Out of Context Graph Challenge #1

By -
I'm struggling with the best way to graph some new data I just analyzed based on the RockYou list. Since I'm also too lazy to write up a full post on it right now, I thought I might as well throw it out as a challenge to the five or so people who read this blog. I'll buy a beer for the first person who can correctly state what the following graph shows.


The beer is redeemable at any conference I happen to meet you at, (For example: Shmoocon). Here are a few hints:
  1. It is based on a subset of one million passwords from the RockYou set
  2. It has to deal with a project I am working on
  3. There is one word you MUST include in your submission for it to be valid
Answers will only be accepted in the comments. This contest will run until someone gets it right or I actually get around to writing a post on this. Imaginary bonus points are applied if you have any suggestions on a better way to graph the data.

Comments

Anonymous said…
A measure of complexity of both crackable passwords using a given technique in a given time and uncrackable passwords.
January 30, 2010 at 11:52 PM
Matt Weir said…
Close, but I'm looking for a specific word. Regardless, you've earned a drink voucher from me.
January 30, 2010 at 11:57 PM
Matt Weir said…
Mostly I'm just saying close so I can buy someone else a beer as well ;) There is one word I want to hear though. Hint - There's a reason the graph X axis doesn't show any values before 4.
January 31, 2010 at 12:05 AM
jolZer said…
graph show cracked passwords by using the rockyou-top-100-list as wordlist with usual variation
... and length of password on x-axis.
January 31, 2010 at 1:07 AM
Matt Weir said…
Good guess jolZer, but the X-axis is not password length, (otherwise the average password would be around 15 characters long).
January 31, 2010 at 12:48 PM
Max Thrun said…
Password entropy on x-axis?
January 31, 2010 at 4:09 PM
Matt Weir said…
Yup, entropy is the magic word Max. Specifically, the graph shows the calculated entropy according to NIST's SP800-63, of cracked/uncracked passwords after a 50Million guess untargeted dictionary attack.
January 31, 2010 at 4:29 PM
Matt Weir said…
So in conclusion, I owe you a beer as well ;)
January 31, 2010 at 4:30 PM
Sc00bz said…
This comment has been removed by the author.
February 1, 2010 at 11:56 AM
Sc00bz said…
You should make two graphs: entropy distribution and passwords cracked per entropy.

Entropy distribution, y-axis percent of passwords and x-axis entropy.

Passwords cracked per entropy, y-axis percent of passwords cracked per entropy and x-axis entropy.

So something like this only more accurate since I took the data from your graph and couldn't get accurate info on entropy 4 through 9 and 22+.
http://yfrog.com/5vgraphsp
February 1, 2010 at 12:00 PM
Matt Weir said…
Wow, great idea + work Sc00bz. I'm really impressed that you could get that from the graph. Thanks, and I'll rearrange my graph to your format when I finally get off my butt and write a post on this.
February 3, 2010 at 12:02 AM
Post a Comment

Popular posts from this blog

Tool Deep Dive: PRINCE

By -
Image
Tool Name: PRINCE (PRobability INfinite Chained Elements) Version Reviewed: 0.12 Author: Jens Steube, (Atom from Hashcat) OS Supported: Linux, Mac, and Windows Password Crackers Supported:  It is a command line tool so it will work with any cracker that accepts input from stdin Blog Change History: 1/4/2015: Fixed some terminology after talking to Atom 1/4/2015: Removed a part in the Algorithm Design section that talked about a bug that has since been fixed in version 0.13 1/4/2015: Added an additional test with PRINCE and JtR Incremental after a dictionary attack 1/4/2015: Added a section for using PRINCE with oclHashcat Brief Description:   PRINCE is a password guess generator and can be thought of as an advanced Combinator attack . Rather than taking as input two different dictionaries and then outputting all the possible two word combinations though, PRINCE only has one input dictionary and builds "chains" of combined words. These chains can have 1 to N wo...
Read more

The RockYou 32 Million Password List Top 100

By -
But first, a quick responses to one of the previous comments, (since it really did merit a front-page post). Tfcx posted: The initial vulnerability was posted 29th November on a hacking forum called darkc0de here: http://forum.darkc0de.com/index.php?action=vthread&forum=11&topic=13082 Thanks, as that really helps narrow down the timeframe, (and reading that post and related posts was interesting if a bit depressing). The hack itself appears pretty straightforward once you see it, (like most things once the solution is presented to you it's easy, but finding it in the first place is hard). I'm still interested in the hacker Igigi, and have been tossing about all sorts of theories; but I'll refrain from posting them here since they are all pure WAGs right now. Now on to the main topic: Per Thorsheim wrote: I would like to see a comparison of Twitters 370 banned passwords against the top 370 or so passwords stolen from rockyou (http://www.techcrunch.com/2009/12/27/twi...
Read more

Cracking the MySpace List - First Impressions

By -
Image
Alt Title: An Embarrassment of Riches Backstory: Sometime around 2008, a hacker or disgruntled employee managed to break into MySpace and steal all the usernames, e-mails, and passwords from the social networking site. This included information covering more than 360 million accounts. Who knows what else they stole or did, but for the purposes of this post I'll be focusing only on the account info. For excellent coverage of why the dataset appears to be from 2008 let me refer you to the always superb Troy Hunt's blog post on the subject . Side note, most of my information about this leak also comes from Troy's coverage. This dataset has been floating around the underground crime markets since then, but didn't gain widespread notoriety until May 2016 when an advertisement offering it for sale was posted to the "Real Deal" dark market website. Then on July 1st, 2016, another researcher managed to obtain a copy and then posted a public torrent of then entir...
Read more