Laurelai/tsukiboards — Issue #15: Insecure "Poster ID" algorithm
Author: savetheinternet
Created: 2011-10-14 23:28:23+00:00
State: open

Currently, as with Kusaba X, a "Poster IDs" are calculated by truncating an (unsalted) MD5 hash of the user's IP address to 6 characters.

Assuming the user is using IPv4, this is quite a security flaw. As there are 232 IPv4 addresses and only 224 possible IDs, it makes it possible (and incredibly easy) to narrow an ID down to ~256 IP addresses. After the rest are eliminated using GeoIP or whatever, an attacker can find the IP address of a user.

Although it may seem unpractical because of the time and processing power required to test a hash for every single IP address, it could be done in just minutes with a large rainbow table (which I created earlier to test my concept).

I suggest that some salt be used to ensure this type of attack isn't possible.