Here comes the Hackpocalypse

Math 4440/5440 Coding and Cryptography · Prof. Stange · October 2026

Timeline

April 2026: Anthropic announced Claude Mythos Preview and held it back from public release. They and the UK AI Security Institute reported thousands of previously unknown vulnerabilities in operating systems and browsers. In one Firefox test it found 271 bugs and wrote working exploits for 181.
October 2026, PHP2Shell: Researchers using AI tools found two critical bugs in PHP, the language behind WordPress and much of the web. Someone tried to exploit them four days before the public announcement.
October 2026, eMudhra: A company trusted to vouch for websites had signing keys so weak that one of them was the number 4.
Black October: JohnDeere, SharkNinja, ConnectWise Cloud Backup, Shinhan Bank, Crowdstrike report, supermarket freezers thawed in europe, AI agents turning off their own monitoring

Passwords

How a server should store your password

Stored on server	If the database leaks…
`password123`	every password is just there
$H(\text{pw})$	one precomputed table cracks everyone; identical passwords look identical
$s,\ H(s \,\Vert\, \text{pw})$ with random salt $s$	attacker must guess each user separately
$s,\ \text{Argon2id}(s, \text{pw}; \text{cost})$	each guess costs real time and memory

Without salt, the attacker can compute $H(w)$ once for every word $w$ in a huge list and then look up every user at once.

With salt, the server picks a random $s$ per user (say 16 bytes) and stores $(s, H(s\,\Vert\,\text{pw}))$.

$2^{128}$ possible salts make precomputation useless.

Under the hood: hash functions only (SHA-256, bcrypt, scrypt, Argon2id), no keys. Your password travels to the server inside TLS, the encryption behind https (see Certificates). Post-quantum: safe. Grover’s algorithm speeds up guessing by at most a square root.

Slow hashes

bcrypt, scrypt, Argon2id iterate many times, with a tunable cost (both time and memory)

Rough guesses per second on one gaming GPU (hashcat benchmarks, RTX 4090):

Hash	Guesses / second
MD5 (old, fast)	$\approx 1.6\times 10^{11}$
SHA-256 (fast)	$\approx 2.2\times 10^{10}$
bcrypt, cost 12	$\approx 1.4\times 10^{3}$

Password strength

Randall Munroe, xkcd 936 “Password Strength” (2011), xkcd.com/936, CC BY-NC 2.5

How long does guessing take?

Time to try the whole space (the expected time is half). Online: guessing at a live login, 1000/s. Offline: a stolen database; one GPU, or 1000 rented GPUs on MD5.

Password space	Size	Bits	Modern online hacker	bcrypt-12	MD5	Modern offline hacker
a real human’s password (top $10^9$ guesses)	$10^9$	30	12 days	8 days	6 ms	instant
8 lowercase letters	$2.1\times10^{11}$	38	7 years	5 years	1 s	1 ms
8 random printable characters	$6.6\times10^{15}$	53	200 000 years	150 000 years	11 hours	41 s
4 random Diceware words	$3.7\times10^{15}$	52	120 000 years	80 000 years	6 hours	23 s
6 random Diceware words	$2.2\times10^{23}$	78	∞ (in practice)	∞ (in practice)	43 000 years	44 years
12 random printable characters	$5.4\times10^{23}$	79	∞ (in practice)	∞ (in practice)	100 000 years	110 years

Use a passphrase of 6+ words chosen by dice or software, not by you, and keep it for the few passwords you must memorize.

Reuse

Credential stuffing: Breached email/password lists are traded and replayed automatically against banks, email and shopping sites.

Use a password manager (Bitwarden, 1Password, the one built into your phone or browser…). Memorize one strong passphrase; let the manager generate a random 20-character password per site. A manager also refuses to auto-fill on a fake domain, which gives you some protection against phishing too.

