Can ECB mode really leak some characters?

Question

In an Ars Technica article about Adobe's use of 3DES in ECB mode, there's a paragraph

The passwords, according to password expert Steve "Sc00bz" Thomas, are encrypted in a mode known as ECB. That was a poor choice on the part of Adobe engineers, because ECB often leaks information about the passwords, such as their last few characters and some of their lengths. In certain cases, for example, passwords that end in e will generate an encrypted string that ends in n2auThm2+Q==; those that are nine or 17 characters long will sometimes end in mfZq5OGbb5.

Is it really the case?

Answer 1

The article mentions that 3-DES was used to encrypt these passwords in ECB mode. DES has a 64-bit/8-byte block.

So let's say you use ECB to encrypt a nine byte password. The first 8-bytes are encrypted using ECB. So far so good.

But what happens when we come to the ninth byte? Well we're now in a new block but only the first byte is populated with any data. The rest are zeros (assuming no padding is used).

This means that there are only 256 possible encryptions of the second block for all nine byte passwords. With a large enough database, it will be relatively easy to guess what these encryptions are. If you had a dictionary of common nine character passwords, a mere frequency analysis of the last character of the password and a comparison to the frequency of the second ECB blocks would be enough!

So yes, the paragraph is correct. It's a significant hole in the scheme they used.

Answer 2

ECB leaks the identity of blocks. After padding some blocks on the end will be eminently predictable, for instance a block with a single 'e' and all zero padding.

Answer 3

It is the case. All 8 character passwords in the leaked file end in "ioxG6CatHBw==" Source: http://pastebin.com/iDTFARwq