Most Popular
| Top Stories | Commented | Featured |
Weekend Open Forum: Have you upgraded to Windows 7 yet? What is there to like/not? featured
Tech Tip of The Week: Turn Off your Display Using a Windows Shortcut and More featured
Netflix PS3 streaming arrives tomorrow
Dell's ultra-thin Adamo XPS to ship soon for $1,799
Windows 7 crushed Vista in early launch sales
Nvidia Tegra 2 to double performance, arrive next year?
TS Community
| User Gallery | Recent Discussion |
 Full View - Samurai by Jasio- |  More Vista by GameJunkie72792 |
 lolz by Adhmuz |  n755182379_657635_45 46 by Punya |
TechSpot RSSInformation Technology
Google serves as MD5 password cracker
Cambridge University researcher Steven Murdoch successfully used Google to help crack a password used by an attacker who had hacked into his blog a few weeks ago and created a user account.
After he quickly disabled the account, Murdoch became curious to know what the hacker’s password might be. Since his website uses WordPress, which stores passwords as unsalted MD5 hashes in its user database, he wrote a script which hashed all words in both the English and Russian dictionary to find a match. He had no luck, however, so he turned to Google.
He took the MD5 password hash from the database and stuck it into Google, which revealed multiple sites featuring the word “Anthony”, the attacker's password. While this certainly is an interesting trick, Google’s usefulness as an MD5 cracker is fairly limited as it only finds hashes of things that people have hashed before, thus the importance of using hard to guess passwords.
After he quickly disabled the account, Murdoch became curious to know what the hacker’s password might be. Since his website uses WordPress, which stores passwords as unsalted MD5 hashes in its user database, he wrote a script which hashed all words in both the English and Russian dictionary to find a match. He had no luck, however, so he turned to Google.
He took the MD5 password hash from the database and stuck it into Google, which revealed multiple sites featuring the word “Anthony”, the attacker's password. While this certainly is an interesting trick, Google’s usefulness as an MD5 cracker is fairly limited as it only finds hashes of things that people have hashed before, thus the importance of using hard to guess passwords.
Related Stories
User Comments (2)
Post a comment| phantasm66 on November 23, 2007 1:01 PM | While this certainly is an interesting trick, Google’s usefulness as an MD5 cracker is fairly limited as it only finds hashes of things that people have hashed before, thus the importance of using hard to guess passwords. But people DON'T use hard to guess passwords - they use crappy ones! I think this is a great hack. I love it.
|
| phantasm66 on November 26, 2007 3:20 AM | Hahahah it works! Go to http://pajhome.org.uk/crypt/md5/ Grab an MD5 of a common name, like Paul, David, Mike, etc. Put the result into Google and watch it find it!!
|
