|
- Readme First! -
Read and follow the rules, otherwise your posts will be closed |
|
|
|
|
|
There are currently, 323 guest(s) and 0 member(s) that are online.
You are Anonymous user. You can register for free by clicking here |
|
|
|
|
|
Dangerous bug or not?!!!! |
|
 one writes "On one russian nuke site in the forum I see one interest post about securety protection and one man post one interest link:
your site//modules.php?name=Downloads&d_op=viewdownload&cid=2%20UNION%20select%20counter,%20aid,%20pwd%20FROM%20nuke_authors%20--
I try check in my site this link and I get admin password in DB format. I think if get password no problem to decode it in redable format. I check this link on nukecops portal system.
Sorry for bad english.
Admin Note: This has been reported to us and I cannot replicate it."
|
|
Posted on Thursday, January 15 @ 12:33:46 CET by Zhen-Xjell |
|
|
|
|
| |
|
|
| | The comments are owned by the poster. We aren't responsible for their content. |
| | | | |
| No Comments Allowed for Anonymous, please register | | | | |
Re: Dangerous bug or not?!!!! (Score: 1)
by georgiaguy on Thursday, January 15 @ 13:01:56 CET
(User Info | Send a Message) | | even if they could get the password from the DB, it's been encoded via md5, which is a "one way" function. once it's been encoded, it can't be decoded (that's why when a user loses their password in PHPNuke, the system has to generate a new one, and not just pull it from the DB and decode it). |
Re: Dangerous bug or not?!!!! (Score: 1)
by Zhen-Xjell on Thursday, January 15 @ 13:04:36 CET
(User Info | Send a Message) http://castlecops.com | | In terms of MD5 it is a one way hashing function. That means the exact password doesn't have to be entered to log in, so long as a password that matches the hash value stored in the DB works then login is successful. |
]
Re: Dangerous bug or not?!!!! (Score: 1)
by georgiaguy on Thursday, January 15 @ 15:04:52 CET
(User Info | Send a Message) | what a knack you have for repeating what i said. but you're incorrect, the probability of two strings having the same MD5 has is a one in 3.4028236692093846346337460743177e+38 probability. From RFC1321:
"It is conjectured that the difficulty of coming up with two messages having the same message digest is on the order of 2^64 operations, and that the difficulty of coming up with any message having a given message digest is on the order of 2^128 operations."
See http://theory.lcs.mit.edu/~rivest/Rivest-MD5.txt |
]
Re: Dangerous bug or not?!!!! (Score: 1)
by Zhen-Xjell on Thursday, January 15 @ 15:27:49 CET
(User Info | Send a Message) http://castlecops.com | I agree with what you said in your first reply, so what is wrong in repeating it in my own words? Diversity is a good thing.
Insofar as being incorrect, in practice by the computing power we have it certainly is not probable that another value can be found to create the same hash calue.
However in theory it is plausible that another value can be found to match the same hash value generated by the MD5 encryption.
You stated the probability of it happening as a figure above. There is no definitive "it cannot be done" statement. A number is provided, that again, by practice in today's standards dictates the chances of it occuring are close to impossible, but not improbable.
Lets not forget... in the past folks have thought:
- the world is flat
- we'll never land on the moon
- blackholes don't exist
Look, it took over 300 years for a working proof of Fermat's Last Theorem to be properly written.
What may not be acheived today, may certainly well be attained tomorrow.
It is only a matter of time.
But coming back to 'time', by today's standard the chances are slim to none. Then again, so is winning the lottery. |
]
Re: Dangerous bug or not?!!!! (Score: 1)
by Jeruvy on Thursday, January 15 @ 16:08:21 CET
(User Info | Send a Message) | And I could if I was so evil and inclined, to simply take 1000 zombies and break the md5 brute force into all of the zombies and wait a few days for the results. Does anyone in security understand the ramifications of Distributed Processing Systems? IF it takes A computer ONE YEAR to brute force the hash then 365 computers could brute force it in one day. Not a true fact (As the actual time may decrease or increase depending on the type of system, etc. etc.) but suffice to make the point that truly in today's world even 3DES, let alone MD5, isn't uncrackable.
Protect your passwords...
Now in real life, I'd bet most passwords would simply require a dictionary attack and I could easily have the results in minutes rather than days.
But the point is if I want to break into your computer the MD5 sufficient. Ask the many who've already fell victim to this attack.
J.
P.S. This hack (not a bug) is very old now and well patched for most sites, but I'm sure you knew this.
|
]
Re: Dangerous bug or not?!!!! (Score: 1)
by Zhen-Xjell on Thursday, January 15 @ 16:21:02 CET
(User Info | Send a Message) http://castlecops.com | Very much. I participated in Seti@Home for almost two years using a small farm of servers (Team Starfire, used to be Team DSLReports). Then I founded a team for Folding@Home and Genome@Home called Team Helix. Anyone in these projects knows about distributed computing efforts.
I've also participated lightly in RC5 and Mersenne Prime distributed computing. |
]
| | | | |
Re: Dangerous bug or not?!!!! (Score: 1)
by judas (judas_iscariote@piscola.com) on Thursday, January 15 @ 17:16:30 CET
(User Info | Send a Message) | this "bug" has been fixed a long time ago..and the hack
your site//modules.php?name=Downloads&d_op=viewdownload&cid=2%20UNION%20select%20counter,%20aid,%20pwd%20FROM%20nuke_authors%20--
only affects you..if you have mysql 4.x (UNION its not implemented on mysql 3.x)
for patch..see nukecops cvs.
|
| | | | | |
