When LeakedSource yesterday disclosed the account details of 43 million account details stolen from Last.fm in 2012, it commented that it was processing enough additional databases to publish one per day for several years. Today it has disclosed details from two bitcoin breaches: BTC-E.com (a bitcoin exchange) and Bitcointalk.org (a bitcoin discussion forum).
The Bitcointalk hack is known. The organization’s Twitter account reported May 2015, “Server compromised due to social engineering against ISP NFOrce.” Theymos later expanded on the bitcoin Subreddit, “the attacker had access for only about 12 minutes before I noticed it and had the server disconnected, so he probably wasn’t able to get a complete dump of the database.” He also added, “each password has a 12-byte unique salt. The passwords are hashed with 7500 rounds of SHA-256.”
LeakedSource has now reported that 499,593 user details were actually stolen, comprising “usernames, emails, passwords, birthdays, secret questions, hashed secret answers and some other internal data.” It confirms that 91% were hashed with sha256crypt, and that it would take them “about a year to crack an estimated 60-70% of them.”
The remaining 9% were hashed with MD5 and a unique salt — and LeakedSource has already cracked approximately 68% of those.
The BTC-E.com hack is less clear; although potentially more serious since wallets could be accessed and bitcoins stolen. LeakedSource says it hasn’t yet seen any news about stolen BTC-E customers losing their coins. There seems to be public knowledge of just one hack: in January 2016 the Financial Underground Kingdom blog noted, “During years of existance [BTC-E] had just 1 hack after which the owners paid all the debt to users.”
It isn’t clear whether that hack and the data disclosure made by LeakedSource refer to the same incident. LeakedSource comments, “BTC-E.com had 568,355 users hacked in October of 2014.” It goes on to add that an unknown hashing method was used, making the “passwords completely uncrackable although that may change.” Later in the same report it adds that since there are examples of some BTC-E users claiming to have had bitcoins stolen, “perhaps someone out there knows how the passwords were encrypted.”
SecurityWeek asked LeakedSource to clarify whether the data had been hashed or encrypted, and received a very prompt response:
“We should have been more careful, Btc-e.com passwords appear to be HASHED not encrypted. There are two formats for passwords, samples as follows:
4096$12$4$GuOVkVwDxd1E%gr$5fcd91f863036ca121b79b98d7e6c7d76fe84c81b1ca6f0e82986d285189cdbb
Other type:
958af5cfa76aefdfbb7bbfc7070b33ba3dd1dcb130a8a1f6841507b2daf8031bb67b77a790a017e38eb958b203a6396eb017251553fd
The presence of two hash types suggest they changed their password storage mechanism at some point but at this time neither us nor any of our security contacts can identify which either of them are to determine their crackability.”
Jarno Niemela, lead researcher at F-Secure Labs, suggests the following method for hashing passwords. Start with a modern algorithm, such as PBKDF2 or SHA256Crypt. Add as many iterations as your server can handle; for example as many as it can perform in 1 millisecond. Then hash the result with a second algorithm that is designed on a different principle — for example, SCrypt. “First do 1 million rounds of PBKDF2 followed by 1 million iterations of SCrypt (or whatever time you want to afford),” he told SecurityWeek.