Have I Been Pwned uses $k$-anonymity:

your password → SHA-1 → 5BAA6 · 1E4C9B93F3… → send only 5BAA6

The server returns every breached hash suffix starting with 5BAA6 (about 2000 of them) and your computer checks for a match.
$16^5 = 1\,048\,576$ buckets. The server learns only that your password is one of a huge number of strings with that prefix.

password → SHA-1 begins 5BAA6; the matching suffix shows up with count 52 372 427. Compute some SHA-1 hashes with the course’s hash tools, then look up a prefix at api.pwnedpasswords.com/range/XXXXX, e.g. api.pwnedpasswords.com/range/5BAA6 (only use passwords you don’t actually use!).

How a password manager works

master password → slow KDF, salt → master key → unlocks vault key → AES-256 decrypts each entry

Key derivation: $K_m = \operatorname{KDF}(\text{master pw},\ \text{salt};\ \text{cost})$, e.g. PBKDF2 with 600 000 iterations or Argon2id.
Key wrapping: a random 256-bit vault key $K_v$ is stored as $\operatorname{Enc}_{K_m}(K_v)$. Changing the master password re-wraps $K_v$; nothing else is re-encrypted.
Each entry: $\operatorname{Enc}_{K_v}(\text{entry})$ with AES-256 plus a MAC, so tampering is detected.
New passwords come from a cryptographic random number generator: 20 characters from 94 symbols is $\log_2 94^{20} \approx 131$ bits.

End-to-end encryption. Encryption and decryption happen only on your devices. The company stores ciphertext.

To log in to sync, your device sends $H(K_m, \text{master pw})$, which the server hashes again before storing. The server never sees $K_m$, so it can’t read your vault.

KDF (key derivation function): turns a password into a key, deliberately slowly.
PBKDF2, Argon2id: standard KDFs; Argon2id also needs lots of memory.
AES-256: the standard symmetric cipher, with a 256-bit key.
MAC (message authentication code, e.g. HMAC): a keyed tag that detects tampering.
Salt: a random value stored in the clear, so the same password gives different keys.

If the password manager itself is breached

The attacker gets your encrypted vault and the salt for offline attack.
LastPass, 2022: attackers stole customers’ encrypted vaults. Older accounts still used as few as 1 or 5000 iterations. Investigators later linked millions of dollars of cryptocurrency thefts to cracked vaults.
1Password’s Secret Key mixes a random 128-bit key, stored only on your devices, into the KDF. A stolen vault alone can’t be brute-forced.

The master password is the one password you must make strong: 6+ random words. Use two-factor login. Keep a recovery copy offline.

Under the hood: Bitwarden uses PBKDF2-SHA256 or Argon2id, then AES-256-CBC with HMAC-SHA256; 1Password uses AES-256-GCM. Sharing a vault with another person wraps keys with RSA-2048. Sync runs over TLS. Post-quantum: the symmetric parts are safe; RSA sharing is not.

Second factors

Factor	Secret lives…	Phishable?	Weak spot
SMS code	with your phone company	yes	SIM swap: a scammer talks your carrier into moving your number
Authenticator app (TOTP)	shared by you and the server	yes	real-time relay by a fake site
Push “Approve?”	phone app	yes	“MFA fatigue”: spam prompts until you tap yes
Passkey / hardware key (FIDO2)	only on your device	no	losing the device (so register two)

TOTP (Authenticator App)

At setup, you and the server share a random key $K$ (the QR code). Every 30 seconds: \[T = \left\lfloor \frac{t_{\text{unix}}}{30} \right\rfloor, \qquad \text{code} = \operatorname{Trunc}\big(\operatorname{HMAC\text{-}SHA1}(K,\ T)\big) \bmod 10^6 .\] HMAC is a keyed hash: without $K$ you can’t predict the next code, even after seeing old ones.

Guessing one code: probability $10^{-6}$ per try, and servers limit tries.
Server breach: the server stores $K$ too. A server breach can leak it.
Phishing relay: a fake site asks for your password and code, then immediately types both into the real site. Phishing kits automate this.

Under the hood: HMAC-SHA1, symmetric: one shared key. Post-quantum: safe.

Passkeys and YubiKeys: public-key authentication

Registration: your device makes a new key pair for this site, keeps $sk$ and sends $pk$.

Login:

The server sends a fresh random challenge $c$.
The device signs $\sigma = \operatorname{Sign}_{sk}(c \,\Vert\, \text{origin} \,\Vert\, \text{counter})$.
The server checks $\operatorname{Verify}_{pk}(\sigma)$.

Signatures are usually ECDSA on the curve P-256, sometimes Ed25519 or RSA. Not yet post-quantum; post-quantum signatures (ML-DSA) for FIDO are in development. The server stores only $pk$.

Passkey = key stored on device or password manager. Security key = key stored in hardware device.

Why passkeys can’t be phished

The browser, not you, puts the site’s real domain (the origin) into the signed message.

paypa1.com asks to log in → browser: “keys for paypa1.com?” → none exist: nothing to sign

Fake site: there is no key registered for its domain.
If an attacker relays the challenge, the signature names the wrong origin and the real server rejects it.

The chip holds a strong random key and lets the PIN unlock it. PIN security comes from rate limiting: a YubiKey’s FIDO2 PIN allows 8 wrong tries and it locks.

Put passkeys or a hardware key on email, bank and school accounts.
Register two keys and store the spare safely. Print the recovery codes.
Ask your phone carrier for a port-out PIN / number lock to block SIM swaps.

PHP2Shell

PHP2Shell (October 2026)

Date	What happened
Oct 17	Amazon’s honeypots catch an exploit attempt, before any announcement
Oct 20	Bug identifiers leak; PHP announces an emergency release
Oct 21	Fixes released; CISA alert; Cloudflare deploys firewall rules
Oct 21–23	Broad exploitation attempts by multiple groups

Two bugs (CVE-2026-109618/109619, severity 9.2/10) let an unauthenticated attacker run code on the server. They affect PHP 5.4 through 8.5, about 14 years of releases. Exploits were demonstrated against WordPress, Drupal, Joomla and Magento.
Found by researchers at Calif, OpenAI and Wiz, who used AI models in the work.

Memory safety

A program frees a piece of memory but keeps a pointer to it.
Later, new data lands in that spot, and the old pointer reads it as trusted.
Leftover state from one web request pointed at freed memory that the next request could fill.
Running out of memory halfway through setting up a request left half-initialized data that the cleanup code trusted.

PHP is written in C, which leaves memory management to the programmer. Microsoft and Google have each reported that about 70% of their serious security bugs are memory-safety bugs.
AI is faster: a security patch is a hint. Comparing old and new code (“patch diffing”) points straight at the bug. Turning a patch into a working exploit used to take weeks; it is shrinking toward hours.

Turn on automatic updates for your phone, laptop, browser and router, and restart when asked. Retire software and devices that no longer get updates, like an old router or an old WordPress site.

Under the hood: updates are signed by the vendor (RSA, ECDSA or Ed25519) and downloaded over TLS. Post-quantum: not yet, but forging a signature needs a quantum computer at the time of the attack, so there is no “harvest now” risk.

Key 4: Certificates

Padlock in the URL bar

A certificate authority (CA) is an organization your browser trusts to vouch that a public key belongs to a domain (e.g., Let’s Encrypt or DigiCert).

Root CA
in your browser's trust store→ signs →Intermediate CA→ signs →bank.com certificate
binds the name to the server's public key

Your browser verifies each signature up the chain. If they all check out, it trusts that the public key belongs to bank.com.
Any trusted CA can sign for any domain. The system is only as strong as the weakest of the hundreds of CAs your browser trusts.

These signatures use RSA or ECDSA. For ECDSA on the curve P-384 with base point $G$ of prime order $n \approx 2^{384}$:

private key: a uniformly random $d \in \{1, \dots, n-1\}$
public key: $Q = dG = \underbrace{G + G + \cdots + G}_{d \text{ times}}$

Recovering $d$ from $Q$ is the elliptic curve discrete log problem. The best known attack, Pollard rho, takes about $\sqrt{n} \approx 2^{192}$ steps.

A typical TLS connection: key exchange X25519 (elliptic-curve Diffie–Hellman), now usually the hybrid X25519 + ML-KEM-768 (post-quantum, default in Chrome, Firefox and Cloudflare); certificate signatures RSA-2048 or ECDSA P-256/P-384 (not yet post-quantum); the data itself AES-GCM or ChaCha20-Poly1305 (safe).

eMudhra: the private key was 4

On October 17, 2026, Mozilla got a report on eight intermediate certificates of eMudhra, an Indian CA.

Their private keys were $d \in \{4,\ 56,\ 66,\ 115,\ 155,\ 156,\ 230,\ 237\}$.

Random Number

Randall Munroe, xkcd 221 “Random Number” (2007), xkcd.com/221, CC BY-NC 2.5

What an attacker could do, and how it was contained

Six were intermediates for websites (TLS, the protocol behind https and the padlock): anyone could sign a valid-looking certificate for any website and intercept traffic with a padlock showing.
Two were code-signing intermediates: malware could be signed to look like it came from a legitimate publisher.
Exposure: about 18 months. The keys were generated in April 2025, and anyone could have recovered them from the public certificates at any time since. There is no evidence anyone did.
The response, Oct 17–22: Chrome, Apple, Microsoft and Mozilla pushed block lists to browsers. eMudhra and Sectigo, which had cross-signed them, revoked the certificates. Non-browser software that doesn’t check revocation may still be exposed.

Certificate Transparency. Browsers only accept certificates recorded in public append-only logs. Each log is a Merkle tree: every node is the SHA-256 hash of its two children (post-quantum safe). To prove a certificate is in a log of $N$ entries, the log sends just the $\lceil \log_2 N \rceil$ sibling hashes on the path to the root. A forged certificate must either appear in a public log, where domain owners can spot it, or be rejected.

A hall of fame of bad randomness

When	What went wrong	The math that broke it
2008	Debian’s OpenSSL seeded its generator with only the process ID	only 32 768 possible keys: list them all
2010	Sony signed PlayStation 3 software with the same ECDSA nonce $k$ every time	two signatures give two linear equations mod $n$: solve for $d$
2012	Many devices generated RSA keys with too little entropy at boot	$\gcd(N_1, N_2) = p$ factors both: about 0.5% of TLS hosts’ keys broken
2026	eMudhra CA keys $d \le 237$	a for-loop

Sony’s mistake. ECDSA signs a hash $h$ as $r = (kG)_x$, $s = k^{-1}(h + rd) \bmod n$. Given two signatures $(r, s_1)$ on $h_1$ and $(r, s_2)$ on $h_2$ with the same $k$, solve for $k$ and then for $d$.

Keep your browser and OS updated so you get the block lists.

Scams and fake sites

Reading a URL

The site’s real identity is the registrable domain: the part just before the first single /, read right to left.

https://www.paypal.com/signin PayPal
https://www.paypal.com.secure-login.app/verify secure-login.app
https://accounts.google.com@evil.example/ everything before @ is a “username” and is ignored
https://аррӏе.com all Cyrillic letters! Its real name is xn--80ak6aa92e.com

Homoglyphs. Unicode has many letters that look like Latin ones: Cyrillic а (U+0430), р (U+0440), е (U+0435), ӏ (U+04CF). If each of 5 letters in a name has 3 lookalikes, there are $4^5 - 1 = 1023$ impostor spellings of one name. Browsers show the punycode form (xn--…) when scripts are mixed suspiciously, but not always.

Don’t log in from links. Type the address or use a bookmark. Your password manager won’t auto-fill on the wrong domain: treat that as an alarm.

AI capabilities

Voice cloning: tools need only a short sample of audio, such as a voicemail greeting or a social media video.
Live deepfake video: in 2024 a finance worker at the engineering firm Arup wired about US $25 million after a video call in which every “colleague” was a deepfake.
Personalized phishing at scale: a model reads your public posts and writes to you in perfect English, or any other language. In a 2024 study, fully AI-written spear-phishing emails got 54% of recipients to click, as many as emails written by human experts; generic phishing got 12%.
Endless patience: one operator can run thousands of chatbot conversations at once, as in romance and fake-investment scams that build trust over weeks.
Fake sites in minutes: a pixel-perfect copy of a login page, and phishing kits that pass your password and one-time code to the real site as you type them.
Caller ID is easy to fake. US carriers sign it (STIR/SHAKEN, ECDSA P-256), but the signature is often lost between networks.

