additional salted SHA-1 hash that contains the password in it’s original form, without being truncated or lower-cased. This hash is generated by salting the password with the userid prior to being hashed with SHA-1.
Rather than directly recover the salted SHA-1 hashes, we can take a shortcut. This means for all those users who contain this secondary salted SHA-1 hash, we can now case correct it against the plain-text we previously recovered. It also means we can derive the actual password for these users prior to length ten truncation.
A generated example
UserID: 65535
Password: Cynosureprime082!
First hash:
(password is truncated to length 10 and lower cased)
cynosurepr->SHA1->6fba0c905ded07590fdbc4b0fa6eb17e565dd814
Second hash:
(userid is applied as a salt to the unmodified password)
Cynosureprime082!->SHA1($salt.$pass)->20c25cbb791bc0b7fcce739f42b682376057eb9e:65535
Stored as:
65535:email:0x6FBA0C905DED07590FDBC4B0FA6EB17E565DD814:0x20C25CBB791BC0B7FCCE739F42B682376057EB9E
Step 1: Recover 6fba0c905ded07590fdbc4b0fa6eb17e565dd814 as cynosurepr
Step 2: Perform case toggling and length extension cynosureprA, cYnosureprBB, cyNosureprZZ etc etc and test against 20c25cbb791bc0b7fcce739f42b682376057eb9e:65535
Out of the entire data-set, about 68M users contain the secondary salted SHA-1 password hash. Of these 68M users, we were able to pair 66M up with the recovered password. This 66M list was then divided into two groups, ‘non-user pass’ which are users containing system generated passwords (14M) and ‘meaningful passes’, those which belong to users (51.6M). We were only able to pair 66M of the total 68M hashes as we have not fully recovered all the SHA1 hashes, but only 97% of them.
Using our tools we performed either a case toggle and/or length extension attack for each of the salted hash pairs. We have successfully verified over 45M plain-texts against their salted SHA-1 counterpart. The case toggle refers to toggling all passes length ten or less against the salted SHA-1. The length extension attack involves cycling through all possible characters and appending them to the plain-text derived from the recovered normal SHA1 and checking this against the salted SHA-1 hash.
Having both variations of the password hashes has made cracking the longer passwords quite easy since we can first recover the length 10 representation and use this in length extension attacks to obtain the full length password. It would appear that the Myspace data may have some usefulness after all.
Note: The salted hashes can be paired up with their corresponding plaintext data and arranged such that they can be recovered using off the shelf software. However, this won't work for case correction, you will also need to reparse the final output.
Note: The salted hashes can be paired up with their corresponding plaintext data and arranged such that they can be recovered using off the shelf software. However, this won't work for case correction, you will also need to reparse the final output.
This entire post absolutely ROCKS! Thank you for all the hard work you put into it. It really shows. best friend captions & Captions
ReplyDeleteQQ Poker
ReplyDeleteQqpoker
QQ Poker Mobile
Club Ceme
KotaCeme
CemeBNI
CemeBCA
Ceme Jackpot
KejuPoker
http://198.252.105.120
Nonton Bokep Terupdate
ReplyDeleteNonton Bokep Full HD
Nonton Bokep Indonesia
Nonton Bokep JAV HD
Cewek SMA DiSodok
Nonton Bokep Terbaru
Agen Poker Online No 1
Royalflush88 Agen Poker Terbaik
Agen Poker Royalflush88 Daftar Disini
selfie ig captions
ReplyDeleteselfie captions
ReplyDeleteThis is Very very nice article. Everyone should read. Thanks for sharing and I found it very helpful. Don't miss WORLD'S BEST CarGames
ReplyDeleteInteresting article, really. I visit again here to see more. Thank you.Silence Quotes
ReplyDeleteNonton Bokep Terbaru Jav
ReplyDeleteNonton Bokep Full HD
Nonton Bokep Indonesia Artis
Nonton Bokep JAV HD
Cewek SMA DiSodokMemek Nya Berdarah
Nonton Bokep Terbaru
Agen Poker Online No 1
Royalflush88 Agen Poker Terbaik
Agen Poker Royalflush88 Daftar Disini
Agen Bola Online No 1 Terbaik
Bokep Orang Rekaman Pribadi
Film Bokep Ngintip
Nonton Bokep Rekaman Cctv
Nonton bOKEP Pelajar
Bokep Hentai
Nonton Bokep Janda STW
Agen Poker Online No 1
Royalflush88 Agen Poker Terbaik
Agen Poker Royalflush88 Daftar Disini
Agen Bola Online No 1 Terbaik
I admire this article for the well-researched content and excellent wording. I got so involved in this material that I couldn’t stop reading. I am impressed with your work and skill. Thank you so much. Being the Top mobile App Development Companies in New Jersey USA Globtier offer superior mobile development at an affordable price, not mention a quick return time.
ReplyDeletemobile application development in New Jersey USA
application development company in new jersey USA
Nonton Film Movie Online Terbaru 2019
ReplyDeleteNonton Film LK21
ReplyDeleteVery nice, thank you for sharing.
