Schneier on Security

Matt from CT • February 9, 2009 7:41 AM

It's far too early in the day, on a Monday no less, to be putting on the tinfoil...

But it does make you wonder if organized crime, with the help or at least toleration of foreign intelligence services, does any data aggregation of these various identity leaks.

Encrypted passwords are quite vulnerable if they're not using some still secret salt to rainbow attacks. Even with a salt with enough passwords, computing power, and time they're still crackable. Without having data in front of me, I'd guess most people use variations of the same password or a "theme."

What's the power of not only aggregating identity information like figuring out where people work, but also looking at several of their passwords you've stolen as plain text or decrypted over the last 10 years of state sponsored / tolerated cracking?

Now instead of a highly visible brute force attack against an account, you can try just the occassional attack using passwords you know the target has used, or common variations of them with a relatively high level of confidence...and do so over the course of years so you never reach the threshold for automated intrusion detection systems to issue alarms.

Matt from CT • February 9, 2009 1:27 PM

>for example AA5jkl); then all I had to
>do was remember the person I used.
>But nowadays thats too short to
>thwart brute force.

You know, I'm not sure I'd even brute force a password like that if I was a state sponsored or otherwise well funded criminal organization.

AA5jkl's md4 (Windows NT) hash is 953f e146 060a f8a0 9754 7827 89c3 e456

I believe it's around 166 Terabytes in hashes generated by 16 character passwords.

You wouldn't even need a database to do the lookups -- chunk the job among a number of Linux hosts and partitions...something like:

hostname 95
mount 3fe1
directory 4606
text file 0af8
then just grep the a0 9754 7827 89c3 e456 part to find the corresponding plain text.

(Naming scheme is derived from the hash, with 256 hosts with 65k mount points with 65k directories in each with 65k files. I'm not sure off hand if we could have that many mounts/dirs/files, but it's a starting point)

It's relatively affordable -- to get a rough idea, I looked at the cost to host such an operation on Amazon's cloud. For the storage at $0.13/GB for 50-400TB a month, so that's $21,000. That they list pricing tiers for 500+ TB tells me they wouldn't be very concerned over a couple hundred TB being generated. 256 of their biggest, computationally powerful virtual machines would run $147,456. You would, however, have your own very happy Amazon salesman asking you if you want to go golfing in Hawaii or get superbowl tickets.

Yeah, it's out of the range of ordinary petty thieves for sure...but those numbers are not very intimidating -- you sure as heck wouldn't need to be the NSA to pull it off.

State sponsorship would make it easy, but to stray into movie plot territory for a moment it would be a lot cheaper to run then any of the plots SPECTRE ever tried in a James Bond flick.

Apply Moore's Law and figure in 4 years it'll be one fourth as expensive and it gets kind of scarey to think how vulnerable passwords are getting to be even if all you have is the hashes.

Matt from CT • February 9, 2009 1:29 PM

Thanks for sharing that story Rich!

It's a great real world example of the vulnerabilities out there when people are specifically focusing their efforts to penetrate particular companies with tools that slip under the conventional antivirus/intrusion detection systems.