LinkedIn password leak

Hackers got access to the 6.5 millions users' unsalted SHA-1 hashed password. We don't know whose accounts got compromised and what was the level of compromise before LinkedIn triggered their incident response process and stopped further compromise.

We still don't have information about how did the hackers manage to get hold of this data. But one thing is certain that it’s an example of absolute negligence. If basic principles of security would have been followed then hacker would not have been able to get the actual password from the hashed password as quickly as they did. They should have at least used salted hash.

So, what is Secure Hash Algorithm -1 (SHA-1): It is an algorithm (cryptographic algorithm) that converts any text/message into unique 160bits (20 bytes or 40 characters representing 20 hex values).
If your password is "MyPassw0rd" then SHA-1 will convert it to something like "e3e5cb40f7fc229ec70d50bc67072dd37ea186c7". This is the way the passwords were stored in the Linkedin database.

Ideally, there is no algorithm that could convert the hash value (like e3e5cb40f7fc229ec70d50bc67072dd37ea186c7) into the actual text (MyPassw0rd). But there is a work-around to get the actual value from the hashed value. 

What if we have a huge table of pre-computed hash values and their corresponding actual value like a sample table shown below?

Hashed Password	Actual Password
e3e5cb40f7fc229ec70d50bc67072dd37ea186c7	MyPassw0rd
e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4	secret
f4e7a8740db0b7a0bfd8e63077261475f61fc2a6	Secret

                       Table -1: The highlighted column shows how did LinkedIn store our passwords.

Such huge pre-computed table is freely available to reveres the hashed password into actual password. This table is known as Rainbow Table. Anyone can search a huge database of pre-computed hash at http://hashlab.info/ . Even if the database does not have an entry for a particular hashed value to get the actual password, the known weaknesses of SHA-1 algorithm would have made hackers tasks easier to reverse the hash value into actual value.

Anyone who follows the security best practices would never hash the passwords without the salt.

So, what is salt? Salt is nothing but a long random number that is added to the actual password before making the hash of the password.

That means, if two users have the same password – secretPassw0rd then it will be hashed with two different randomly generated numbers:

• SHA-1 hash of [secretPassw0rd + 39432] = 3e2a12099ac8762414ea81874b0ef7c82a5106db
• SHA-1 hash of [secretPassw0rd + 42451] = b8c61b002cfb164a99f9421d4a805719e005c5fb

The addition of long random number makes the rainbow tables impractical for getting the actual passwords. Disclosure of actual password would have prevented if Linkedin would have stored their passwords with at least SHA-256 salted hash. SHA-256 is the advanced version of SHA-1 that has resolved the weakness SHA-1 and is more secure.