Velocity Technical Archive
Are the Hashed AshleyMadison.com Passwords Secure?
Published 2015-08-25 • Blog
Archived Reference: This is a historical technical article preserved from the Velocity Technologies knowledge base. For current Phoenix and East Valley managed IT services, explore our managed IT services or cybersecurity solutions.
When the AshleyMadison.com website was hacked the hackers released the entire dump of hashed passwords. Hashed passwords are passwords that have been converted from plaintext to a garbled set of characters so that if someone compromises the file they cannot simply read the passwords. In this example Ashley Madison used salted bcrypt with a cost of 12 for their encryption. If you research this encryption you will find things like "it's not worth the time cracking". However, if you actually go through the steps you can actually extract passwords.\nThe first thing to do obviously is head over to Pirate Bay and download the torrents which contain all the files:\nhttps://thepiratebay.mn/torrent/12237184/The_Complete_Ashley_Madison_Dump_from_the_Impact_Team\nhttps://thepiratebay.mn/torrent/12256948/Ashley_Madison_2nd_dump_20_GB\nIf you get these torrents on a Windows box you're going to have to enable SSH and use WinSCP to transfer the files to your Kali Linux box.\nThe first thing to notice is they dumped the member_login.dump as a mysqldump file. So we perform the following steps:\ngunzip member_login.dump.gz\ntr , '\\n' < member_login.dump > member_login.txt # switching to commas for the new lines\ngrep "\\$2a" member_login.txt > member_login2.txt # grepping out hashes\ntr -d "\\'" < member_login2.txt > member_login_final.txt # single quotes need to be removed\nThis remaining file will be 2.1GB with 36 million passwords. When we run this command against it...\n./oclHashcat32.bin -m3200 -a0 member_login_final.txt rockyou.txt --force --weak-hash-threshold 0\nLet's say you are not lucky enough to have a GPU based cracker. You can also just use the regular hashcat program\n\ncd /usr/share/hashcat/\n./hashcat.bin -m3200 -a0 /root/AshleyMadison/member_login_final.txt /usr/share/wordlists/rockyou.txt\n\nThis attack is a basic -a0 attack using the rockyou.txt file included with Kali Linux. This will start extracting passwords, however be warned, this is going to be extremely slow! Perhaps AshleyMadison.com should have used a security consulting company?
