scorge
Fledgling Freddie
- Joined
- Sep 13, 2004
- Messages
- 2,721
Ovron said:A hash is irreversible .
you would think so buts its not..
Ovron said:Edit: On a second read, I'm not sure what you mean by hash. If you do mean a hash-value, lets say md5, then it is irreversible. Can make your own hash pretty easily by: asc is the ascii-value for the current char in the string: squarroot(theHash + asc), and do that till you are out of chars - then remove the decimal sign. Very easy - and if you find a way to make it back to the original string... well... ok, I give up - its impossible.
you can brute force md5 hashes due to collisons or use a chosen-plaintext attack or know-plaintext attack, to quicken the decryption. Its not as secure as it once was for a one way hashing function
http://www.schneier.com/blog/archives/2005/03/more_hash_funct.html
i doubt very much though if the "scammer" decrypted MD5 hashes, more likely managed to grab a cached copy of the webform passwords.
social engineering oe educated guesses even over MSN is a lot simpler and quicker means of compromisig accounts.