Tuesday, August 25, 2015

What I learned from cracking 4000 Ashley Madison passwords

The Plan

When the Ashley Madison database first got dumped, there was an interesting contingent of researchers talking about how pointless it would be to crack the passwords, since Ashley Madison was using salted bcrypt with a cost of 12.  I thought it might be a fun experiment to run the hashes on a cracking rig of mine to see what I could actually get out of it.

The Rig

My cracking rig is your typical milk carton style setup, as seen on Silicon Valley.

It was originally purchased a couple years ago as a cryptocoin mining rig for about $1500 in bitcoins.  Pretty much just a stack of four ATI R9 290s running PIMP (http://getpimp.org).  PIMP is a Debian based USB boot environment designed for plug and play cryptocoin mining.  I find it super convenient to use because it deals with all the GPU driver BS, and by default gives you the most optimized setup for whatever cards you're using.  To give it the magical cracking powers, I dropped the most recent oclHashcat in there as well.

The Procedure

So, the data showed up in the form of a mysqldump.

gunzip member_login.dump.gz
tr , '\n' < member_login.dump > tmp.txt # switching commas for newlines
grep "\$2a" tmp.txt > tmp2.txt # grepping out hashes
tr -d "\'" < tmp2.txt > am.txt # removing single quotes

Holy cow, this thing has 36 *million* hashes in it.  The leak was still pretty new at the time, so I hadn't realized how many accounts were actually in the dump, but just the file of hashes themselves was 2.1 gigs.  I moved the file over to the cracking rig and ..

oclHashcat v1.36 starting...
Counting lines in am.txt
ERROR: Insufficient memory available

Huh.  Well that sucks.  I use head to grab the first million lines, and the thing fires up just great.  This is my first time seeing the real benchmarks for the crack, and it looks something like this:

Speed.GPU.#1...: 39 H/s
Speed.GPU.#2...: 39 H/s
Speed.GPU.#3...: 39 H/s
Speed.GPU.#4...: 39 H/s
Speed.GPU.#*...: 156 H/s

Yes, that's right, 156 hashes per second.  To someone who's used to cracking md5 passwords, this looks pretty disappointing, but it's bcrypt, so I'll take what I can get.  I start seeing how many hashes I can do at a time.  I double to 2 million hashes, then 4, and finally I see the Insufficient Memory error again when I hit 8 million hashes.  I drop it down to 6 million, and that seems to work just fine.  So my final list of hashes to crack is the first 6 million hashes from the database dump.

My final command looks like this:

./oclHashcat32.bin -m3200 -a0 am2.txt rockyou.txt --force --weak-hash-threshold 0
This is just a super basic -a0 attack using the famous rockyou.txt wordlist.  I also set a script to take a snapshot how how many passwords I had cracked every 10 minutes.

And now.. we wait..

The Data

So, after five days and three hours, I hit 4000 passwords, which I figured was a good time to stop.  I pulled the 10 minute snapshots together, and as it turns out, this is what the final graph of cracks over time looked like:

Now, of course what immediately jumped out at me was how insanely linear this is.  It comes to about 32.6 cracked passwords discovered per hour.  I had expected the curve to shoot up and level off over time as passwords became more rare.  This could be because I was still in the "dumb password" phase, but it's hard to tell.  It may not look like it at first, but there are 741 data points in this graph.

Some interesting numbers, of the 4007 cracked passwords in the final list, only 1191 of them were unique.  Dropping the list of cracked passwords into http://www.textfixer.com/tools/online-word-counter.php, we get a nice list of the most popular passwords cracked so far.  Here's the top 20 for your amusement:

123456 202
password 105
12345 99
qwerty 32
12345678 31
ashley 28
baseball 27
abc123 27
696969 23
111111 21
football 20
fuckyou 20
madison 20
asshole 19
superman 19
fuckme 19
hockey 19
123456789 19
hunter 18
harley 18

So, maybe these passwords were all throwaways.  It may also be infeasible to crack any given bcrypt password, but given enough users, it doesn't matter if passwords are bcrypted and salted, a ton of passwords are eventually going to pop out.

