TechSpot en EspañolMost Popular
| Top Stories | Just in | Featured |
11 awesome applications you've never heard of featured
Microsoft to offer three-user Windows 7 Family Pack?
2K Games offers "Huge Game Pack" on Steam for $54
Fallout 3 gets 50% price cut on Steam this weekend
Apple issues advice on iPhone 3GS overheating
Firefox 3.5 breaks 5 million downloads in 24 hours
TS Community
| User Gallery | Recent Discussion |
 linesss by JoeM076 |  current desktop pic by Hedgehog |
 My AMD Rig #2 by Whiffen |  Garry's Mod: Flying car! by TimeParadoX |
TechSpot RSSInformation Technology
Google serves as MD5 password cracker
Cambridge University researcher Steven Murdoch successfully used Google to help crack a password used by an attacker who had hacked into his blog a few weeks ago and created a user account.
After he quickly disabled the account, Murdoch became curious to know what the hacker’s password might be. Since his website uses WordPress, which stores passwords as unsalted MD5 hashes in its user database, he wrote a script which hashed all words in both the English and Russian dictionary to find a match. He had no luck, however, so he turned to Google.
He took the MD5 password hash from the database and stuck it into Google, which revealed multiple sites featuring the word “Anthony”, the attacker's password. While this certainly is an interesting trick, Google’s usefulness as an MD5 cracker is fairly limited as it only finds hashes of things that people have hashed before, thus the importance of using hard to guess passwords.
After he quickly disabled the account, Murdoch became curious to know what the hacker’s password might be. Since his website uses WordPress, which stores passwords as unsalted MD5 hashes in its user database, he wrote a script which hashed all words in both the English and Russian dictionary to find a match. He had no luck, however, so he turned to Google.
He took the MD5 password hash from the database and stuck it into Google, which revealed multiple sites featuring the word “Anthony”, the attacker's password. While this certainly is an interesting trick, Google’s usefulness as an MD5 cracker is fairly limited as it only finds hashes of things that people have hashed before, thus the importance of using hard to guess passwords.
Related Stories
User Comments (2)
Post a comment| phantasm66 on November 23, 2007 1:01 PM | While this certainly is an interesting trick, Google’s usefulness as an MD5 cracker is fairly limited as it only finds hashes of things that people have hashed before, thus the importance of using hard to guess passwords.
But people DON'T use hard to guess passwords - they use crappy ones! I think this is a great hack. I love it.
|
| phantasm66 on November 26, 2007 3:20 AM | Hahahah it works!
Go to http://pajhome.org.uk/crypt/md5/ Grab an MD5 of a common name, like Paul, David, Mike, etc. Put the result into Google and watch it find it!!
|
