Cracking 14 Character Complex Passwords in 5 Seconds
1–10 of 64 posts
Re: Cracking 14 Character Complex Passwords in 5 Seconds
#2I believe it's not accidental that all passwords that they crack in the demo are 14 characters or less, that can mean that they attack the hashes which are always possible to crack, the speedup they claim is 100 (they simply increased tables from 8 GB to 80 GB and put them on SSD) but e.g. 1000 seconds before was also very fast for somebody who just needed to gain access to one target.
Re: Cracking 14 Character Complex Passwords in 5 Seconds
#3Hmm, I guess I'll just go out to 15 (or 60, safe for a few years) digits of Pi instead of 14...
Re: Cracking 14 Character Complex Passwords in 5 Seconds
#4If they're really just using 80GB on the SSD (as the linked-to article suggests), why not just use a server with 128GB of RAM and avoid writing to disk altogether?
Re: Cracking 14 Character Complex Passwords in 5 Seconds
#5With a separate salt for each password the rainbow table becomes useless.
If an attacker has both the salt and the hash, they are back to computing the table (brute force)
Re: Cracking 14 Character Complex Passwords in 5 Seconds
#6If they're really just using 80GB on the SSD (as the linked-to article suggests), why not just use a server with 128GB of RAM and avoid writing to disk altogether?
True, but I suspect a 80GB SSD is a lot easier to afford for your common basement hacker than a box with 128GB of RAM.
Re: Cracking 14 Character Complex Passwords in 5 Seconds
#7Considering that most password are shorter than 14 characters, everyone implementing hashed passwords without a random salt could just store them as plain text. The rainbow table for the most common passwords (names, cities, pet names etc.) would fit in less than 1GB and would probably yield a very high success rate. There's no need to use complex passwords to prove that hashes without proper salting are bound to fail.
Re: Cracking 14 Character Complex Passwords in 5 Seconds
#8People, NTLM hashes have been dead for years. Stop using them.
Re: Cracking 14 Character Complex Passwords in 5 Seconds
#9If they're really just using 80GB on the SSD (as the linked-to article suggests), why not just use a server with 128GB of RAM and avoid writing to disk altogether?
I'm not entirely sure which algorithm is used in WinXP for password hashing, but it might still be an LM hash, which has some security flaws. All lower-case characters are converted into upper case characters and the 14-byte password (cannot be longer) is divided into two 7-byte passwords, which can be cracked alone (sort of).
So, 300 billion passwords per second is still a very impressive load, but the keyspace for WinXP passwords is somewhat limited, which would also explain why 80 GB of rainbow tables are sufficient.
But correct me if I'm wrong.
Re: Cracking 14 Character Complex Passwords in 5 Seconds
#10If they're really just using 80GB on the SSD (as the linked-to article suggests), why not just use a server with 128GB of RAM and avoid writing to disk altogether?
True, but I suspect a 80GB SSD is a lot easier to afford for your common basement hacker than a box with 128GB of RAM.
23GB of ram on EC2 is 1.60 an hour. Spin up 10 for $16.00. I think most hackers can afford that and it gives them enough computing power to match an 80GB SSD, I would say.