Re:StockX was hacked, exposing millions of customers’ data
by txcwpalpha on Sunday August 04, 2019 @06:15PM
(#20609570)
Look up benchmarks for cracking MD5 hashes. You can crack an MD5 hash of an average length password (and StockX only requires an 8 character password), even with a salt, within seconds with a single consumer grade GPU. A hacker group with any serious setup for hash cracking has almost certainly already cracked most, if not all, of these hashes.
[ Parent
| on HN ]
Re:StockX was hacked, exposing millions of customers’ data
by xwdv on Sunday August 04, 2019 @06:32PM
(#20609661)
Show me the benchmarks.
Re:StockX was hacked, exposing millions of customers’ data
by dehrmann on Sunday August 04, 2019 @07:11PM
(#20609824)
https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...
Looking at phpass (one of the md5 algorithms), a high-end GPU can do 7M hashes per sec.
Re:StockX was hacked, exposing millions of customers’ data
by txcwpalpha on Monday August 05, 2019 @01:36AM
(#20611549)
If StockX was using phpass (which is a KDF that uses MD5 as a base but adds multiple permutations on top), it is quite a bit safer (but still not recommended and these hashes should be considered to be compromised).
The bigger issue is if they were actually using raw MD5 (which is sadly quite common), which is benchmarked at 25 billion (with a B) hashes per sec per GPU.
Re:StockX was hacked, exposing millions of customers’ data
by blondin on Sunday August 04, 2019 @08:32PM
(#20610131)
nowhere in these benchmarks anyone said the MD5 were salted. am i reading it wrong?
Re:StockX was hacked, exposing millions of customers’ data
by thenewnewguy on Sunday August 04, 2019 @08:42PM
(#20610170)
Unless you're operating under the (likely incorrect) assumption that the salts aren't leaked than salting the password doesn't matter for attacking a single user - it just means you can't reuse your results for other users.
Re:StockX was hacked, exposing millions of customers’ data
by ryanlol on Sunday August 04, 2019 @06:31PM
(#20609648)
Unless you presume that you know the salt your comment is utter nonsense.
The fact that the article says “believed to be” strongly suggests that things are not as simple as they’re “believed to be”, because if the passwords were easy to crack that’d be trivial to prove.
Re:StockX was hacked, exposing millions of customers’ data
by eterm on Sunday August 04, 2019 @07:40PM
(#20609953)
If the passwords have leaked it's safe to assume the salts have, typically they're stored side by side.
Re:StockX was hacked, exposing millions of customers’ data
by thenewnewguy on Sunday August 04, 2019 @08:44PM
(#20610177)
If the hash has been leaked then why is there reason to believe the salt _hasn't_ been leaked?
Re:StockX was hacked, exposing millions of customers’ data
by alasdair_ on Sunday August 04, 2019 @09:53PM
(#20610404)
>Unless you presume that you know the salt your comment is utter nonsense.
Usually the attacker will also know the salts in a breach of this type, unless the company did something clever with the salts (doubtful since they used MD5).
Re:StockX was hacked, exposing millions of customers’ data
by ryanlol on Monday August 05, 2019 @04:19AM
(#20612276)
The fact that the article says “believed to be” strongly suggests that things are not as simple as they’re “believed to be”, because if the passwords were easy to crack that’d be trivial to prove.
We don’t know how the passwords are hashed. All we have is a journo guessing.