25-GPU cluster cracks every standard Windows password in less than 6 hours • Hacker News Board

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#41

Post by muyuu » Mon, Dec 10, 2012, 8:43 AM UTC

Blara wrote: post #35

madao wrote: post #17

I remember back when I was doing a network engineering course the guys could crack a windows password in minutes offline, simple matter of grabbing the database from the machine. I think once you have the machine offline unless you encrypt the data your pretty screwed regardless..

When was this? I know older windows versions stored passwords in plain text... I can't remember when they switched to hashed passwords but I think it was around XP or Vista

Windows never stored system passwords in plain text.

It did use the LM hash function to store passwords, which was rather weak, making rainbow table attacks easy.

http://en.wikipedia.org/wiki/LM_hash

For backwards compatible this hash function was commonly in use up to Windows 7 (it was disabled by default in Vista though). There are decent workarounds since NT.

NTLMv1 is also rather easy to crack. NTLMv2 is better but took a long time to be in wide use. Kerberos is strong too and can be used

Long story short, Windows OS prior to Vista maintain weaker hash support for backwards compatibility by default (although you can work around it since NT 4, almost nobody did this). Windows Vista still has support for them if you want to turn it on, but by default it's off. From Windows 7 there is no support for weak system hashes. For Active Directories, MIT's Kerberos (used typically in Unix networked environments since the 80s) replaced NTLM from Windows 2000 on.

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#42

Post by Zenst » Mon, Dec 10, 2012, 8:46 AM UTC

ramidarigaz wrote: post #18

cynwoody wrote: post #10

Impressive as the numbers are, it's worth remembering that this is an "offline crack", going against a stolen list of encrypted passwords. If they can steal your database of encrypted passwords, you've got a problem no matter how strong the passwords are. How many guesses per second do you get in a typical online crack? E.g., a script kiddie trying to guess your cloud server's SSH password?

On my webserver, you get 3 chances and then a 24 hour ip ban. I think that comes out to 0.00003 passwords per second :) The particularly persistent IPs get a special iptables rule.

I remember using the nice fingerprint reader upon my old IBM laptop once, worked well until you changed your password and then if you had not updated the one in finger print encypted libary you got some impressive automation. Usualy it would automate yoru password once you scanned your finger. Now with the power of a computer you could scan your finger once and watch as the wonderful system tried the wrong password as fast as it could repeat upon itself. Was fun restoring my blackberry from backup after the 10 failed attempts in nanoseconds.

I like your approach though though I would redirect them to a appeal process that a human could read, but I'm not aware of the volumes you have to deal with. I would though wonder how this system will adapt come IPV6 times and with that if your not using it then I hope it is disabled as if your ISP/provider suddenly starts processing it or running tests then that latent IPV6 stack doing nothing could suddenly come to life and you probably don't have many firewall or IPtable rules for that in place. But that is a problem many will face over the years comming.

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#43

Post by muyuu » Mon, Dec 10, 2012, 8:50 AM UTC

peteretep wrote: post #36

Less good against non-NTLM passwords ... from my comment last time: Taking SHA-1 (which YOU MUST NOT USE for password hashing blah), it only manages 63 billion a second. To try all the passwords for that in the alphanumeric space: - 10 chars: 35 weeks - 11 chars: 44 years - 12 chars: 2,800 years - 16 chars: 11 times the age of the sun 10 chars for bcrypt: 600,000 years... http://www.wolframalpha.com/input/?i=%2865**1…

http://www.imdb.com/title/tt0109686/quotes?qt=qt0383410

Lloyd: What are my chances?

Mary: Not good.

Lloyd: You mean, not good like one out of a hundred?

Mary: I'd say more like one out of a million.

[pause]

Lloyd: So you're telling me there's a chance... YEAH!

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#44

Post by alexkus » Mon, Dec 10, 2012, 9:10 AM UTC

halviti wrote: post #38

ramblerman wrote: post #34

Earlier quoted context omitted.

I think what they're referring to is having access to the physicial harddisk. In linux terms it would equate to having a copy of the /etc/passwd file. For example the FBI seizes someones computer. This would allow them to brute force without said restriction. So yes, from an online, or standard entry viewpoint this is a moot point. Also a properly encrypted hard drive using something like truecrypt is still pretty im…

I've grabbed the SAM file from remote IIS servers in my younger years and cracked the passwords locally. Buffer overflow the web service, bind a command shell to a port running as the system account (by having the system execute shellcode used in the buffer overflow), netcat to your open port, ftp the SAM (located in the repair directory) to somewhere you can retrieve it, download the file, delete all of the logs, cr…

> Hard drive encryption would have done nothing to prevent this.

