25-GPU cluster cracks every standard Windows password in less than 6 hours • Hacker News Board

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#31

Post by mrb » Mon, Dec 10, 2012, 6:24 AM UTC

patrickgzill wrote: post #16

bradleyland wrote: post #7

Earlier quoted context omitted.

Put your tin foil hats away. This doesn't "crack" NTLM, it brute forces at a very high rate. The NSA has more money to spend, but are similarly limited by the hardware available at any given point.

The NSA has access to their own chip fabrication facilities. I do not know if they own their own plant, or just have secure fab space at some other company's plant. So they could have easily fabbed something like this, or a tuned architecture specifically designed for the purpose.

NSA does not own a foundry anymore. Modern top-of-the-line foundries cost too much, even for the NSA.

Instead, they participate in a program to partner with domestic companies to manufacture their chips: http://trustedfoundryprogram.org/

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#32

Post by rjempson » Mon, Dec 10, 2012, 6:47 AM UTC

I'm not sure there is much significance to this article.

It points out "The technique doesn't apply to online attacks, because, among other reasons, most websites limit the number of guesses that can be made for a given account."

Same applies to Windows.

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#33

Post by rjempson » Mon, Dec 10, 2012, 6:51 AM UTC

rjempson wrote: post #32

I'm not sure there is much significance to this article. It points out "The technique doesn't apply to online attacks, because, among other reasons, most websites limit the number of guesses that can be made for a given account." Same applies to Windows.

Thinking about it some more. Is the only practical exploit of this the case where a rogue sysadmin wants to figure out user passwords (without resetting the password and therefore alerting the user)?

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#34

Post by ramblerman » Mon, Dec 10, 2012, 6:55 AM UTC

rjempson wrote: post #32

I'm not sure there is much significance to this article. It points out "The technique doesn't apply to online attacks, because, among other reasons, most websites limit the number of guesses that can be made for a given account." Same applies to Windows.

I think what they're referring to is having access to the physicial harddisk. In linux terms it would equate to having a copy of the /etc/passwd file.

For example the FBI seizes someones computer. This would allow them to brute force without said restriction.

So yes, from an online, or standard entry viewpoint this is a moot point. Also a properly encrypted hard drive using something like truecrypt is still pretty impenetrable regardless.

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#35

Post by Blara » Mon, Dec 10, 2012, 7:04 AM UTC

madao wrote: post #17

I remember back when I was doing a network engineering course the guys could crack a windows password in minutes offline, simple matter of grabbing the database from the machine. I think once you have the machine offline unless you encrypt the data your pretty screwed regardless..

When was this? I know older windows versions stored passwords in plain text... I can't remember when they switched to hashed passwords but I think it was around XP or Vista

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#36

Post by peteretep » Mon, Dec 10, 2012, 7:42 AM UTC

Less good against non-NTLM passwords ... from my comment last time:

Taking SHA-1 (which YOU MUST NOT USE for password hashing blah), it only manages 63 billion a second. To try all the passwords for that in the alphanumeric space:

- 10 chars: 35 weeks

- 11 chars: 44 years

- 12 chars: 2,800 years

- 16 chars: 11 times the age of the sun

10 chars for bcrypt: 600,000 years...

http://www.wolframalpha.com/input/?i=%2865**16+%2F+63+billio...

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#37

Post by pserwylo » Mon, Dec 10, 2012, 7:45 AM UTC

rjempson wrote: post #32

I'm not sure there is much significance to this article. It points out "The technique doesn't apply to online attacks, because, among other reasons, most websites limit the number of guesses that can be made for a given account." Same applies to Windows.

I disagree. If a website gets hacked and its customer database is stolen, then this could be used to crack the user passwords.

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#38

Post by halviti » Mon, Dec 10, 2012, 7:47 AM UTC

ramblerman wrote: post #34

rjempson wrote: post #32

I'm not sure there is much significance to this article. It points out "The technique doesn't apply to online attacks, because, among other reasons, most websites limit the number of guesses that can be made for a given account." Same applies to Windows.

I think what they're referring to is having access to the physicial harddisk. In linux terms it would equate to having a copy of the /etc/passwd file. For example the FBI seizes someones computer. This would allow them to brute force without said restriction. So yes, from an online, or standard entry viewpoint this is a moot point. Also a properly encrypted hard drive using something like truecrypt is still pretty im…

I've grabbed the SAM file from remote IIS servers in my younger years and cracked the passwords locally.

Buffer overflow the web service, bind a command shell to a port running as the system account (by having the system execute shellcode used in the buffer overflow), netcat to your open port, ftp the SAM (located in the repair directory) to somewhere you can retrieve it, download the file, delete all of the logs, crack the file.

Hard drive encryption would have done nothing to prevent this.

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#39

Post by ygra » Mon, Dec 10, 2012, 8:04 AM UTC

halviti wrote: post #38

ramblerman wrote: post #34

Earlier quoted context omitted.

I think what they're referring to is having access to the physicial harddisk. In linux terms it would equate to having a copy of the /etc/passwd file. For example the FBI seizes someones computer. This would allow them to brute force without said restriction. So yes, from an online, or standard entry viewpoint this is a moot point. Also a properly encrypted hard drive using something like truecrypt is still pretty im…

I've grabbed the SAM file from remote IIS servers in my younger years and cracked the passwords locally. Buffer overflow the web service, bind a command shell to a port running as the system account (by having the system execute shellcode used in the buffer overflow), netcat to your open port, ftp the SAM (located in the repair directory) to somewhere you can retrieve it, download the file, delete all of the logs, cr…

I doubt law enforcement would go that route if they seized your stuff.

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#40

Post by [deleted] » Mon, Dec 10, 2012, 8:08 AM UTC

ygra wrote: post #39

halviti wrote: post #38

Earlier quoted context omitted.

I've grabbed the SAM file from remote IIS servers in my younger years and cracked the passwords locally. Buffer overflow the web service, bind a command shell to a port running as the system account (by having the system execute shellcode used in the buffer overflow), netcat to your open port, ftp the SAM (located in the repair directory) to somewhere you can retrieve it, download the file, delete all of the logs, cr…

I doubt law enforcement would go that route if they seized your stuff.

[deleted]