'Hash Hunters' Web service cracks password hashes for bitcoins

The service lets people post rewards for converting password hashes into their original form

A web service, Hash Hunters, lets users offer a reward payable in Bitcoin to people who can convert a password hash into the original password.

A web service, Hash Hunters, lets users offer a reward payable in Bitcoin to people who can convert a password hash into the original password.

A search for "Hash Hunters" turns up marijuana-themed t-shirts for sale. It also brings up a password-cracking outsourcing service, payable in bitcoin.

Fearing data breaches, Web services often store hashes of passwords, or cryptographic representations of the passwords, which have been processed by an algorithm.

In the hands of a hacker, the hashes are useless unless they can be converted back to the original password. That's where Hash Hunters comes in.

Hash Hunters lets users post their hashes and offer a reward for a person who can convert it. It's not the first kind of website that takes such outsourced jobs, but it's possibly one of the few using only bitcoin, the pseudonymous virtual currency, as its only payment method.

The service will likely only attract a criminal crowd, said Jeremi Gosney, CEO of the Stricture Consulting Group, which specializes in password-related security products and services. He said most professional security professionals who probe networks and systems for weaknesses aren't allowed to use such Web-based services.

"We considered doing a similar service (involving Bitcoin as well), but had a hard time coming up with a legitimate use case," Gosney said via email. "So that's why we abandoned plans for that. We still do paid password recovery, but we do it as a professional service."

Hash Hunters is a bit rough around the edges, Gosney wrote. It doesn't use "https," which is a standard security technology that encrypts communication between a client and a server.

Gosney, who created an account on Hash Hunters, said it doesn't seem to have a reliable way for contract password crackers to communicate with their clients, the site crashes occasionally and it doesn't appear that cracked passwords can be uploaded.

The domain, hashunters.net, was created on June 25, according to the Whois database, which provides domain name registration information. A Facebook page for the site appears to have been created on Aug. 29.

Efforts to reach the domain name's owner were unsuccessful, although it appears from the Whois record to be related to a search-engine optimization company based in Germany called Seotecs UG.

Quite a few hashes have been submitted, which are labeled by the type of algorithm which generated them: MD5, SHA1, SHA224, SHA384. The highest reward posted on Hash Hunters is 1.585 Bitcoins for an MD5 hash, which would be about US$209 according to the market price on the Mt. Gox Bitcoin exchange on Thursday.

Large data breaches over the years have yielded millions of hashes, many of which have been converted to their original password for research projects looking at password security. Consulting those lists is often the first step for someone trying to crack one.

If there are no matches, decoding tools and powerful graphics processors can be used to try and covert it. Typically, the longer and more complicated the password is, the harder is it to crack. Brute-force attempts create different word, number and symbol combinations in hopes of generating a matching hash. But that can take a long, long time.

Kevin Young, an adjunct professor of information security at Utah Valley University who studies passwords, said via email that there are people on IRC instant messaging channels that will crack passwords for free.

"It's a challenge, the thrill of the hunt," Young wrote.

The utility of Hash Hunters depends on how desperate you are to crack a password, he said. "If you're looking for the password to your girlfriend's laptop and wanna snoop around, it probably isn't worth it. If a disgruntled employee quit and changed the password on your network infrastructure, it would be worth every penny."

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the Good Gear Guide newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Hash HunterssecurityStricture Consulting Group

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?