As security breaches go, they don’t get more vexing than this: 7 million compromised accounts that protected passwords using woefully weak unsalted MD5 hashes, and the outfit responsible, still hadn’t disclosed the hack three months after it came to light. And as if that wasn’t enough, the service recommended the use of short passwords. That’s what Motherboard reported Tuesday about Lifeboat, a service that provides custom multiplayer environments to gamers who use the Minecraft mobile app.
The data circulating online included the e-mail addresses and hashed passwords for 7 million Lifeboat accounts. The mass compromise was discovered by Troy Hunt, the security researcher behind the Have I been pwned? breach notification site. Hunt said he had acquired the data from someone actively involved in trading hacked login credentials who has provided similar data in the past.
Hunt reported that some of the plaintext passwords users had chosen were so weak that he was able to discover them simply by posting the corresponding MD5 hash into Google. As if many users’ approach to password selection weren’t lackadaisical enough, Lifeboat’s own Getting started guide recommended “short, but difficult to guess passwords” because “This is not online banking.”
Crude but effective
Short passwords are especially prone to cracking by brute force, a technique that tries all possible combinations of numbers, letters, and special characters until the specific one protecting a compromised account is tried. By counseling users to choose short passwords, Lifeboat operators made this crude cracking approach feasible. After all, a six-character password that uses letters and numbers has just 626 possible combinations. An 11-character password with letters and numbers has 6211 combinations, making it out of reach by brute-force methods.
The advice is compounded by the reliance on unsalted MD5 hashes to obscure the password plaintext. MD5 was designed to be extremely fast and require minimal computation. In years past, those were good attributes that gave a performance boost to inexpensive hardware. But as computers have grown increasingly powerful, the same qualities make MD5 a liability. The fact that the hashes were unsalted—meaning the plaintext passwords weren’t combined with a value that was unique for each account—makes the cracking process go much quicker and require less computation. Because salting ensures that each stored hash is unique even if two users choose the same passcode, each hash in a compromised table must be cracked separately, even if they mask one or more identical plaintext passwords.
Lifeboat officials told Motherboard that MD5 is no longer being used. They also said they implemented a password reset but didn’t disclose the breach because they didn’t want to notify the attackers there would be a limited shelf life to the hashes. Some Lifeboat users have disputed the claim there was a password reset. What’s known for sure is that the practices exposed in the breach are a text-book example of how not to store password data at rest.