ReplyDeleteBoys captions , badass captions , attitude quotes
MINAT POKER
ReplyDelete* BONUS NEW MEMBER 20%
* Bonus Turn Over Mingguan 0.5% (ALL GAME TANPA SYARAT)
- TIDAK ADA MINIMAL TURNOVER
- TIDAK ADA MAKSIMAL BONUS ROLLINGAN
* BONUS REFERAL BERJALAN TERBESAR
- AJAK 3-5 TEMAN DAN AKTIF BERMAIN AKAN DIBERIKAN CHIP 50.000
- AJAK 6-10 TEMAN DAN AKTIF BERMAIN AKAN DIBERIKAN CHIP 100.000
- AJAK 11-15 TEMAN DAN AKTIF BERMAIN AKAN DIBERIKAN CHIP 150.000
- AJAK 16-20 TEMAN DAN AKTIF BERMAIN AKAN DIBERIKAN CHIP 200.000
- BONUS AKAN DIBAGIKAN SETIAP HARI SENIN
WA : +855887950794
Domino Online
Poker Online
Ceme Online
Agen Poker Online
Situs Poker Online
Dewa Poker Online
http://idnpokeronline.me
ReplyDeletehey, i like your article specially your writing style keep it up i read your your all work.Entire post really Awesome! Thank you for all the hard work you put into it. It's really shows.nerdy pick up lines || Thank you for all the hard work you put into it. It's really shows. i read you all post i love to read your post and you work well. love status in english
ReplyDeletehello,
ReplyDeleteYour Site is very nice, and it's very helping us this post is unique and interesting, thank you for sharing this awesome information. and visit our blog site also
Satta King
really nice, thank you for sharing..
ReplyDeletebadass quotes
Hey Thanks for Sharing here is my site TopAppAndroid
ReplyDeleteYour Site is very nice, and it's very helping us this post is unique and interesting,i like your article specially your writing style keep it up i read your your all work.Entire post really Awesome!
ReplyDeleteDaily Satta king Providing Live Result
Satta king Desawer, satta king Gali, satta Faridabad, Gaziyabad result, Satta King live result,
Satta king online result, Satta king result today
If you are interested in then we can provide you thebusiness directory and business directory india
ReplyDeleteWe also provide marketing automation tools and marketing automation.
If you are interested in then we can provide you thedatabase company and b2b company in india
ReplyDeleteWe also provide sales automation and online crm software.
pierce journal get this link
ReplyDeleteThank you so much for sharing such a superb information.
ReplyDeletemobile repairing course in delhi
mobile repairing course in delhi
mobile repairing institute in laxmi nagar
Talimgun is a illegal public torrent website.
ReplyDeletehttps://dailysattaking.com/satta-king-desawar-result-chart-2019.php
ReplyDeleteDaily satta king
ReplyDelete123movies site
ReplyDeletetamilyogi site 2019
ReplyDeleteThank you so much for discussing about this topics. I have been searching for the information about this topic today. it is very well written and contains alot of information. Kenyamanan dan keamanan dalam bermain slot online hanya bisa didapatkan pada saat Anda bermain bersama agen slot online MPO007. Jangan salah pilih dalam bermain permainan slot online, hanya MPO007 pilihan Anda sebagai Agen Slot Online Terlengkap di Indonesia Situs Slot Online
ReplyDeleteThank you so much for discussing about the topics. The topics can be said one of the well written about this topics. I have saved your site and will come back and visit it regularly. Kenyamanan dan keamanan dalam bermain slot online hanya bisa didapatkan pada saat Anda bermain bersama agen slot online MPO007. Jangan salah pilih dalam bermain permainan slot online, hanya MPO007 pilihan Anda sebagai Agen Slot Online Terlengkap di Indonesia Situs Slot Online
ReplyDeleteWonderful and excellent blog. Rich in contents and the design is amazing. It amaze me start the moment that i visit your site and by visiting your site, i have learned few things that i can use to improve my own blog site. Thank you so much. MPO2QQ sebagai agen slot online dengan nominal jackpot progressive terbesar dan juga berbagai jenis permainan slot online terlengkap dan terbesar di Indonesia. Dapatkan bonus permainan slot online hingga 100% pada saat anda bermain bersama situs slot online MPO2QQ
ReplyDeleteisaimini movies site
ReplyDeleteAmazing and very goood article visit captions
ReplyDeleteBagi Kalian yang sangat menyukai bola tentunya kalian ingin memasang pasangan yang kalian inginkan, Kalian bisa memasang di situs kami, karena pelayanan kami sudah sangat terpercaya bagi para orang orang yang bermain di situs kami silahkan kunjungi tempat kami untuk membuktikan bahwa kenyamanan dan untuk membuktikan kualitas kami adalah yang terbaik.
ReplyDeleteBola Deposit Pulsa
deposit bola via pulsa
deposit bola dengan pulsa
agen bola deposit pulsa
Thankyou so much for this detailed information, keep up the good work. Here is the link of my website Modern Home Designs
ReplyDeletethanks for the info https://dailysattaking.com/ visit here for more info
ReplyDeletethanks for the info Daily satta king visit here for more info
ReplyDelete