Deciphering Ashley Madison Passwords

A month ago, more than 36 million password hashes of users of the site for adultery Ashley Madison got into open access. You can download the database, for example, from this torrent (also dump number 2 and dump number 3 on the darknet via the gate).



Passwords are processed by bcrypt hash functions. At first glance, such protection seems relatively reliable. But the experts from the CynoSure Prime hacker group decided not to bluntly bcrypt stupidly, but to dig into the source code of the Ashley Madison backend and frontend (the sources are available at the above torrent). They studied the hashing algorithm itself.



Search source code gave the result. As it turned out, the hashes themselves were encrypted with bcrypt, but two insecure methods using MD5 were used to create the $loginkey variable. Thus, instead of bruteforce hash bcrypt directly, what the whole Internet is doing now, hackers have directed their efforts at bruteforce weak tokens md5(lc($username).”::”.lc($pass)) and md5(lc($username).”::”.lc($pass).”:”.lc($email).”:73@^bhhs&#@&^@8@*$”) .

')

From the code in the amlib_member_create.function.php file (lines 69, 70), it became clear that the $loginkey variable is generated by MD5 hashing of the user name and password in lower case. Before the code change on June 14, 2012, all the hashes can be opened by simply hacking MD5.



Similarly, another method of generating $loginkey , which is specified in the AccountProvider.php code.



The hacker group has not laid out the decoded passwords, but anyone can get them on their own, following the published instructions .



Later, CynoSure Prime revealed interesting statistics on Ashley Madison passwords.



First, here are the Top 100 most popular passwords and the number of entries of each of them.









Further - more interesting. The analysis showed that more than 630,000 passwords coincide with the username . That is, even without exploiting weaknesses in the hashing algorithm, these passwords are easy to recover.



But the most interesting passwords. They are not included in the list of Top 100 popular, but show a funny way of thinking of some users. The list is just for fun.



These think that adding a few words makes the password more secure.

mypasswordispassword

superhardpassword

thebestpasswordever

thisisagoodpassword



Doubt their decision to register on the site for adultery

ishouldnotbedoingthis

ithinkilovemywife

thisiswrong

whatthehellamidoing

whyareyoudoingthis

cheatersneverprosper

donteventhinkaboutit

isthisreallyhappening



Cheating without hesitation

likeimreallygoingtocheat

justcheckingitout

justtryingthisout

goodguydoingthewrongthing



Confused the site for cheating from dating sites

lookingfornewlife

friendswithbenefits



Doubt the professionalism of hackers

youwillneverfindout

youwillnevergetthis

secretissafewithme



Passwords from the xkcd comic (https://xkcd.com/936/)

batteryhorsestaple

correcthorsebatterystaple



Someone foresaw the activity of hackers and wants to hide

nothingfound

theywererobots

nobodyhere



Other jokes

everynameitriedwastaken

allthegoodpasswordshavegone

lickemlikeshelikesit

lildickinyourpussyn0w

satisfactionwithlicking

blackfromthewaistdown

smalldickbuthardworker