Users Ashley Madison Had Often Name As Password

Users of the Ashley Madison website often used their username and password, so researchers have discovered. The group of researchers called Cynosure Prime showed last week that by some programming errors crack the password hashes of Ashley Madison are simple. At the hack of the cheaters website approximately 36 million password hashes were stolen.

Hashes to ensure that the user passwords are not immediately visible to an attacker in case the website is hacked. Ashley Madison used before a strong hashing algorithm, but by various programming errors hashes prove yet easy to crack. The researchers have cracked 11.7 million password hashes.

It shows that mainly weak and insecure passwords were used. So there were three million passwords of six characters and there were slightly less than 3 million, which consisted of eight males kara. The shortest password was cracked one character long. Nearly 10 million passwords only consisted of small letters or lowercase letters and numbers.

User Name

The researchers were also curious how many users are using their username and password. A total of 630 000 passwords were found that matched the user name. The investigators noted that the actual number is higher as possible, since there are obvious only obvious mutations were used. If there was more combinations of uppercase and lowercase letters sought was the true number is likely higher. The researchers argue that these passwords could be cracked too easily without programming errors found.

Striking Passwords

Instead of publishing a list of the Top 10 most common passwords, the researchers decided to create a collection of distinctive passwords. It is about passwords as allthegoodpasswordshavegone ',' youwillneverfindout ',' everynameitriedwastaken ',' goodguydoingthewrongthing ',' thisisagoodpassword 'and' correct horse battery staple ", known from the xkcd strip.

Researchers Crack 11 Million Passwords Ashley Madison

Researchers have managed to crack more than 11 million passwords of Ashley Madison users, as they have announced today. The group of researchers called himself the cynosure Prime and examined the data that was stolen by the cheaters website. Attackers managed to steal gigabytes of data at Ashley Madison, including hashed passwords of users.

It involves a total of 36 million password hashes. Ashley Madison had the passwords are not stored in plain text, but in hashed form. This makes them not directly readable, but they can be cracked. For hashing the password had Ashley Madison the bcrypt algorithm used, and there was also a "salt-made 'use. This makes it much more difficult to crack password hashes. In a weaker algorithm, such as MD5, it is possible to try millions of password combinations per second. In the case of the gesalte bcrypt hashes came another researcher with his computer not go beyond 156 hashes per second. This investigator knew in five days 4000 passwords to crack.

It was therefore argued that the cracking of all Ashley Madison password hashes would last for centuries. That now seems not to be so. The researchers from Cynosure Prime investigated namely the second amount of data that was recently put online. In it they found information that helps them with the bcrypt hashed passwords could crack much faster. "Instead of cracking the slow bcrypt hashes, which is currently a hot topic, we decided to choose a more efficient approach and attack the MD5 tokens," the researchers said in their explanation.

The cheaters website appears to have used for reasons still unknown MD5 tokens. These tokens can be cracked much simpler than the bcrypt hashes. The information from the cracked tokens could then be used to crack the hashes bcrypt, she discovered. Since the researchers two weeks ago with their research, they began now more than 11.2 million bcrypt hashes cracked. In total there were in the stolen data over 15 million tokens.

Director Ashley Madison Departs After Massive Hack

The director of Ashley Madison has resigned after attackers managed to steal confidential data of 32 million users, including names, addresses, email addresses and hashed passwords. Also all kinds of confidential business information were stolen, including e-mails.

It was gigabytes of data that have been published in part last week. In a statement enables Avid Life Media, the company behind Ashley Madison CEO Noel Biderman which has resigned and no longer works for the company. Until a new director was appointed the existing management team will lead the company. The company also states that it is still working on the settlement of the attack and actively with international investigative agencies work together to identify the perpetrators.

Researcher Cracks 4000 Passwords Ashley Madison

A researcher has managed to crack 4000 passwords of users of Ashley Madison, which demonstrates how important it is to choose a strong password. Attackers managed last month to steal a large amount of data from Ashley Madison, the site for cheaters.

The data were published last week in part. Among the stolen data there were also 36 million password hashes. Ashley Madison had the passwords are not stored in plain text, but in hashed form. This makes them not directly readable, but they can be cracked. Dean Pierce, Linux security engineer at chip giant Intel, password hashes ended with his special "squat machine" to crack.

Computer Pierce consists of four R9 290 ATI video cards. For hashing the password had Ashley Madison the bcrypt algorithm used, and there was also a "salt-made 'use. This makes it much more difficult to crack password hashes. In a weaker algorithm, such as MD5, it is possible to try millions of password combinations per second. In the case of the make bcrypt hashes came Pierce with his computer not go beyond 156 hashes per second.

The experiments also revealed the extent of the number of password hashes problematic, so he could load 6 million of the 36 million password hashes. For cracking the hashes he used the RockYou dictionary. RockYou is a company developing widgets for social media. In 2009 it was hacked, giving attackers more than 32 million managed to steal passwords. These passwords were stored in plain text, and finally appeared on the Internet. Since then the passwords of RockYou be used by many researchers as the default password cracking.