And it's quite common in corporate environments for PGP Desktop HDD encryption to be setup to use the Windows password as the key to accessing the HDD encryption key(s).

For this reason we're advised not to put out laptops in sleep mode when transporting the laptop as someone finding the laptop could do something like the above (remote exploit and then get access). When coming out of hibernation PGP desktop requires the HDD password to be provided so that it isn't in an exploitable state.

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#45

Post by hayksaakian » Mon, Dec 10, 2012, 9:25 AM UTC

Caerus wrote: post #29

hayksaakian wrote: post #14

Earlier quoted context omitted.

Individual char variance is less significant compared to additional chars. Look at the xkcd password entropy comic

From what I remember of the comic, the point was not the length of the password. The entropy was calculated based on 4 possible words. Assuming ~2000 common English words, the number of possible passwords in that format is 2000^4 ~= 2^44. If the calculation is based on a completely random string of letters it is far stronger at 26^30 ~= 2^141 but it's safe to assume people aren't going to memorize a 30 character rand…

Why would that be true?

Wouldn't you have to know in advance that the longer password was only lower case letters?

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#46

Post by jasonwatkinspdx » Mon, Dec 10, 2012, 9:33 AM UTC

rjempson wrote: post #32

I'm not sure there is much significance to this article. It points out "The technique doesn't apply to online attacks, because, among other reasons, most websites limit the number of guesses that can be made for a given account." Same applies to Windows.

Offline attacks matter. The last few years have seen a continuous stream of high profile account database leaks. There are now some 1 billion known real user selected passwords that are readily downloaded from any of a number of shady sites.

It is irrational to assume that password database leaks won't continue.

The hashing scheme and salting matters less and less, as the total entropy humans can conveniently recall is quite limited and moore's law keeps marching.

We need a fundamental rethinking of security and identity on the internet, and IMHO the OSS world needs to get there before partisan commercial interestes.

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#47

Post by ChrisNorstrom » Mon, Dec 10, 2012, 9:49 AM UTC

Guess what? Back in 2009, I started using a method to remember long passwords with a huge # of letters, numbers, & special characters.

Gw?Bi2009Isuamtrlpwah#ol,n,&sc. (31 characters)

Create memorable sentences and create a password using the first letter of each word & all the numbers and punctuation. After entering it 10 or so times you'll get used to it pretty quickly.

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#48

Post by raverbashing » Mon, Dec 10, 2012, 10:52 AM UTC

plaguuuuuu wrote: post #26

patrickgzill wrote: post #16

Earlier quoted context omitted.

The NSA has access to their own chip fabrication facilities. I do not know if they own their own plant, or just have secure fab space at some other company's plant. So they could have easily fabbed something like this, or a tuned architecture specifically designed for the purpose.

It's very probable that they have and if so, it's almost certain that it would involve specialized hardware implementations (ASIC, FPGA, whatever) rather than commodity graphics hardware which is burdened with expensive and useless stuff like onboard memory and would be power inefficient considering that the entire purpose of NSA in the first place is to provide SIGINT and encrypt or decrypt signals, it's almost a gi…

Not sure

Money buys more commodity hardware faster than the time/money used to develop a chip

It's not hard to make tens, or maybe even hundreds of GPUs beat a specialized chip except for very specific things

And even for something specialized it's probably easier to use an FPGA

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#49

Post by phpnode » Mon, Dec 10, 2012, 11:24 AM UTC

ChrisNorstrom wrote: post #47

Guess what? Back in 2009, I started using a method to remember long passwords with a huge # of letters, numbers, & special characters. Gw?Bi2009Isuamtrlpwah#ol,n,&sc. (31 characters) Create memorable sentences and create a password using the first letter of each word & all the numbers and punctuation. After entering it 10 or so times you'll get used to it pretty quickly.

or you can literally write the whole sentence, which is even more secure and you don't have to remember any special rules, just the sentence itself. Of course it's more typing:

    Guess what? Back in 2009 I saw a uniquely attired man traipsing round local places with a high number of legs, necks and shirt collars.

136 characters or 14 Gigayears to crack. Wow today I learnt that there's such a thing as a Gigayear.

Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours

#50

Post by muyuu » Mon, Dec 10, 2012, 11:42 AM UTC

patrickgzill wrote: post #3

If this is done with commodity hardware, now, what were the NSA's capabilities even 5 years ago?

I wouldn't call a big cluster of commodity hardware simply commodity hardware because then many of the top supercomputers of the world are commodity hardware.

The combination is exotic enough to be considered non-commodity hardware.