This is the goodbye message I got when I stopped the crack.

Session.Name...: oclHashcat
Status.........: Aborted
Input.Mode.....: File (rockyou.txt)
Hash.Target....: File (am2.txt)
Hash.Type......: bcrypt, Blowfish(OpenBSD)
Time.Started...: Thu Aug 20 11:40:32 2015 (5 days, 3 hours)
Time.Estimated.: 0 secs
Speed.GPU.#1...: 39 H/s
Speed.GPU.#2...: 39 H/s
Speed.GPU.#3...: 39 H/s
Speed.GPU.#4...: 39 H/s
Speed.GPU.#*...: 156 H/s
Recovered......: 4007/6000000 (0.07%) Digests, 4007/6000000 (0.07%) Salts
Progress.......: 60396544/86002302412928 (0.00%)
Rejected.......: 0/60396544 (0.00%)
Restore.Point..: 0/14343296 (0.00%)

As you can see, the crack still had quite a ways to go when I aborted it.

All my data from this study can be found here:

am-checkpoints.txt : log of passwords cracked every 10 minutes
am-freq.txt : frequency count of cracked passwords
am-pass.txt : final list of cracked passwords
am-sorted.txt : list of passwords, sorted alphabetically
am.pot : oclHashcat potfile generated by the crack

thanks everyone!  you can follow me on the tweeters @deanpierce


/u/rallias has pointed out that uniq -c will do a frequency count, and I'm dumb for using a website :-)


  1. Any luck with the NTLM hashes from the domain controller? I've tried brute-forcing up to 8 characters, but don't want to run my single gpu for 2 days to try 9 characters.

    1. got about 7, then bailed. Saved the restore file for later.

  2. I wonder how much of a difference a bcrypt "workload" setting of 13 instead of 12 would make. Theoretically the time to crack a password would double, but it might be nice to put this to the test on a realistic "cracking rig" like yours. (also, how do think this machine compares to your average, reasonably sophisticated, attacker?)

    The 12 that's used by these passwords seems to be pretty standard, used in most systems as a default value. Perhaps now it's time to start considering changing our software to use a higher default? This is the whole point of bcrypt; so that we _can_ adjust the workload as hardware gets faster.

  3. 4000 is not much.

    So far I cracked 19664 hashes and I don't have any special hardware and I'm using neither JTR or Hashcat.

    I'm using the bcrypt module for python and every time I crack a hash I write it to the database (added a column to the db, it took several hours to mysql to do that).

    The difference is I din't focus on a limited range of accounts.
    I first checked for accounts where the username is also used as the password : there is a lot...If I try every hash I should have more than 600000 cracked hashes at the end.

    Then in a second time I'm testing hashes against a small list of the most common passwords... I have pretty good results too.

  4. I do not have a compatible video card and I'm just trying to test this in theory. So I'm just using Hashcat. I ran the following command and it keeps stating Killed and dies after 3 minutes. Can someone offer some insight?

    root@kali:/usr/share/hashcat# ./hashcat.bin -m3200 -a0 /root/AshleyMadison/member_login_final.txt /usr/share/wordlists/rockyou.txt --debug-file=/root/AshleyMadison/debug.txt

    Initializing hashcat v0.49 with 1 threads and 32mb segment-size...


  5. I don't know how to parse the 156 H/s speed, It seems that you checked about the first 2000 passwords from the rockyou.txt file against 6000000 hashed passwords in 5 days 3 hours. That's about 12G hashes in 5*86400 + 3*3600 seconds ... which is 27100 H/s

  6. hey, just wanna say thanks, someone i know found out their email with personal details were on the ashley madison site, that they didnt create. I downloaded the dump and got the hashed password with winhex, used oclhashcat as per your method with rockyou and 4.5 hours later on my lowly windows pc , it recovered the password.

  7. Probably a silly question: how much does it change the probability of successful brute force password cracking by knowing that bcrypt was used? I mean in a more general sense - do you really need to know the encryption method to crack, or is it moot when using these tools?

