Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

stacksmashing.net

Post reply on HN
Print view View original

71–80 of 90 posts

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#71

Post by ams6110 »

pjscott wrote: post #59
yafujifide wrote: post #44

Earlier quoted context omitted.

> How the hell are we going to get them to use longer passwords, and change them every year? You merely require them to use longer passwords, and require them to change them every year. My university does this. They require a minimum of 8 characters, and they require that we change our password every 3 months or we can't log in.

How many people do things like changing their password from "soccer5" to "soccer6" every three months?

That's avoided by not allowing more than three consecutive characters from the old password to be in the new password. It gets really annoying, trust me.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#72

Post by pjscott »

ams6110 wrote: post #71
pjscott wrote: post #59

Earlier quoted context omitted.

How many people do things like changing their password from "soccer5" to "soccer6" every three months?

That's avoided by not allowing more than three consecutive characters from the old password to be in the new password. It gets really annoying, trust me.

That would mean that they're storing the passwords themselves, hopefully encrypted, rather than just a salted slow hash of them. That makes me nervous. Should it?

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#73

Post by Groxx »

>This just shows one more time that SHA1 is deprecated

This just shows ignorance about hashing functions, especially fast ones. If they had used SHA-512, or say SHA-65536, it wouldn't be any more secure against brute-forcing / dictionary attacks. Barring SHA1 being cracked - ie, finding an efficient way to find SHA1 collisions - ie, "reversing" SHA1, it's no more deprecated than any other non-cracked hashing function.

About your only option is s/bcrypt, or something similar, which are intentionally slow / hard, to defeat brute-force attacks like this.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#74

Post by orborde »

nl wrote: post #46
windll wrote: post #17

Earlier quoted context omitted.

Last time I checked, GPU processing has a better-bang-for-the-buck than FPGA processing, and the gap continues to widen.

I suspect the NSA doesn't care too much about bang-for-buck. 22nm FPGA's [1] seem like they would work pretty well. In an interesting twist, The Register claims that Achronix's decision to use Intel was driven in part by national security considerations. We've reported extensively on the idea that chips fabbed overseas in insecure facilities could contain hidden kill switches or backdoors that would let an opponent c…

I suspect the NSA doesn't care too much about bang-for-buck.

Bang-for-buck is pretty much the name of the game in brute-force cracking. You're right that NSA probably doesn't have any budget constraints, but they'd still be interested in getting the most hashes/second possible out of $10 million.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#75

Post by mthoms »

sathyabhat wrote: post #66
konad wrote: post #28

isn't it illegal for a German to post on how to crack passwords ?

Why ?

In Germany, linking to illegal material can be considered a crime itself, for example linking to pirated software/media.

http://www.webtvwire.com/linking-law-expert-dr-stephan-ott-t...

IANAL but I suspect the OP feels the same laws could be applied here.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#76

Post by mducia »

windll wrote: post #17
cperciva wrote: post #14

Earlier quoted context omitted.

They've just brought near-government grade crypto-breaking capabilities to the mass market. No, they really haven't. Near-government grade KDF-cracking capabilities will be when Amazon announces FPGA Compute instances.

Last time I checked, GPU processing has a better-bang-for-the-buck than FPGA processing, and the gap continues to widen.

World's fastest supercomputer is now nvidia's gpus: http://spectrum.ieee.org/tech-talk/computing/hardware/china-...

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#77

Post by fragmede »

bl4k wrote: post #24
davidu wrote: post #9

Earlier quoted context omitted.

At the very least, add a random salt added to each plaintext before you run it through the SHA1. This will at least defeat rainbow attacks fairly well. That said, you need to do more and move beyond SHA1 since you can now reverse a SHA1 into plaintext with the computing power EC2 gives you.

technically you aren't reversing it, you are calculating it through brute-force. best analogy for a hash is smashing a plate. you may be able to glue it back together but it is not the same plate btw I wonder how long before somebody calcs and loads a rainbow table onto AWS and charges for lookups. so tempted...

http://www.wpacracker.com/

Runs a WPA cracker against your provided pcap files for $17- $40, depending on how fast and how extensive a word list you want to use. (Yes, I realize they aren't using rainbow tables, but WPA uses the SSID as salt, so that wouldn't be as usefu.)

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#78

Post by nezza-_- »

16s wrote: post #69
msmith wrote: post #68

Earlier quoted context omitted.

How long does it take your software to crack the other half?

That depends on the number and type of CPUs available. I know better than to race my CPU against a GPU. I won't win. I'm just pointing out the fact that if you have a fast GPU (or a cluster of them as the article suggests), then the hashes should be much better than what is provided. With those hashes, any CPU based cracker can do them easily. The article says 1 to 6 character passwords. With 12 cores, I can enumerat…

In the article it's stated that the hashes are brute forced using the provided charset. I think you used a wordlist, which is a whole other thing.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#79

Post by mrb »

16s wrote: post #54

With the right hash type (unsalted md4... yes, I'm looking at you Microsoft Windows Active Directory) and a top notch Nvidia or AMD graphics card, one can attempt roughly 600 million hashes per second at home in the living room. Also, one of the teams used Amazon servers during the 2010 Defcon Crack Me If You Can contest. Here is their write-up: http://contest.korelogic.com/team_CrackHeads.html

600 million? Try 10x that. A top notch HD 5970 does 6 billion MD5 hashes/sec. The MD4 rate is roughly 25% faster.

http://golubev.com/gpuest.htm

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#80

Post by corin_ »

bl4k wrote: post #24
davidu wrote: post #9

Earlier quoted context omitted.

At the very least, add a random salt added to each plaintext before you run it through the SHA1. This will at least defeat rainbow attacks fairly well. That said, you need to do more and move beyond SHA1 since you can now reverse a SHA1 into plaintext with the computing power EC2 gives you.

technically you aren't reversing it, you are calculating it through brute-force. best analogy for a hash is smashing a plate. you may be able to glue it back together but it is not the same plate btw I wonder how long before somebody calcs and loads a rainbow table onto AWS and charges for lookups. so tempted...

Adding a few cracks and glue doesn't make it a different plate...
Post reply on HN