Mozilla inadvertently leaks 44,000 users' passwords

[tox]

What can only be described as a large mistake by someone, Mozilla somehow accidentally left a partial database of user accounts on a public server. This breach in security went on for some time, until on December 17 after Mozilla was notified by a security researcher of the issue. The leaked database contained 44,000 inactive accounts for addons.mozilla.org that had passwords hashed using md5 technology. This leak only affected accounts created before April 9, 2009, as since then up through now Mozilla uses a SHA-512 password hash with per-user salts to protect account data.

read more here

Note how unsecure MD5 is http://md5encryption.com/ http://md5decryption.com/

http://en.wikipedia.org/wiki/Md5#Security

[forkbomb]

Change your passwords often, use strong passwords, use something like keepass, don't use the same pass on multiple accounts, yadda yadda.

[Now, to quibble:
While md5 is certainly deprecated and shouldn't be used because far better algorithms can be used with acceptable processor overhead, a lot of people pushing the md5 "panic button" misunderstand both hash encryption and the nature of md5's vulnerabilities. It's trivial now that md5's mathematical weaknesses are known to generate collisions but that's a different type of attack from being able to literally reverse a digest as if it were two-way encryption/decryption. We all know already that md5 is vulnerable to a number of collision attacks.

But as far as I know md5 isn't so broken that you can derive plaintext knowing only a given digest. If anybody's able to derive the plaintext of a given md5 digest without use of a rainbow table and knowing only the digest, I'd like to see a whitepaper on how it can be done. I've seen a bunch of kooks on forums and blogs claim that they can literally reverse digests knowing only the ciphertext, but they never explain how they do it. Odd.

Part of why md5 is weak, as far as "deriving" plaintexts goes, is that it's a very fast algorithm, thus making the process of md5 table generation comparatively faster than generating rainbow tables for more processor-intensive algorithms.]

[Firewing1]

Although there doesn't seem to be any real harm done as every download of the file was accounted for, this is why salts (and minimum password lengths) are incredibly important.

Even if some theoretical hacker had access to a database with 44,000 MD5 password hashes, if they were all salted and the plaintext passwords had a 6 character minimum length requirement, it would be exceedingly difficult to generate anywhere near enough rainbow tables to gain access to many accounts.

This is also another reason I like to use at least 1 punctuation mark or other symbols in my passwords when allowed... Many rainbow tables don't take those into account.

[stevea]

Firewing1 - good intention but I don't think you understand the crypto issues. Passwords are not what many ppl think - you have a hash function dependent on plaintext passwd and the "random" salt. which is often just a few clock bits at the time the passwd is set.

char * hash(char *passwd, char *salt);
Or "man crypt"
char *crypt(const char *key, const char *salt);

The salt is always directly included in the passwd field. So in /etc/shadow we have:
stevea:$6$mYT8S4Hs$sVAufsKQSN/ZlUaMSxwRUSkR.dxhjDX6oJU.aUdNcgiC4UO.nj3oi/0shTBAmVrsr3DxETNTIVNiZ6oZylb2q0:

Says that stevea is
$6: Using sha-512 hash (not md5)
$mYT8S4Hs: salt value
$sVAufsKQSN/ZlUaM... : the hash of the plaintext passwd.

When you steal the passwd you know the hash method and the salt.

The only thing you have to do to crack the passwd, is create ANY plaintext passwd, that when combined w/ the salt produces the same hash. There are many passwords that produce the same hash - you only need to find a collision, not the original passwd.

So the as forkbomb says, the problem of cracking is trivial IF the hash is simply computed, and the resulting hash is small. Here the resulting 86 character is a mapping of 512bit of content. The hash-space (2^512 patterns) is vast for sha-512, so there aren't high probabilities of a collision for common 6-12 character passwords.

Even if some theoretical hacker had access to a database with 44,000 MD5 password hashes, if they were all salted and the plaintext passwords had a 6 character minimum length requirement, it would be exceedingly difficult to generate anywhere near enough rainbow tables to gain access to many accounts.

Some real-world hacker does have that, and no - it's not hard to crack 44k 6 char passwds using brute-force. The are only about 96 printable characters(depends on locale), including the ~32 punctuation marks. So there are only 782 Billion 6 character passwds, and a top end PC core might brute force those in several days. You can get non-comprehensive results results a lot faster using dictionaries and rule-based attempts.

Picking less-likely passwords with punctuation, numbers and various cases improves the entropy in the passwd which inherently makes it harder to guess, but no need to guess a short 6 char passwd.

Of course with that same PC, it might take a year or two to test all 7 char passwds and a century or two to check all 8 char passwds, tho' still quite do-able on some more serious cell processors that could be accessible to a serious hacker. The current crypt only accepts 56 bit keys, the equivalent of 8 characters w/ perfect entropy.
=======