  8. Me and Blogging is the best site to download the nulled of
    40+ Mixed Premium Action

  9. This comment has been removed by a blog administrator.

  10. Take a look at http://www.resourceforums.net/ t0 grab Ashley Madison decrypted

  11. "How we cracked millions of Ashley Madison bcrypt hashes efficiently" http://cynosureprime.blogspot.ch/2015/09/how-we-cracked-millions-of-ashley.html

  12. Have you tried creating a password that is impossible to be cracked? Well, I did, and it made me completely safe and secure while handling all business activities online.

  13. شركة تنظيف
    تهتم شركة قمم التميز باعمال وخدمات التنظيف فى اى مكان فى تنظيف الشقق – البيوت – المنازل – المصانع واى مكان يحتاج الى اعمال التنظيف من اجل ان تساعد فى الوصول الى افضل ما تجدة من نتائج مميزة شركة تنظيف كنب بخميس مشيط
    تنظيف يحتاج للاشياء معقدة من الادوات ، مثل الغرف المنزل لها ادوات التنظيف الخاصة، الصالون المدهب يحتاج لمنظف الخاص ، وسطح فى المنزل يتطلب مواد متخلفة ، فكثير من المنظفات المطلوبة حتى تكون عملية التنظيف سهلة ومن المنظفات : مبيض التواليت ، منظف الحمام، المطهرات ، المنظف للنوافذ شركة تنظيف موكيت بخميس مشيط
    والارضيات والغسيل ، سائل الغسيل واعمال المنزل الصغيرة يمكن انجازاها بفوطة جافة ومنظف جيد ، المنظف المصنوع بقل الامكنيات ، معلقتين من الخل الابيض مع لتر من الماء الساخن وضعهم فى بخاخة . بيكربونات الصوديم لتنظيف البلاط يمكن مزج ثلاثه اجزاء من الماء الساخن مع جزء من الصودا لتنطيف الفرن والثلاجة ، وبيكربونات الصوديم بقليل من سائل الجلى يتكون معجون سميك صالح لتنظيف الحمام ، يمكن استخدام بيكربونات الصوديم وضعه فى صحن صغير ولطرد الروائح الكريهة من الثلاجة ، كربونات الصوديم فعالة فى ازالة البقع الدهنية لانها قلوية ويجب لبس قفازات لاستخدامها شركة تنظيف مجالس بخميس مشيط
    الخل الابيض وعصير الليمون يمكن تنظيف السطوح الزجاجية والخشبية المصقولة ، ويمكن استخدام الخل الابيض والليمون للتخلص من الروائح الكريهة والتعطير .
    عند التنظيف يجب لبس القفازات لحماية الايدى من المواد المنظفه ، ويمكن لبس الفقازات عند غسيل الصحون وتكون مخصص لعمل فى المطبخ .
    والمنزل النظيفة من غير فوضوى أجمل بكثير وافضل ،وإذا توفر جميع الادوات النظافة داخل بيت تكون عمليه النظافة سهلة شركة تنظيف مساجد بخميس مشيط
    للتنظيف المنزل من اعلى الى اسفل ، اى تنظيف الغبار من اعلى الى اسفل ويمكن استخدام الاجهزة الكهربائية فى عملية التنظيف .
    تنظيف النوافذ باستخدام قطعة قطنية فى مسح الزجاج وللتجفيف بورقة من الجرائد ، وتنظيف الاسطح الزجاجية للمنضدة باستعمال عصير ليمون ودعكها ثم تجفيفها بفوطة ورقية. ويمكن استعمال معجون الاسنان فى ازالة الخدوش الصغيرة من الزجاج . شركة تنظيف سجاد بخميس مشيط
    لتنظيف الاثاث استعمال منظف على قليل من نشادر ، عدم وضع الاثاث فى أشعه الشمس فالشمس تجفف الأثاث ، للتخلص من الحلقات التى تكون على المنضدة بقليل من المنظف مع النشادر ثم مسحها بفوطة جافة ثم تلميعها بالملمع .

  14. نحافظ على مستوى النظافة دائما فالشعور بعد النظافة شء يقلق الجميع لذلك تحرص دائما شركةاحباب المدينة ان تكون عند حسن ظن عملا ئها بها

    شركة نظافة بالمدينة المنورة
    تقوم باستهدام منظفات ذات مركات عالمية تقضى على جيمع الاوساخ بكل سهولة
    شركة تنظيف شقق بالمدينة المنورة تقوم بتنظيف الشقق والسجاد والكنب اقوى المنظفات وتقوم بتنظيف الحوائط والاثريات
    شركة تنظيف منازل بالمدينة المنورة تقوم بتنظيغ المنازل كل مشتملاتها وكل ركن من اركانهالا تترك اى ركن بدون تنظيف لان لديها العمالة الماهرة وذو الخبرة الكفاية فى عالم التنظيف
    شركة تنظيف فلل بالمدينة المنورة لان الفلل تحتاج لعمالة كثرة وات خبرةفى التنظيف فنحن لدينا كل هذه المميزات
    شركة تنظيف كنب بالمدينة المنورة اذا كنت ترغبين فى تنظفين طقم الكنب الخاص بك فليس لديك سوا شركتنا تمنحك الشعور الدائم بالنظافة

  15. If you have any problem related to Lenovo products do visit us on this link.
    Lenovo Customer Support

  16. We are always here to help you if you are facing some problem regarding iPhone.
    iPhone customer support number

  17. Thank you for sharing the story behind. Enjoying reading it.
    ig viewer

  18. شركة تنظيف بأبها
    تعاني كل سيدة من التنظيف اليومي لمنزلها لكنها قد لا تحصل على النظافة المثالية التي ترغبها، لذا فإن شركة تنظيف بأم الساهك تقدم لكي سيدتي الحل الأمثل لتنظيف منزلك او فيلتك دون عناء منك وبالنظافة المرغوب فيها، حيث ان شركة تنظيف بابها تمتلك فريق من العمال على اعلى مستوى من الكفاءة، ومن خلال شركتنا يمكنك الحصول على ارضيات لامعه ومنزل مرتب وخزانات مياه نظيفة وجدران نظيفة جدا مع الحفاظ على الوانها، وأيضا الكنب والرخام كل هذا وأكثر تجده عندنا في شركة التنظيف بأبها
    شركة تنظيف فلل بابها
    شركة تنظيف منازل بابها
    شركة تنظيف شقق بابها

  19. Online Gambling, Soccer Betting, and Reliable Gamblings the most trusted online bookmaker in Indonesia since 2009 with flagship and favorite games such as SBOBET, IBCBET, CMDBET Bola Tangkas which are in the betting and ball gambling category. Not only that, also provides a variety of other exciting games such as Casino, Bola Agile, Bola Tangkas Online Poker, Cock Saw, Togel, and Shoot Fish. You just have to register yourself with us to play all these excellent games.

    As the Best Indonesian Football Agent and Agent
    We guarantee that we are the best soccer agent Agen Bola Tangkas and agent in Indonesia because we always give satisfied service to every member. The proof of our members continues to grow and we also strive to always provide the best service for all. The main Agen Bola Tangkas thing that we prioritize is ensuring that all data and member transactions are at a high level of security, then we also guarantee a fast, secure and reliable deposit and withdraw transaction so that all our members feel comfortable playing Agen Bola Tangkas online gambling and gambling on. Bonus and Interesting Promo Idol Town

    Provides Bonus and Promo appeal to all, Agen Bola Tangkas including newly registered members and registered members. Everything can enjoy the exciting Bonus and Promo we provide. Therefore do not hesitate to choose us as your betting partner. Register now, Deposit, Play, and Win at gambling balls online

  20. Another necessity is rapid, 24-hour Internet get to. Fundamentally, the machine takes a picture of your beware of the two sides, similarly as a money checking machine would. Check Cashing chicago

  21. Numerous shipper loan moneylenders publicize that the cash will be accessible in as quick as 10 days, and dissimilar to a bank advance that have a settled financing cost, as the sum due and due date are settled every month, regardless of if your business drop. Rather, with a dealer loan the payback originates from future Visa receivables, not stressing your business income. Cash Advances corona

  22. The payday advance loaning industry has prepared for here and now advances that furnish speedy money to individuals with terrible credit or no credit by any means. auto title loans chicago

  23. I like to read your article because it really helps me. Thank you for sharing this post with us.
    Togel Online

  24. a very useful website, very good to always remember and must be taken care of thanks for the information.

    Bandar Togel Terbesar

  25. This comment has been removed by the author.

  26. A very good website, I have never found a website like this, it always works.

    Game Online Terburuk

    Game Online Steam

  27. I began to understand how to write after seeing your article, thank you very much for the very good writing.

    Keuntungan Jualan Online

    Bisnis Online Terbaru

  28. This is the first time I've seen a website that is so good and very natural.

    Situs Mencari Kerja

    Situs Berita Terpercaya

  29. Clint Eastwood is a wonderful actor and director. He tells a story of a 90 year old man facing money youjizz and family issues. However, when he works for the wrong people, he may have money coming in so he can enjoy life but the consequences at the you jizz end will hit him hard.

  30. Interesting post with great story. i will share this on my site below
    Game Online Indonesia

  31. Amazing blog! I found it while browsing on Yahoo News. Do you have suggestions on how to register on Yahoo News? I have tried for a while but it never seems Get there! thank you

    Tanaman Pembawa Rejeki

  32. Heya i’m for the primary time here. I came across this board and I to find It really helpful & it helped me out a lot. I am hoping tto offer something back and help others like you helped me.
    Tempat Wisata Indonesia

  33. Very useful post. Thanks a lot for posting this information on your blog.

    articleblogin | wallpaper | seo techniques | guest blogging

  34. [url]https://bindassnews.com/[/url]

  35. Writing articles that are very interesting and very neat, at first I did not understand how to write good articles, after I saw your website I began to learn and understand how to write the right articles. Thank you for giving a very good example of writing, I will often come to your website to learn how to write like the one on your website.
    bola tangkas hkb

  36. This comment has been removed by the author.

  37. Writing articles that are very interesting and very neat, at first I did not understand how to write good articles, after I saw your website I began to learn and understand how to write the right articles. Thank you for giving a very good example of writing, I will often come to your website to learn how to write like the one on your website.

  38. Given article is very helpful and very useful for my admin, and pardon me permission to share articles here hopefully helped :

    Cara Menyembuhkan Flek Paru Paru Secara Alami

  39. This is Very very nice article. Everyone should read. Thanks for sharing. Don't miss WORLD'S BEST CarGamesDownload

  40. Download and install Vidmate App which is the best HD video downloader software available for Android. Get free latest HD movies, songs, and your favorite TV shows.

  41. Vinings Locksmiths are the Professional Emergency Locksmiths serving the entire Vinings, GA and surrounding areas..We open 24 hours a day. No matter what the emergency is rest assure that our Locksmith is just a phone call away. Our Emergency Locksmiths are licensed and insured to provide
    Vining Locksmith, LLC
    Vinings GA Locksmith Services
    Vining Locksmith Services
    Vining Locksmith Services
    Vinings Locksmiths are the Professional Emergency Locksmiths serving the entire Vinings, GA and surrounding areas..We open 24 hours a day. No matter what the emergency is rest assure that our Locksmith is just a phone call away. Our Emergency Locksmiths are licensed and insured to provide

  42. Your work is very good and I appreciate you and hopping for some more informative posts. Thank you for sharing great information to us.

  43. https://ligatamora.net/

  44. <a href="https://ligatamora.net/>https://ligatamora.net/</a>

  45. Berita Lengkap Seputar Sepak Bola dan Prediksi Bola
    Hai ingin bertukar link ? bisa kunjungi website saya di :

    Berita Bola
    Prediksi Bola
    Jadwal Pertandingan Bola
    Hasil Pertandingan Bola