Crack Time

Pierce had his machine power for five days, during which he finally managed to crack 4000 passwords. That equates to 32.6 cracked passwords per hour. It also showed that there were 1191 unique passwords between. The most common password is "123456", which occurred 202 times. It also showed that 105 users had chosen the password "password". Pierce made ​​a Top 20 of the most common passwords. The list is very similar to other password lists that are regularly published.

According to the researcher, it is probably impossible to crack each bcrypt password, but will in the case of Ashley Madison eventually many passwords are outdated anyway. It is in this case especially for weak passwords which are found in many dictionaries, or simply through brute force to retrieve his. Thus, on the list of passwords of the short Pierce especially less than eight characters.

Subscribers Ashley Madison Extorted via E-mail

Several subscribers cheaters website Ashley Madison became the target of extortionists who threaten to inform their partner unless they pay an amount in bitcoin. Both American and New Zealand subscribers have received the email.

The email warns that the cost of a divorce lawyer if the partner comes behind the cheating, or anything revealing to have the data for consequences if someone is already in a separation procedure. It also warned of the reaction of family and friends as they discover that the person in question was active on Ashley Madison, so reporting CoinDesk and Stuff.

The extortionist then demands two bitcoins, what with the current exchange rate is 410 euros. How many subscribers have received the e-mail or run from the threat is unknown. Attackers managed last month to hack the website Ashley Madison this week and made ​​a part of the data publicly available. The media has already speculated that subscribers would be extorted possible.

No New Data Ashley Madison Users Put Online

Several media reports that the attackers behind the hack of Ashley Madison information of users have put online, but it is the same data that Sunday had already been made ​​public. Attackers then made ​​known to the data of over 37 million users had captured, as well as all kinds of business data of a site for cheaters.

The attackers threatened to remove all data online as Ashley Madison has not been taken off the air. The website is still online. Still, the threat has not yet been implemented and there are no new data made public. In announcing the hack data from two users were mentioned. It is the real name, username, registration date, complete address, email address, sexual fantasies, desires and password hash of an American man.

In the case of the second user it comes to someone from the "full delete" function had used. This option allows users of the website for $ 19 it removed their profile. However, the purchase details have been preserved, said the attackers. In this case it is the user's name, address and sexual fantasies. His username, password hash and email address are not mentioned.Ashley Madison is a website for people who want to cheat. Because of the incident, the website decided users free of charge to raise their profile.

Ashley Madison Lets Users Remove Free Profile

The hacked website for cheaters Ashley Madison offers users the option to remove their profiles free of charge, after an attacker there previously managed the data of 37 million users to steal. It would be profiles with "secret sexual fantasies," nude photos and user calls, including related credit card transactions, real names and addresses.

How the attacker access data to gain knew was not disclosed, but Avid Life Media, the company behind Ashley Madison, says that all "unauthorized access" are closed. There is also with investigating authorities initiated an investigation into the attacker and the company claims that the perpetrator will finally be held accountable.

Delete Function

In addition to the theft of user data, the attacker claimed that the website users cheated. Ashley Madison offers users: the ability to delete their profiles fee of $ 19, but the striker claims that this feature does not work properly. Details of purchases made with a credit card, including real names and addresses, remain as the attacker in the database behind.

In a statement enables Avid Life Media that paid delete function deletes all information related to the user and communication of the user. However, it is unclear whether the card data is included. The delete function last year, the company would have resulted in $ 1.7 million. However, because of the incident, it was decided that users are now free information deleted their profile.

37 Million Users Information Stolen Ashley Madison

Attackers have managed the data of 37 million users of AshleyMadison.com to steal a website for adulterers, and threaten to reveal if the site is not closed. In addition to the user data would also financial information and other business data are stolen.

The attackers threatened to publish the captured data as Ashley Madison and Established Men, a dating site for "young women to find successful men" from the same company can not be taken offline. It would be profiles with "secret sexual fantasies," nude photos and user calls, including related credit card transactions, real names and addresses. Ashley Madison claims to have over 37 million users. Furthermore, will the business documents and e-mails are posted online, says IT journalist Brian Krebs .

Remove Function

Next, the attackers that the delete function offered by the website is not working. Users may remove their profile data for $ 19. This feature, called "full delete", the company last year would have yielded $ 1.7 million. However, not alll data deleted.Details of purchases made with a credit card, including real names and addresses, continue to follow the attackers in the database behind.

Avid Life Media, the company behind the two Web sites, confirms in a statement that it is indeed hacked. According to him, it would have invested in the latest privacy and security, but this could not prevent the intrusion. Furthermore Avid Life Media late declaration know nothing, except that the investigation into the extent of the incident is ongoing.