'Hash Hunters' Web service cracks password hashes for bitcoins

The service lets people post rewards for converting password hashes into their original form

A web service, Hash Hunters, lets users offer a reward payable in Bitcoin to people who can convert a password hash into the original password.

A web service, Hash Hunters, lets users offer a reward payable in Bitcoin to people who can convert a password hash into the original password.

A search for "Hash Hunters" turns up marijuana-themed t-shirts for sale. It also brings up a password-cracking outsourcing service, payable in bitcoin.

Fearing data breaches, Web services often store hashes of passwords, or cryptographic representations of the passwords, which have been processed by an algorithm.

In the hands of a hacker, the hashes are useless unless they can be converted back to the original password. That's where Hash Hunters comes in.

Hash Hunters lets users post their hashes and offer a reward for a person who can convert it. It's not the first kind of website that takes such outsourced jobs, but it's possibly one of the few using only bitcoin, the pseudonymous virtual currency, as its only payment method.

The service will likely only attract a criminal crowd, said Jeremi Gosney, CEO of the Stricture Consulting Group, which specializes in password-related security products and services. He said most professional security professionals who probe networks and systems for weaknesses aren't allowed to use such Web-based services.

"We considered doing a similar service (involving Bitcoin as well), but had a hard time coming up with a legitimate use case," Gosney said via email. "So that's why we abandoned plans for that. We still do paid password recovery, but we do it as a professional service."

Hash Hunters is a bit rough around the edges, Gosney wrote. It doesn't use "https," which is a standard security technology that encrypts communication between a client and a server.

Gosney, who created an account on Hash Hunters, said it doesn't seem to have a reliable way for contract password crackers to communicate with their clients, the site crashes occasionally and it doesn't appear that cracked passwords can be uploaded.

The domain, hashunters.net, was created on June 25, according to the Whois database, which provides domain name registration information. A Facebook page for the site appears to have been created on Aug. 29.

Efforts to reach the domain name's owner were unsuccessful, although it appears from the Whois record to be related to a search-engine optimization company based in Germany called Seotecs UG.

Quite a few hashes have been submitted, which are labeled by the type of algorithm which generated them: MD5, SHA1, SHA224, SHA384. The highest reward posted on Hash Hunters is 1.585 Bitcoins for an MD5 hash, which would be about US$209 according to the market price on the Mt. Gox Bitcoin exchange on Thursday.

Large data breaches over the years have yielded millions of hashes, many of which have been converted to their original password for research projects looking at password security. Consulting those lists is often the first step for someone trying to crack one.

If there are no matches, decoding tools and powerful graphics processors can be used to try and covert it. Typically, the longer and more complicated the password is, the harder is it to crack. Brute-force attempts create different word, number and symbol combinations in hopes of generating a matching hash. But that can take a long, long time.

Kevin Young, an adjunct professor of information security at Utah Valley University who studies passwords, said via email that there are people on IRC instant messaging channels that will crack passwords for free.

"It's a challenge, the thrill of the hunt," Young wrote.

The utility of Hash Hunters depends on how desperate you are to crack a password, he said. "If you're looking for the password to your girlfriend's laptop and wanna snoop around, it probably isn't worth it. If a disgruntled employee quit and changed the password on your network infrastructure, it would be worth every penny."

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags securityHash HuntersStricture Consulting Group

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?