  46. القضاء النهائي على الأوياخ والبقع من الفرش والموكيت والسجاد والمنازل والشقق والأرضيات نقضي نهائياَ على كافة الملوثات والأوساخ التي تتواجد في كل منزل وفي كل مكان نتواجد على مدار 24 ساعه شركة ركن الامانة افضل شركة تنظيف كنب بابها
    افضل شركة تنظيف منازل بنجران
    شركة تنظيف موكيت بخميس مشيط
    شركة تنظيف بصبيا
    شركة تنظيف بصامطة
    شركة تنظيف مكيفات بجازان
    شركة تنظيف فلل بابها


  47. شركتنا هي الأفضل في المنطقة الجنوبية بفعل ما تقدمة من خدمات متميزة عالية الدقة تنظيف بالبخار ونظافة عالية الدقة من قبل متخصص في خدمات التنظيف شركة ركن الأمانة
    شركة تنظيف فلل بخميس مشيط
    شركة تنظيف بوادي بن هشبل
    شركة تنظيف بللحمر
    شركة تنظيف بأحد رفيدة
    شركة تنظيف بجازان
    شركة تنظيف بالنماص
    شركة تنظيف بمحايل عسير
    شركة تنظيف خزانات بخميس مشيط
    شركة تنظيف خزانات بنجران

  48. شركة تنظيف شركة ركن الأمانة تعد من أفضل شركات التنظيف بالمنطقة الجنوبية بالمملكة العربية السعودية شركة تنظيف منازل وبيوت وشقق وفلل وكنب وسجاد تعد أفضل شركة تنظيف والبكم بعض من خدمات الشركة المتميزة التي تقدمها نظافة بالبخار وتنظيف عام
    شركة تنظيف خزانات بجازان
    شركة تنظيف خزانات بابها
    شركة تنظيف ببيشة
    شركتنا لا مثيل لها بفضل الإيمكانيات التي تمتلكها شركتنا عليكم بالتواصل معنا الأن وسوف نصل إليكم في أسرع وقت ممكن شركة تنظيف بابها
    شركة تنظيف بخميس مشيط
    شركة تنظيف بنجران
    شركة تنظيف مجالس بابها
    شركة تنظيف منازل بابها
    شركة تنظيف كنب بخميس مشيط

    شركة تنظيف منازل بخميس مشيط


  49. Thankyou for this blog its really interesting and informative and i also have

    some good blogs you must have to see:

    Avast Login
    avg.com/retailbullguard support number

  50. Thanks you for article! Nice information for all people in the world
    Situs PKV Games
    PKV Games
    PKV Games Online

  51. I m Really looking forward to read more. Your site is very helpful for us .. This is one of the awesome post i got the best information through your site and Visit also this site
    Black satta king
    disawar satta king
    gaziabad satta king
    faridabad satta king
    gali satta king

  52. Terimakasih Konten yang sangat bermanfaat bagi kami. Jangan lupa untuk kunjungi SITUS JUDI BOLA TERPERCAYA Kami dan dapatkan hadiah jutaan rupiah dari kami. Ayo daftar dan mainkan sekarang.

  53. This post is good enough to make somebody understand this amazing thing, and I’m sure everyone will appreciate.palm beach tree removal services

  54. Thanks for a wonderful share. Your article has proved your hard work and experience you have got in this field. Brilliant .i love it reading. Escorts ny

  55. Hello, I have browsed most of your posts. This post is probably where I got the most useful information for my research. Thanks for posting, maybe we can see more on this. Are you aware of any other websites on this subject.
    kitchen remodel contractor albuquerque nm

  56. This post is good enough to make somebody understand this amazing thing, and I’m sure everyone will appreciate.ac repair west palm beach fl

  57. I have read your article, it is very informative and helpful for me.I admire the valuable information you offer in your articles. Thanks for posting it..
    port st lucie tree service

  58. I think this is one of the most significant information for me. And i’m glad reading your article. But should remark on some general things, The web site style is perfect, the articles is really great : D. Good job, cheers.
    kitchen and bath remodeling reno nv

  59. This is a great article thanks for sharing this informative information. I will visit your blog regularly for some latest post.trash haulers west palm beach

  60. Pakarbet Merupakan Situs Judi Online Terpercaya dengan 1 userid bisa bermain semua games seperti sportsbook, live casino, slot online, poker online