‘Hash Hunters’ Web service cracks password hashes for bitcoins

A search for “Hash Hunters” turns up marijuana-themed t-shirts for sale. It also brings up a password-cracking outsourcing service, payable in bitcoin.

Fearing data breaches, Web services often store hashes of passwords, or cryptographic representations of the passwords, which have been processed by an algorithm.

In the hands of a hacker, the hashes are useless unless they can be converted back to the original password. That’s where Hash Hunters comes in.

Hash Hunters lets users post their hashes and offer a reward for a person who can convert it. It’s not the first kind of website that takes such outsourced jobs, but it’s possibly one of the few using only bitcoin, the pseudonymous virtual currency, as its only payment method.

The service will likely only attract a criminal crowd, said Jeremi Gosney, CEO of the Stricture Consulting Group, which specializes in password-related security products and services. He said most professional security professionals who probe networks and systems for weaknesses aren’t allowed to use such Web-based services.

“We considered doing a similar service (involving Bitcoin as well), but had a hard time coming up with a legitimate use case,” Gosney said via email. “So that’s why we abandoned plans for that. We still do paid password recovery, but we do it as a professional service.”

Hash Hunters is a bit rough around the edges, Gosney wrote. It doesn’t use “https,” which is a standard security technology that encrypts communication between a client and a server.

Gosney, who created an account on Hash Hunters, said it doesn’t seem to have a reliable way for contract password crackers to communicate with their clients, the site crashes occasionally and it doesn’t appear that cracked passwords can be uploaded.

The domain, hashunters.net, was created on June 25, according to the Whois database, which provides domain name registration information. A Facebook page for the site appears to have been created on Aug. 29.

Efforts to reach the domain name’s owner were unsuccessful, although it appears from the Whois record to be related to a search-engine optimization company based in Germany called Seotecs UG.

Quite a few hashes have been submitted, which are labeled by the type of algorithm which generated them: MD5, SHA1, SHA224, SHA384. The highest reward posted on Hash Hunters is 1.585 Bitcoins for an MD5 hash, which would be about US$209 according to the market price on the Mt. Gox Bitcoin exchange on Thursday.

Large data breaches over the years have yielded millions of hashes, many of which have been converted to their original password for research projects looking at password security. Consulting those lists is often the first step for someone trying to crack one.

If there are no matches, decoding tools and powerful graphics processors can be used to try and covert it. Typically, the longer and more complicated the password is, the harder is it to crack. Brute-force attempts create different word, number and symbol combinations in hopes of generating a matching hash. But that can take a long, long time.

Kevin Young, an adjunct professor of information security at Utah Valley University who studies passwords, said via email that there are people on IRC instant messaging channels that will crack passwords for free.

“It’s a challenge, the thrill of the hunt,” Young wrote.

The utility of Hash Hunters depends on how desperate you are to crack a password, he said. “If you’re looking for the password to your girlfriend’s laptop and wanna snoop around, it probably isn’t worth it. If a disgruntled employee quit and changed the password on your network infrastructure, it would be worth every penny.”

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk