CYBERCOM’s Secret Code Demystified

“Punch in 9ec4c12949a4f31474f299058ce2b22a. Searching MD5 hash generator will let you reverse the process or make exciting new codes with your friends.”

MD5 hashes cannot be “reversed”. It is a one way algorithm that may either be brute-forced (every permutation tested), or a hacked via “lookup” (involving anything from comparing the hash with a hash of a known plaintext word, to rainbow tables).

Someone had already plugged in the mission statement into whatever website you used to “decrypt” the hash and it just compared the known hashes.

I’m no expert, so feel free to build on or debunk what I’m about to say, but: both of you are right and wrong.

Md5 can’t simply be “converted” back to regular text with some formula etc. On the surface this would mean decrypters are BS – and they very well may be.

However, the decrypters available online work through a database of pre-calculated strings stored with their original text. Using one of these databases, one would find that the text has been stored by someone to match that code.

Thus, while it isn’t a literal “conversion” to the original text, it’s still capable of producing it should someone have added it earlier.

For those curious, the text you Have to enter:
USCYBERCOM plans, coordinates, integrates, synchronizes and conducts activities to: direct the operations and defense of specified Department of Defense information networks and; prepare to, and when directed, conduct full spectrum military cyberspace operations in order to enable actions in all domains, ensure US/Allied freedom of action in cyberspace and deny the same to our adversaries.

Be sure to use a generator that can handle the full text (several web-based ones only allow 255 characters), and be sure to copy that text Exactly: no spaces before or after the paragraph, as even THIS will avalanche the entire code into something else.

Uh, guys, they’re using the 32 bit md5 hash. Maybe that’s why you got something else. Oh, and an md5sum, as I understand it, is also different.

Here’s the decrypted I used:
Got the same thing John did.

Also ran it the other way through this:

Worked both ways because md5 hashes FOR STRINGS can be reversed. Now and md5sum FOR A FILE or something of considerable length can’t. That’s because reversing an 8 bit character has very few permutations.

><> B

I tried this yesterday and got a different hash. I copied and pasted the Mission Statement from the US Cyber Command Fact Sheet, which had an extra comma when compared to the Mission Statement above:

From the fact sheet:
USCYBERCOM plans, coordinates, integrates, synchronizes, and conducts

From this article (and presumably, some other source):
USCYBERCOM plans, coordinates, integrates, synchronizes and conducts

I wanted that t-shirt

Elliott,

md5decrypter.com is a database of hashes, and not an actual decrypter.

To prove the point, allow me to challenge you with this hash:

e5baf1859e944b21e770b497a6b1fe8e

I think the point they were trying to make, Elliott, was that the only reason you can decrypt it on md5decrypter, is because somebody has already encrypted it on the same site. It’s not actually “decrypting” anything, that’s just a name. It’s simply comparing what you enter to a database of known strings. To test it yourself, invent a new sentence on another encrypter (eg, ). No common phrases, something new and different. I used, “we don’t live in a yellow submarine”. Take the resulting md5 key to md5decrypter and enter it. It will come back unknown, because it hasn’t been encrypted on their database. Now, go to the encrypter tab on the same site, and enter the same original sentence. It will provide you with the same md5 key, and now it will show up in the decrypter as well. It’s just a database. There are no real md5 decryption sites out there, they all just compare to their own databases of already known results.

I took the mission statement, being very careful to select only the text, ending period and no quotes before copying and pasting to a web MD5 hasher. Got the exact value as in the logo. Just one bit of difference would change the hash result. Nothing too sinister. Really just an inside joke. But if they can put it on their logo then they’ve got the right stuff in my book.

Elliott, your technique of using google is only possible because the hash has been cracked and added to the database. It had to have been, at one time, cracked. MD5 hashes (or any hash for that matter) is extremely difficult to solve when there are no databases that contain the given hash (this is usually the case). Please educate yourself before posting. Read here:

I’m excited to see this much buzz about my first tech blog, especially from so many people much more computer savvy than myself. Certain posts demand I retract taking credit for cracking the code, and of course I will. Everybody now knows it was Jemele Hill the wired.com contest winner, or perhaps it was it Sean-Paul Correll, the Panda Security Researcher. Multiple stories circulate. I only took credit jokingly. All I really did was independently decipher what the code was using my computer skills, limited as they may be. Through this blog I’ve learned more about MD5 hash than I’d ever really wanted to know, but I sincerely appreciate all the cyber experts taking time to both school me and set the record straight on alpha numeric message digest encryptions. The main point I wanted to get home is there is a unique element in the Cyber Command Logo, and it represents a throwback to early days of Internet coding while embedding the command’s mission statement into the logo at the same time. Well played CYBERCOM.
Very respectfully,
MC2 Fabrizio

Person who invented that play is good enough to project a plan how to discover terorrists in Afghanistan etc,,,by installing small autonome dissimulable cameras near roads and points: full contacts 24 hr with an “air reader controling their site images and having their position”. If someone takes the gadget nice small camera…air reader controler will locate new site of location. Camera will not have any movable-complicated piece…it will be just a window-view at many places night and day. As small as possible not reflecting on sun and no condensation on view-eye part. Medal for invention and award for modern technics gadget-assistance in army. Sizes…max golf ball. Ready?Go!

Lol I cant believe a government website linked to this blog with invalid information. Like everyone said, md5 is a one way hashing algorithm. To reverse it you must apply brute force algorithms in combination with other tools. The only way to check if the mission statements hash is: 9ec4c12949a4f31474f299058ce2b22a, is to run the mission statement through a MD5 hash generator. I ran the mission statement through php’s md5() function and got the hash on the logo.

C4I AF NQK SMI HQ

Here's me doubting it would have taken alot longer to crack without a.MD5 convertor, eh!

32-bit, the exact number of characters in the inner gold ring. This is an encrypted four-batch of bytes, that refer to the platform computer that generated the seal, graphically, and with text. Not quite Enigma, but without decryption, the message is impossible to decypher.

A very good blog, thanks for updating.