PS3 cracks security yet again...

Well, after the last blog I wrote (a year ago, embarassing, I know), it seems that SONY's PS3 has delivered yet again on it's pre-release promises of computational power.

In my previous blog spot, I wrote about the PS3's ability to crack MD5 hashes. Of cource, one machine could only (!) do 1000 times better than an Intel based processor, yielding the attack probably too time-consuming to be a real threat. But, as I predicted, a real threat has appeared.

Combining the computational force of 200 of these machines, attackers managed to break one of the MD5 algorithms used by Equifax and forge an invalid certificate from a valid provider. More details can be found here, here and here.

But the problem is not the attack itself, but rather the downplay from a number of parties, including the researches that performed the attack, and Microsoft. They are basing their evaluation of the risk to the fact that in order for black-hat attackers to use the breakthrough they need to have the cryptographic backround. And of course, we know how dumb hackers are when it comes to monetary gain...

A remedy of sort is not using MD5 as a hashing algorithm for SSL. It is well known that SSL uses two (primary) methods for doing hashing, MD5 and SHA1. For those who might be a bit worried, simply trust (for the time being) encrypted pages that use certificates that either use only SHA1 or use both SHA1 and MD5. It also has to be noted that in order for an attack to be succesful, not only does an attacker have to create a forged SSL certificate, but also redirect a victim to a malicius server. And we know that can't happen (remember the Kaminsky attack? 25 per cent of the worlds DNS servers still remain unpatched!)

To keep things short, I said it a year ago, I'll say it again. I may not be a guru in the field, but I know enough to understand that week algorithms should be made obsolete. SHA1 may be a remedy for the time being (as it is more secure than MD5 currently), but remember, it has not been ckacked, but it has been broken. Serious businesses should move to more secure algorithms, as if they wait for the tidal wave of security failure, I'm pretty sure they will go down with their ship.

Popular Game Machine used for password cracking

As I was looking for some information on the web about MD5, I stumbled across this article from PC World Magazine. The article mentions about the efforts of a senior security consultant at an Auckland based security firm, who managed to dramatically increase the processing capability of cracking passwords by use of a Playstation 3.

By use of the PS3's Cell processor technology, the aforementioned security consultant could crack passwords by a factor of a 100 (and that is not a small factor) faster than Intel based processor architecture, for MD5 hashing (Message-Digest algorithm 5), one of the most widely used cryptographic hashing functions. I will not go through the technical details, however brief they are discussed in the article, but I will try to convey the significance of this effort.

As we all know, technology is progressing at increasingly fast paces. Cryptography (and Information Security in general), are not keeping up with it. Although there are cryptographic algorithms and techniques that provide a level of security that is acceptable (and even unbreakable), these are often computationally heavy on the underlying hardware, thus making both encryption and decryption/verification too heavy for most popular devices (a variety of hand held devices use very simplistic encryption/decryption schemes).

Having a $400 gaming machine, that can be outfitted with Linux in the hands of a capable hacker (which most of them are extremely good programmers), that can be turned into a password cracking machine, personal information is starting to become more and more prone to leaking into the wrong hands. As a student, I was told that certain algorithms where good for encryption, as it was, as stated, "computationally infeasible to generate the passphrase from the encrypted text". As it seams, this is not the case any more.

So, better algorithms are needed, and unfortunately, they are needed right now. The general public does not have the luxury of a million dollar security system, but needs their personal information to remain personal. All that can be said in the end is that nowadays, safely surfing the net and surviving is not just for the technologically literate, but also for the very lucky.