Encryption usefullness

[GriffinHeart]

i'm posting this thread since i do not know which mod or super mod deleted the recent thread about a brute forcer for MD5,

anyways

i've searched the rules and i've found no rule relating to this subject either in this section or the general forum rules.

and i want to point that considering the purpose of this forum "the ultimate mmorpg resource" it is benefitial to have encryption related resources, may they be implementations of code or just random talk.

since this forum not only has "hacking" sections of mmorpgs and has dev sections for mmorpgs. Any dev would agree to me nowdays any online aplication should have any sort of encryption.

i'd like to see where most of the current emulators or the sorts would be if peeps didn't know how encryption protocols work and how to "hack" them.

anyways just my opinion.

feel free to express yours

 

[Pieman]

Yeah, I saw that thread. It probably was deleted because a bunch of noobs were throwing **** at it for no reason.

But then again, a md5 brute forcer is not a very good idea, because you do not know anything about the encrypted string. It could be anything from 1 character to 15 characters(I believe it was 15 not sure) So that would mean it would take awfully long to bruteforce something like that.

 

[GriffinHeart]

Yeah, I saw that thread. It probably was deleted because a bunch of noobs were throwing **** at it for no reason.

But then again, a md5 brute forcer is not a very good idea, because you do not know anything about the encrypted string. It could be anything from 1 character to 15 characters(I believe it was 15 not sure) So that would mean it would take awfully long to bruteforce something like that.

as i said in the thread that got deleted its not about if its a good ideia or not,
hell i dont think making "hello world" programs serve any purpose at all, besides the educational one, wich would be one of the purposes of a md5 bf.

now if a mmorpg would use a md5 encryption that guy would have given us tool to help make an emu for that mmorpg maybe the mmorpg you've waited to play for ages cause you dont want to pay the subscription.

i didn't even really take a good look to the code cause for me its not very interesting but i did give constructive advice.

 

[mgX^]

ooh an md5 bruteforcer does exist...it uses like 250gb of the socalled "rainbow tables" to crack the hash...very brilliant, and pretty darn fast..so md5 is generally speaking very insecure...

Passwords recovery - MD5, SHA1, MySQL <---tadaaaa online md5 cracker

its a dictionary lookup really.... having every possible combination of letters and numbers hashed in a huge dictionary... the amount of stuff it can crack is based on how big the rainbow tables are.

 

[GriffinHeart]

mgX^u should investigate more and not assume things, any cracker you have or rainbow table are praticily reduced to nill if u had salt to your encryption object. so even if you know the object is a word from english and use the best dictionary you would still have to compare each word to each appended salt.

here from wikipedia

Assume a user's secret key is stolen and he is known to use one of 200,000 English words as his password. Because of the salt, the attacker's pre-calculated hashes are of no value. He/she must calculate the hash of each word with each of 2^32 (4,294,967,296) possible salts appended until a match is found. The total number of possible inputs can be obtained by multiplying the number of words in the dictionary with the number of possible salts:

2^{32} x 200 000 = 8.58993459 x 10^{14}

To complete a brute-force attack, the attacker must now compute about 800 trillion hashes, instead of only 200,000. Even though the password itself is known to be simple, the secret salt makes breaking the password radically more difficult.

and here from the rainbow table in wikipedia

A rainbow table is a lookup table offering a time-memory tradeoff used in recovering the plaintext password from a password hash generated by a hash function, often a cryptographic hash function. A common application is to make attacks against hashed passwords feasible. Salt is often employed with hashed passwords to make this attack more difficult, often infeasible.

 

[mgX^]

mgX^u should investigate more and not assume things, any cracker you have or rainbow table are praticily reduced to nill if u had salt to your encryption object. so even if you know the object is a word from english and use the best dictionary you would still have to compare each word to each appended salt.

here from wikipedia



and here from the rainbow table in wikipedia

i am perfectly aware of how this works....but again..."often"...more like "on occations"... ive used those rainbow tables with great success numerous times to crack pws extracted from hacked sql servers....mostly forum passwords etc.

 

[Daevius]

I deleted it.

