NTLM hashes are stored in Active Directory servers as one round of unsalted MD4. It's plain MD4. Not many people know this and I only point it out as it's important to understand that when talking about how many cracks per second they are getting.
25-GPU cluster cracks every standard Windows password in less than 6 hours
51–60 of 77 posts
Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours
#52I'm not sure there is much significance to this article. It points out "The technique doesn't apply to online attacks, because, among other reasons, most websites limit the number of guesses that can be made for a given account." Same applies to Windows.
I think what they're referring to is having access to the physicial harddisk. In linux terms it would equate to having a copy of the /etc/passwd file. For example the FBI seizes someones computer. This would allow them to brute force without said restriction. So yes, from an online, or standard entry viewpoint this is a moot point. Also a properly encrypted hard drive using something like truecrypt is still pretty im…
Technically you want /etc/shadow as that is where the actual hashes are stored.
On a Linux system usually any user has at least read access to /etc/passwd but only root has /etc/shadow.
This attack would presume that you already have either physical access to the disk or you have already compromised the machine remotely to basically root or admin type level.
Of course being able to get the actual passwords of users would be useful to an attacker because they might be able to use them to elevate from access to one system to potentially other systems where users might well be using the same password.
Not sure how drive encryption with Truecrypt would work in this case. I presume password hashes are stored outside of the encrypted part otherwise every user would have to enter the volume key before they signed in regardless of their access level. Which would mean distributing the volume key widely.
Truecrypt is also vulnerable in the sense that it is often possible to grab the volume key straight out of DRAM if the computer is on or has only recently been switched off.
Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours
#53Impressive as the numbers are, it's worth remembering that this is an "offline crack", going against a stolen list of encrypted passwords. If they can steal your database of encrypted passwords, you've got a problem no matter how strong the passwords are. How many guesses per second do you get in a typical online crack? E.g., a script kiddie trying to guess your cloud server's SSH password?
it's my understanding that NTLM hashes are sent over the wire...? therefore any machine on the local network could intercept this hash via network-level attacks such as ARP poisoning, WiFi attacks, etc. Then the cracking box would quite happily and easily brute force the entire 8 char keyspace and reveal the pass. it's a different threat model to hash+email retrieval via sql injection which can lead to all sorts of n…
If they are sent over the wire I hope there is some additional encryption such as SSL involved in the transmission!
Otherwise regardless of hash crackability, one would be able to do authentication bypass by simply sniffing hashes and replaying them.
Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours
#54I remember back when I was doing a network engineering course the guys could crack a windows password in minutes offline, simple matter of grabbing the database from the machine. I think once you have the machine offline unless you encrypt the data your pretty screwed regardless..
When was this? I know older windows versions stored passwords in plain text... I can't remember when they switched to hashed passwords but I think it was around XP or Vista
You might be thinking of a very old version of Windows, like 3.1 vintage.
3.1 didn't really have passwords to access the system, it did however have screensaver passwords which were either plain text or a very weak hash.
They could also be disabled by simply deleting the line for a .ini file which was bad considering it didn't have the concept of users who could only access certain files.
Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours
#55Less good against non-NTLM passwords ... from my comment last time: Taking SHA-1 (which YOU MUST NOT USE for password hashing blah), it only manages 63 billion a second. To try all the passwords for that in the alphanumeric space: - 10 chars: 35 weeks - 11 chars: 44 years - 12 chars: 2,800 years - 16 chars: 11 times the age of the sun 10 chars for bcrypt: 600,000 years... http://www.wolframalpha.com/input/?i=%2865**1…
- 8 chars: 84 minutes
- 6 chars: 1.2 seconds
All of which demonstrates the importance of requiring longer passwords. Also, keep in mind that these are maximum times required to crack a password and not the average times.
Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours
#56Every standard Windows password less than 8 chars only?
Some versions of Windows (XP and lower I believe?) would split long passwords into 2 hashes, effectively allowing them to be cracked in parallel.
Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours
#57So , why don't modern versions of Windows just use Bcrypt or similar for passwords?
Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours
#58Impressive as the numbers are, it's worth remembering that this is an "offline crack", going against a stolen list of encrypted passwords. If they can steal your database of encrypted passwords, you've got a problem no matter how strong the passwords are. How many guesses per second do you get in a typical online crack? E.g., a script kiddie trying to guess your cloud server's SSH password?
On my webserver, you get 3 chances and then a 24 hour ip ban. I think that comes out to 0.00003 passwords per second :) The particularly persistent IPs get a special iptables rule.
That's why an attacker will try three common passwords against every possible login name.
Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours
#59Guess what? Back in 2009, I started using a method to remember long passwords with a huge # of letters, numbers, & special characters. Gw?Bi2009Isuamtrlpwah#ol,n,&sc. (31 characters) Create memorable sentences and create a password using the first letter of each word & all the numbers and punctuation. After entering it 10 or so times you'll get used to it pretty quickly.
or you can literally write the whole sentence, which is even more secure and you don't have to remember any special rules, just the sentence itself. Of course it's more typing: Guess what? Back in 2009 I saw a uniquely attired man traipsing round local places with a high number of legs, necks and shirt collars. 136 characters or 14 Gigayears to crack. Wow today I learnt that there's such a thing as a Gigayear.
I just went through the process of changing passwords to sentences. You'd be surprised at how many sites do not allow sentences.
Re: 25-GPU cluster cracks every standard Windows password in less than 6 hours
#60Less good against non-NTLM passwords ... from my comment last time: Taking SHA-1 (which YOU MUST NOT USE for password hashing blah), it only manages 63 billion a second. To try all the passwords for that in the alphanumeric space: - 10 chars: 35 weeks - 11 chars: 44 years - 12 chars: 2,800 years - 16 chars: 11 times the age of the sun 10 chars for bcrypt: 600,000 years... http://www.wolframalpha.com/input/?i=%2865**1…
- 8 chars: 84 minutes - 6 chars: 1.2 seconds All of which demonstrates the importance of requiring longer passwords. Also, keep in mind that these are maximum times required to crack a password and not the average times.
The average time to crack will just be half of the maximum, so it's not a big difference (compared to order of magnitude errors, anyway). Still good to point out, though.