LivingSocial Hacked – 50 Million Customers Affected

Re:LivingSocial Hacked – 50 Million Customers Affected by wglb on Friday April 26, 2013 @05:56PM (#5615734)

Why would the attacker, if they got the passwords, not bother to look to the column just to the right and take the salts as well? Given that, the attacker can try hundreds of billions of password combinations per second.

[ Parent | on HN ]

Re:LivingSocial Hacked – 50 Million Customers Affected by chill1 on Friday April 26, 2013 @06:52PM (#5615969)

The point of unique salts is that even if all the user's passwords are the same, the end resulting hashes that are stored in the database, are different. So, let's say you wanted to hash your set of 50,000 different, commonly used passwords. You'd have to hash that list of 50k passwords for EACH individual user. So instead of 50,000 hashes... you have 50,000 x the total number of users.

[ Parent | on HN ]

Re:LivingSocial Hacked – 50 Million Customers Affected by wglb on Saturday April 27, 2013 @10:36AM (#5617859)

I am not following your logic here.

What I am saying that if the attacker gets a row from the database that has the user's id, the password will be in a column labeled 'password'. Next column is likely to be the salt generated for that user's password, and let's say that this column name is 'salt'. With the salt and password for each user, you can run a dictionary across each combination at a furious rate.

[ Parent | on HN ]

Re:LivingSocial Hacked – 50 Million Customers Affected by StavrosK on Friday April 26, 2013 @06:53PM (#5615972)

The attacker does, of course, have the salts as well, since they're part of the hash. I don't see how they can try hundreds of billions of password combinations per second, though.

[ Parent | on HN ]

Re:LivingSocial Hacked – 50 Million Customers Affected by bcoates on Friday April 26, 2013 @07:33PM (#5616104)

http://securityledger.com/new-25-gpu-monster-devours-passwor...

25 late 2012 vintage GPUs gets you 180 billion MD5 tries per second. With a fairly modest budget you can rent a whole lot more GPU power than that. A little Googling gets me several companies offering password hash cracking as a service.

[ Parent | on HN ]

Re:LivingSocial Hacked – 50 Million Customers Affected by elithrar on Friday April 26, 2013 @08:40PM (#5616312)

> 25 late 2012 vintage GPUs gets you 180 billion MD5 tries per second. With a fairly modest budget you can rent a whole lot more GPU power than that. A little Googling gets me several companies offering password hash cracking as a service.

But we're assuming, at the very least, that they're not using MD5 and are instead using SHA-2/SHA-256 or (s|b)crypt.

There's an order of magnitude difference between brute forcing MD5 and brute forcing something better.

[ Parent | on HN ]

Re:LivingSocial Hacked – 50 Million Customers Affected by floody-berry on Friday April 26, 2013 @09:00PM (#5616368)

http://hashcat.net/oclhashcat-plus/

MD5 is 2-3x as fast as SHA-1

MD5 is 5-7x as fast as SHA-256

I don't know why anyone would assume they are using anything better than MD5/SHA-1 considering the history of incidents like this.

[ Parent | on HN ]

Re:LivingSocial Hacked – 50 Million Customers Affected by floody-berry on Sunday April 28, 2013 @05:55AM (#5620770)

https://www.livingsocial.com/createpassword: "LivingSocial passwords were hashed with SHA1 using a random 40 byte salt."

Shocker!

[ Parent | on HN ]