It was not really illegal indeed, I called it semi-illegal (as it will prolly be used for illegal actions). If that'd be the only thing I wouldn't delete it, but it was also in the wrong section (should be showcase), used no tags and had little to no description or comments to what happens. It was just some lines of code without any learning purpose...a md5 bf source can just be found on the net anyways, so what would this add? So since all these things were wrong (even the little ones), I deleted it.

If the member whatsoever wants to edit his post and make it more usefull (comments on what happens so other people can learn from it/know how to use it), I'd be happy to undelete it . But just dumping some code isn't very usefull, is it?

 

[FragFrog]

Well said Daevius :smile:

The problem with discussing encryption methods is that, in order to know how to secure something, you must also know how to break insecure programs. In effect, to make a good save program you must know how to hack. Most of RageZone's audience however ignores the educational part and just extracts the hacks and be done with it - which is why an encryption discussion tends to fail.

A salted MD5 is difficult to crack, but only if it is always checked with the salt added. For websites it is just as easy to use sha1 instead, which is much more difficult to crack - which is why I always tend to use it for password encryption. Breaking an encrypted line between gameclient and server seems impossible since it means breaking all packets, which could take years, and then you'd still have to analyse them. Fortunately, most games don't bother with encrypting their data streams, where it stops becoming an encryption problem and starts becoming a simple 'what does this do?' situation.

Though even if you can figure that out, making a good emu is still so much more difficult that I doubt you would not be able to if you could already create one of those :smile:

 

[mgX^]

Well said Daevius :smile:

The problem with discussing encryption methods is that, in order to know how to secure something, you must also know how to break insecure programs. In effect, to make a good save program you must know how to hack. Most of RageZone's audience however ignores the educational part and just extracts the hacks and be done with it - which is why an encryption discussion tends to fail.

A salted MD5 is difficult to crack, but only if it is always checked with the salt added. For websites it is just as easy to use sha1 instead, which is much more difficult to crack - which is why I always tend to use it for password encryption. Breaking an encrypted line between gameclient and server seems impossible since it means breaking all packets, which could take years, and then you'd still have to analyse them. Fortunately, most games don't bother with encrypting their data streams, where it stops becoming an encryption problem and starts becoming a simple 'what does this do?' situation.

Though even if you can figure that out, making a good emu is still so much more difficult that I doubt you would not be able to if you could already create one of those :smile:

not hard to break the encryption of games only game ive come by that is hard, is the sims online...afaik it uses SSL...its like...GL bruteforcing the private key needed for encryption ....the thing is, most games wont use a heavy duty encryption for the gtamepackets, might do for the login packets, but not the game ones...it simply takes too much processing power...which is why we are still able to crack them we would need a shitload of power if we are to crack something like ssl or diffie hellman or something along those lines...

 

[Wh005h]

Has MD5 and SHA1 become encryptions now?
Could have sworn there was a difference in encryptions and hashes lol
I suppose it could be decrypted since every string makes a unique hash though, it just requires a bit of guess work on the part of the decryptor since the hashes are essentially "rounded".

I don't think they're really decrypted so much as matched with another hash lol. That was said earlier but not in plain terms =p
I thought about making a bot to scan some dictionary sites and make hashes of all the words but I never really got around to it =/

 

[FragFrog]

Technically you're absolutely correct Wh005h, but effectively a hashing algorythm can act as an ecryption - especially if you know how to apply it.

I'm currently writing a MMO gameserver myself and not even bothering about encryption. Instead, I let the server do the checks. Almost impossible to cheat that way :icon6:

 

[FrostDeamon]

Just to add my 2 cents:

An MD5 brute forcer would be extremely easy to make, hell, you can even do it in PHP.
Using MD5 as "encryption" isn't really that secure. I personally use(for websites atleast):
OtixaCrypt(MD5(MD5($password).SHA1($password)), $key);
(No, I won't tell you how OtixaCrypt works ;])


[Fd]

 

[mgX^]

Technically you're absolutely correct Wh005h, but effectively a hashing algorythm can act as an ecryption - especially if you know how to apply it.

I'm currently writing a MMO gameserver myself and not even bothering about encryption. Instead, I let the server do the checks. Almost impossible to cheat that way :icon6:

did anybody say rararararaaadaaaaar? and packetforging ofc