November 10, 2022 at 1:34 AM
In 2013, one of the biggest hacks in history took place - the Adobe hack.
Its peculiarity is that the passwords were not hashed, but encrypted with a block cipher with an unknown key. He was never found for 10 years. This cipher separately encoded every 8 characters of the password, which opened up some possibilities. I never found the decrypted version on the Internet, so I decided to decrypt the database myself.
I did the following - I took the Evite database, hacked at about the same time, and found all the mails that were found in both the Evite database and the Adobe database. There were 1.6 million such mails. (I didn't even use the entire Evite database, only 10kk lines) Then I took a ready-made list of 100 already decrypted blocks of 8 characters and proceeded as follows:
1) For each line, I divide the password into blocks and look for them in already decrypted blocks.
2) If part of the password is decrypted and part is not, I compare the partially decrypted password with the password that this person used in the Evite leak.
3) I consider the password decrypted in two cases:
- If the password length and at least 2 characters match
- If the length and 1 character match, as well as the password, at least two accounts with the same data use
4) I add the decrypted blocks to the table and return to point 1.
As a result of such actions, I managed to decrypt 9.440.000 lines completely and 17.340.000 partially. Of course, there are not 100% correct passwords, but at least 95% will be. At least judging by the hints that are consistent with the decrypted passwords. I post both of these bases below. There is little practical value in this data, since the leak is already 10 years old. I deciphered this base just for sporting interest.
I think if you use all the leaks of that time, you will be able to decrypt most of the database, but it is unlikely that anyone needs it.