Authentication protocols for humans

Calling back on a known number is out-of-band authentication.

A family code word is a pre-shared secret.

A secret known fact is a challenge-response protocol.

Locking down your credit

Quantum computers

Shor’s algorithm (coming soon in this course!) would break RSA and elliptic-curve cryptography on a large enough quantum computer.
Harvest now, decrypt later: adversaries can record encrypted traffic today and decrypt it once such machines exist.
The response is already deployed: NIST standardized the lattice-based ML-KEM (FIPS 203, 2024). Chrome, Firefox and Cloudflare already use a hybrid X25519 + ML-KEM-768 key exchange by default.

Job	Typical algorithms	Used in	Quantum computer	Status
Key exchange (public key)	X25519 / ECDH, RSA	TLS, SSH, Signal, iMessage	broken by Shor; harvest now, decrypt later	hybrid ML-KEM already default: Chrome, Firefox, Cloudflare, OpenSSH 10, Signal, iMessage PQ3
Signatures (public key)	RSA, ECDSA, Ed25519	certificates, passkeys, software updates, caller ID	broken by Shor, but only for forgeries made once the machine exists	ML-DSA, SLH-DSA standardized (FIPS 204, 205, 2024); deployment just starting
Encryption and MACs (symmetric)	AES, ChaCha20, HMAC	TLS data, password vaults, TOTP, disk encryption	Grover: square-root speedup at best	AES-256 is fine
Hashing	SHA-256, bcrypt, Argon2id	password storage, CT logs, HIBP	Grover again	fine

Stored on server	If the database leaks…
`password123`	every password is just there
\(H(\text{pw})\)	one precomputed table cracks everyone; identical passwords look identical
\(s,\ H(s \,\Vert\, \text{pw})\) with random salt \(s\)	attacker must guess each user separately
\(s,\ \text{Argon2id}(s, \text{pw}; \text{cost})\)	each guess costs real time and memory

Hash	Guesses / second
MD5 (old, fast)	\(\approx 1.6\times 10^{11}\)
SHA-256 (fast)	\(\approx 2.2\times 10^{10}\)
bcrypt, cost 12	\(\approx 1.4\times 10^{3}\)

Password space	Size	Bits	Modern online hacker	bcrypt-12	MD5	Modern offline hacker
a real human’s password (top \(10^9\) guesses)	\(10^9\)	30	12 days	8 days	6 ms	instant
8 lowercase letters	\(2.1\times10^{11}\)	38	7 years	5 years	1 s	1 ms
8 random printable characters	\(6.6\times10^{15}\)	53	200 000 years	150 000 years	11 hours	41 s
4 random Diceware words	\(3.7\times10^{15}\)	52	120 000 years	80 000 years	6 hours	23 s
6 random Diceware words	\(2.2\times10^{23}\)	78	∞ (in practice)	∞ (in practice)	43 000 years	44 years
12 random printable characters	\(5.4\times10^{23}\)	79	∞ (in practice)	∞ (in practice)	100 000 years	110 years

Timeline

Passwords

How a server should store your password

Slow hashes

Password strength

How long does guessing take?

Reuse

How a password manager works

If the password manager itself is breached

Second factors

Second factors

TOTP (Authenticator App)

Passkeys and YubiKeys: public-key authentication

Why passkeys can’t be phished

PHP2Shell

PHP2Shell (October 2026)

Memory safety

Key 4: Certificates

Padlock in the URL bar

eMudhra: the private key was 4

Random Number

What an attacker could do, and how it was contained

A hall of fame of bad randomness

Scams and fake sites

Reading a URL

AI capabilities

Authentication protocols for humans

Locking down your credit

Social security numbers and identity theft

Quantum computers

Quantum computers