Cracking Millions Of Ashley Madison Passwords In Quadruple Quick Time

Signing up to a dating site which offers the platform for affairs while expecting all your data to remain safe looks to be rather stupid, after the many revelations which have been exposed concerning the Ashley Madison website. If the owners thought it could not be embarrassed any further, a cracking team by the name of Cynosure prime, not affiliated with Amazons video service, has cracked roughly 11 million passwords in just 10 days.

They managed this with help from an error implemented by Ashley Madison themselves, this involved breaking the passwords which were secured using MD5 (Message Digest Algorithm) which is a faster algorithm but far less secure than others. Using the second leak of data as a study group, cynosure prime attacked the md5 tokens, the passwords were set to bcrypt which is much more secure and therefore should have been harder to crack. Problem is, cynosure prime found that the commit was changed on the 14^th June 2012 to 1c833ec7, this meant accounts could be cracked which had been created prior to this date with “simple salted MD5”.

What was expected to take years to solve only took 10 days to expose such naïve security protocols within Ashley Madison’s tech structure. The era of basic security has long since ended and businesses need to understand the scale of threats which are targeting their valuable data, Mrs Madison won’t be the last to experience such data loss. This should also be yet another warning against the crusade to ban effective encryption which is an essential tool to protect consumers from web-based data theft.

If you have a spare few minutes then by all means take a look at the full detailed explanation of the techniques used to crack the passwords, its worth a read.

Thank you cynosureprime for providing us with this information.

Image courtesy of winknews