[Continue] Why hwz asking hp number during registration

[powerrr]

http://forums.hardwarezone.com.sg/o...-hp-number-during-registration-5112109-4.html

Kiwi8 wrote:

U dunno what's the meaning of a hash function meh? It is used to calculate a hash number from the phone number in a one-way fashion. It is easy to calculate the hash number from the phone number but computationally difficult to calculate the phone number from the hash number. HWZ stores the hash number only.

https://en.wikipedia.org/wiki/Hash_function

Actually if the hp number used is translated into a hash number and stored, it's possible to use brute-force methods to get back the hp number.

All you need is a loop like this:

# just pseudo code, not actual php code
# starting from 80000000 because hp numbers start with 8
# end with 99999999 because that's the largest hp number
for (80000000..99999999) {
   find_hash_of_each_hp_number;
   match_it_against_hash_numbers_stored;
   if matched, you get the number back;
}

# code like the above will likely execute in a few minutes because there are only 20 million numbers between 80000000 to 99999999

So although the actual hp number used for registration is not stored in hwz's database, it's still possible to retrieve the number used if needed.

If hwz's database gets leaked, technically the hp numbers used can be reversed engineered.

Here's an example. I stored the number 97664041 as an MD5 string. The resultant MD5 hash is 6301ff4f97d86ee653caddc1de22befc.

You can decrypt that MD5 hash and get back 97664041. There are many online tools for doing that. Here's one:

http://www.md5online.org/

 

[treeskull]

Cos mata can call u mah

Sent from 你是我的小啊小苹果儿怎么爱你都不嫌多红红的小脸儿温暖我的心窝点亮我身命的火火火火火火 using GAGT

 

[mryang]

http://forums.hardwarezone.com.sg/o...-hp-number-during-registration-5112109-4.html


Actually if the hp number used is translated into a hash number and stored, it's possible to use brute-force methods to get back the hp number.

All you need is a loop like this:

# just pseudo code, not actual php code
# starting from 80000000 because hp numbers start with 8
# end with 99999999 because that's the largest hp number
for (80000000..99999999) {
   find_hash_of_each_hp_number;
   match_it_against_hash_numbers_stored;
   if matched, you get the number back;
}

# code like the above will likely execute in a few minutes because there are only 20 million numbers between 80000000 to 99999999

So although the actual hp number used for registration is not stored in hwz's database, it's still possible to retrieve the number used if needed.

If hwz's database gets leaked, technically the hp numbers used can be reversed engineered.

Here's an example. I stored the number 97664041 as an MD5 string. The resultant MD5 hash is 6301ff4f97d86ee653caddc1de22befc.

You can decrypt that MD5 hash and get back 97664041. There are many online tools for doing that. Here's one:

http://www.md5online.org/

heng har using DNC.

Sent from power lie in you using GAGT

 

[derazor]

http://forums.hardwarezone.com.sg/o...-hp-number-during-registration-5112109-4.html


Actually if the hp number used is translated into a hash number and stored, it's possible to use brute-force methods to get back the hp number.

All you need is a loop like this:

# just pseudo code, not actual php code
# starting from 80000000 because hp numbers start with 8
# end with 99999999 because that's the largest hp number
for (80000000..99999999) {
   find_hash_of_each_hp_number;
   match_it_against_hash_numbers_stored;
   if matched, you get the number back;
}

# code like the above will likely execute in a few minutes because there are only 20 million numbers between 80000000 to 99999999

So although the actual hp number used for registration is not stored in hwz's database, it's still possible to retrieve the number used if needed.

If hwz's database gets leaked, technically the hp numbers used can be reversed engineered.

Here's an example. I stored the number 97664041 as an MD5 string. The resultant MD5 hash is 6301ff4f97d86ee653caddc1de22befc.

You can decrypt that MD5 hash and get back 97664041. There are many online tools for doing that. Here's one:

http://www.md5online.org/

pls remove my phone #

 

[TheSexposed]

http://forums.hardwarezone.com.sg/o...-hp-number-during-registration-5112109-4.html


Actually if the hp number used is translated into a hash number and stored, it's possible to use brute-force methods to get back the hp number.

