<story><title>Kaspersky researcher cracks Flame malware password</title><url>http://www.networkworld.com/news/2012/091812-kaspersky-flame-262531.html</url></story><parent_chain><item><author>xal</author><text>&amp;#62; The hash - 27934e96d90d06818674b98bec7230fa - was resolved to the plain text password 900gage!@# by Bestuzhev.&lt;p&gt;What? How did they crack this if brute force failed? That&apos;s scary as hell.</text></item></parent_chain><comment><author>miles</author><text>Not only that: &quot;&lt;i&gt;Kaspersky analyst Dmitry Bestuzhev cracked the hash for the password Sept. 17 just hours after Symantec put out a public request for help&lt;/i&gt;&quot;&lt;p&gt;How is it possible to crack 900gage!@# in a few hours?</text></comment>
<story><title>Kaspersky researcher cracks Flame malware password</title><url>http://www.networkworld.com/news/2012/091812-kaspersky-flame-262531.html</url></story><parent_chain><item><author>xal</author><text>&amp;#62; The hash - 27934e96d90d06818674b98bec7230fa - was resolved to the plain text password 900gage!@# by Bestuzhev.&lt;p&gt;What? How did they crack this if brute force failed? That&apos;s scary as hell.</text></item></parent_chain><comment><author>WestCoastJustin</author><text>Unreal that he was able to crack it so fast.. a little scary really! He might have access to precomputed password hashes in a database. For example, you create a massive password list and compute all the hashes, save them in a database, why would you compute these hashes and throw away the results each time. You might just say &quot;select plain_text from results where hash = &apos;27934e96d90d06818674b98bec7230fa&apos;;&quot;. Just a guess though.</text></comment>