Hacker News Reader

Comment by woliveirajr | Hacker News Reader

> Buried in those malicious samples were hard-coded MD5 hash values that turned out to be unique MAC addresses for network adapter cards.

Having access to those MAC address (or their MD5 hashes) could be interesting. I would like to verify if my MAC was among those target to do deep inpection in my whole infrastructure. I'm not sure Kapersky was able to determine all those 600 MAC addresses to contact specific companies.

View on HN

It’s a MD5 hash according to the article. I wonder how long it would take to hash 281,474,976,710,656 MAC addresses into MD5? Well wouldn’t have to do all those, find the vendor id’s for ASUS and “just” hash those.

EDIT: Looks like Kaspersky have published tools to check if your MAC was one of those targeted - https://securelist.com/operation-shadowhammer/89992/ don’t think they have published the whole list. Just a checker app and a webform to check. The checker app _may_ contain the whole list.

Looks like they there updating the list of MACs over time (rules out my initial thought of them targeting an purchase order to get hand full of people who would of gotten machines from that order) as it seems that Kaspersky pulled the list of MACs from about 200 samples.

It would take a few seconds (at most) to brute force all of them.

The vendor IDs in a laptop/desktop would be a limited set (Realtek, Intel, Atheros, Broadcom are the big names off the top of my head), each company has a few vendor IDs but still it's a small search space. Here are my notes from the calculation:

48 bits / 6 bytes per MAC

Vendor ID is 6 hex digits = 3 bytes / 24 bits

https://www.brandonfoltz.com/2014/09/how-fast-is-md5/ 2014/09: Core 2 Duo e6550 @ 3 GHz does 427 MB/s with one process, DDR2-800 RAM

Modern cpu: 4.5 ghz @ 8 cores * 1.25x IPC and RAM improvement (RAM has come a long way since DDR2, but in the article he was CPU bound so that's probably still the bottleneck)

= 427 * (4.5/3.0) * 8 * 1.25 = 6.4 GB/s

24 bits of actual MAC left per vendor = 16,777,216 MACs/vendor

16.8 million * 3 bytes = 50.4 million bytes per vendor

6.4 GB / 50.4 MB = almost 1300 vendor prefixes per second

The website listed above provides MD5 hash rate in MB/s (on a CPU, too). A few other sources I found provided hash rates in hashes/sec instead, such as this StackExchange saying that 1.3 billion SHA-1 hashes/sec are possible on a old GPU. SHA-1 is more complex than MD5, and GPUs are still following Moore's law very well, so it would be trivial to brute force this.

https://security.stackexchange.com/a/8609

Source for vendor IDs: https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd...

A Nvidia GTX 1080 can do about 20-25 GH/s of MD5. This makes the whole searchspace even without taking the vendor prefixes into account, quite brute forceable. Here is a benchmark of hashcat that gives some insights into the speed of the different hashing algorithms.

https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...

A recently released tool also allows you to do all this on AWS for quite cheap without any big investment in hardware. https://github.com/Coalfire-Research/npk

The article at [1] provides both a tool and online form to verify if your MAC address is among those targetted.

[1] https://securelist.com/operation-shadowhammer/89992/

From my security perspective, this reads to me as if you are confirming to own an Asus laptop bought in that timeframe on a public forum.

Depending how paranoid you are, or should 'secure' you should be because of for example work, I would not have posted this.

Or maybe it’s a misinformation op. Maybe they only buy from Dell and this is to throw people off the scent? Maybe they don’t even own a computer...

Reply on news.ycombinator.com