Originally
posted by
LittleItaly:
Galleri, before you try to calm people, understand that having the source code means they had the hash key = decoding the hash.
Not directly, no.
Having the source code means they had to pour through hundreds, if not thousands, of lines of code, to pick out which snippets of code they may be able to use. These snippets of code would have contained parts of queries performed by the web application to go get data out of the database that the application needed to do its job. These queries would have told the perpetrators the names of the tables needed to look through, how the database treated these queries, and how the application responded to odd inputs. In this particular case (I have not seen any proof of what happened in this particular case, it's just usually what happens), the data sought for would probably have been the usernames and (hashed) passwords. So the actual number of lines of code to sift through may have been much less than thousands. It may have all been contained in a single file.
Looking at the queries performed by the application would have given the perpetrators the knowledge of how they would need to construct a query that either would return the data requested, or return a basic error message (to show they were on the right track). They would have put this specially-constructed query in either the query string at the end of the URL for the login page to BoxCar, or, more likely, put it in certain text fields, such as those for the username and password.
Once the correct query had been entered, the data they would have received would have contained the usernames, hashed passwords, contact info, etc, of all the people in a single table in the database (or just the people in whatever alliance site they were targeting). The passwords would have probably been hashed in either sha512 or MD5, which is much weaker. If the passwords were hashed in MD5, they may not have even needed to be cracked--a simple lookup of the hash would tell you the true password.