All you need is a loop like this:

# just pseudo code, not actual php code
# starting from 80000000 because hp numbers start with 8
# end with 99999999 because that's the largest hp number
for (80000000..99999999) {
   find_hash_of_each_hp_number;
   match_it_against_hash_numbers_stored;
   if matched, you get the number back;
}

# code like the above will likely execute in a few minutes because there are only 20 million numbers between 80000000 to 99999999

So although the actual hp number used for registration is not stored in hwz's database, it's still possible to retrieve the number used if needed.

If hwz's database gets leaked, technically the hp numbers used can be reversed engineered.

Here's an example. I stored the number 97664041 as an MD5 string. The resultant MD5 hash is 6301ff4f97d86ee653caddc1de22befc.

You can decrypt that MD5 hash and get back 97664041. There are many online tools for doing that. Here's one:

http://www.md5online.org/

Bro why are you so worried about phone number being leaked?

If you are not a celebrity or minister please do not worry..

U go pickup your phone input 8 digits start with either 8 or 9 u will reach someone..what's so special about our handphone number?

What u need to be worried about is your secrets stored on your computer.

Your homemade porn

Your *** videos..

These are the things that matter

 

[akloaklo]

The 8000000-90000000 thing won't work if there are salt appended to the phone number.

 

[powerrr]

Bro why are you so worried about phone number being leaked?

If you are not a celebrity or minister please do not worry..

U go pickup your phone input 8 digits start with either 8 or 9 u will reach someone..what's so special about our handphone number?

What u need to be worried about is your secrets stored on your computer.

Your homemade porn

Your *** videos..

These are the things that matter

Well, if the database gets leaked into the wrong hands, then there might be a lot of unpleasant surprises.

I think telling people that the hp numbers are stored as hashes may give them a false sense of privacy.

 

[ceecookie]

so that they can supplement their revenues by sharing your hp number with telemarketers

 

[powerrr]

so that they can supplement their revenues by sharing your hp number with telemarketers

Or someone putting the leaked database somewhere and have a table that shows which hp number corresponds to which username.

 

[beano]

This is for new accounts right, can't recall registering a phone num 16yrs ago..

 

[mryang]

so that they can supplement their revenues by sharing your hp number with telemarketers

omg..... for how much$$$$

Sent from power lie in you using GAGT

 

[powerrr]

The 8000000-90000000 thing won't work if there are salt appended to the phone number.

If a salt is used, it just makes the decryption harder.

And the salt value is also stored in the server's script, so anyone who has access to hwz's server account (a hacker, for example) theoretically can decrypt all the hp numbers.

 

[powerrr]

This is for new accounts right, can't recall registering a phone num 16yrs ago..

Yes, older accounts didn't have to go through this step - just an email for confirmation.

 

[lyfeforce]

This is to ensure that the account created is owned by a sentient being of the human race and not used by a script. Also to reduce the number of troublemakers who come back with clones.

Any and every security measure can be challenged, your credit card number on PayPal or Amazon, your phone number with banks, photocopy of your IC with any telcos when you sign up for a new mobile line.

End of the day, it's whether anyone got any use for said details. HWZ's stand is that it doesn't store the numbers directly in numerical format. "That's why Kok Leong is not given these details."

Note: Statement in quote is a ongoing joke for those who understand.

 

[Zangief]

obvious isn't it ?

 

[lifeislame]

This is to ensure that the account created is owned by a sentient being of the human race and not used by a script. Also to reduce the number of troublemakers who come back with clones.

Any and every security measure can be challenged, your credit card number on PayPal or Amazon, your phone number with banks, photocopy of your IC with any telcos when you sign up for a new mobile line.

End of the day, it's whether anyone got any use for said details. HWZ's stand is that it doesn't store the numbers directly in numerical format. "That's why Kok Leong is not given these details."

Note: Statement in quote is a ongoing joke for those who understand.

how much u pay him per month?

Sent from Samsung SM-G935F using GAGT

 

[Expert]

Yes, older accounts didn't have to go through this step - just an email for confirmation.

But if u go and update your profile you will need to key in right?

 

[Goodshot]

Because easier to lim kopi

 

[powerrr]

Because easier to lim kopi

Unfortunately yes.

If only your IP is stored, it's harder to trace the forumer - example if the person resides in an obscure country or uses the Tor browser.

But because a new hwz account is tied to a unique hashed hp number, if need be, that hash can be decrypted (using brute-force methods) to recover the original hp number.

 

[TuaLiYa]

wa sibei sarki ah ur programming skills