Weebly hacked, 43M credentials stolen

Re:Weebly hacked, 43M credentials stolen by MasterScrat on Friday October 21, 2016 @09:45AM (#12760326)

I believe he meant the will try the top 100 most common passwords on each account on the website directly, resulting on "82% of users at risk", assuming 82% of users use one of these 100 passwords.

Strong brute-force protection (eg block account for exponential times) could mitigate this attack vector.

[ Parent | on HN ]

Re:Weebly hacked, 43M credentials stolen by user5994461 on Friday October 21, 2016 @02:41PM (#12763321)

Why are you guys talking about live site and rainbow table???

The attackers have the salts and the hashes, they can brute force the hashes offline with [ocl]hashcat as they wish.

Top 100 passwords * 43M accounts is only ~4B hashes to compute. We don't know what bcrypt parameters they used but we're probably talking a few hours here, maybe only a few minutes.

[ Parent | on HN ]

Re:Weebly hacked, 43M credentials stolen by novaleaf on Saturday October 22, 2016 @11:24AM (#12769035)

to brute force the top 100 passwords, only the usernames were really required. can easily bruteforce the top 100 passwords on a live site.

you are right that it's now very easy to use dictionary attacks now, on all the credentials offline. and those with super weak passwords will have their accounts compromised.

[ Parent | on HN ]