'Hash Hunters' Web service cracks password hashes for bitcoins

The service lets people post rewards for converting password hashes into their original form

A web service, Hash Hunters, lets users offer a reward payable in Bitcoin to people who can convert a password hash into the original password.

A web service, Hash Hunters, lets users offer a reward payable in Bitcoin to people who can convert a password hash into the original password.

A search for "Hash Hunters" turns up marijuana-themed t-shirts for sale. It also brings up a password-cracking outsourcing service, payable in bitcoin.

Fearing data breaches, Web services often store hashes of passwords, or cryptographic representations of the passwords, which have been processed by an algorithm.

In the hands of a hacker, the hashes are useless unless they can be converted back to the original password. That's where Hash Hunters comes in.

Hash Hunters lets users post their hashes and offer a reward for a person who can convert it. It's not the first kind of website that takes such outsourced jobs, but it's possibly one of the few using only bitcoin, the pseudonymous virtual currency, as its only payment method.

The service will likely only attract a criminal crowd, said Jeremi Gosney, CEO of the Stricture Consulting Group, which specializes in password-related security products and services. He said most professional security professionals who probe networks and systems for weaknesses aren't allowed to use such Web-based services.

"We considered doing a similar service (involving Bitcoin as well), but had a hard time coming up with a legitimate use case," Gosney said via email. "So that's why we abandoned plans for that. We still do paid password recovery, but we do it as a professional service."

Hash Hunters is a bit rough around the edges, Gosney wrote. It doesn't use "https," which is a standard security technology that encrypts communication between a client and a server.

Gosney, who created an account on Hash Hunters, said it doesn't seem to have a reliable way for contract password crackers to communicate with their clients, the site crashes occasionally and it doesn't appear that cracked passwords can be uploaded.

The domain, hashunters.net, was created on June 25, according to the Whois database, which provides domain name registration information. A Facebook page for the site appears to have been created on Aug. 29.

Efforts to reach the domain name's owner were unsuccessful, although it appears from the Whois record to be related to a search-engine optimization company based in Germany called Seotecs UG.

Quite a few hashes have been submitted, which are labeled by the type of algorithm which generated them: MD5, SHA1, SHA224, SHA384. The highest reward posted on Hash Hunters is 1.585 Bitcoins for an MD5 hash, which would be about US$209 according to the market price on the Mt. Gox Bitcoin exchange on Thursday.

Large data breaches over the years have yielded millions of hashes, many of which have been converted to their original password for research projects looking at password security. Consulting those lists is often the first step for someone trying to crack one.

If there are no matches, decoding tools and powerful graphics processors can be used to try and covert it. Typically, the longer and more complicated the password is, the harder is it to crack. Brute-force attempts create different word, number and symbol combinations in hopes of generating a matching hash. But that can take a long, long time.

Kevin Young, an adjunct professor of information security at Utah Valley University who studies passwords, said via email that there are people on IRC instant messaging channels that will crack passwords for free.

"It's a challenge, the thrill of the hunt," Young wrote.

The utility of Hash Hunters depends on how desperate you are to crack a password, he said. "If you're looking for the password to your girlfriend's laptop and wanna snoop around, it probably isn't worth it. If a disgruntled employee quit and changed the password on your network infrastructure, it would be worth every penny."

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags Hash HuntersStricture Consulting Group

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?