25-GPU cluster can brute force Windows password in record time

By Shawn Knight
Dec 10, 2012
Post New Reply
  1. Jeremi Gosney, the founder and CEO of Stricture Consulting Group, recently showcased a GPU-based computer cluster capable of brute forcing its way through any standard eight-character Windows password (including upper- and lower-case letter, digits and symbols) in less than six...

    Read more
  2. jasphoto

    jasphoto Newcomer, in training

    It would be nice if the article said what difference would 9 characters over 8 make using this method - or 10 for that matter.
    m4a4 likes this.
  3. Vicenarian

    Vicenarian TechSpot Enthusiast Posts: 100   +9

    But can it run Crysis?




    (I know, I know...)
    H3llion, Burty117 and igotdembombs like this.
  4. tomkaten

    tomkaten TechSpot Enthusiast Posts: 71   +26

    "While remarkable for its simplicity and speed in software, RC4 has weaknesses that argue against its use in new systems.[2] It is especially vulnerable when the beginning of the output keystream is not discarded, or when nonrandom or related keys are used; some ways of using RC4 can lead to very insecure cryptosystems such as WEP."

    NTLM is RC4-based and, as such, is quite obsolete. See a backtrack distro cracking your WEP pass in an hour or two, easier ones, of course, but still, I'd say this algorithm's credibility is pretty much shot.

    Let me see it crack an AES 256 hash based pass of 16 characters or more and then you can color me impressed :)

    Still, it's scary for the masses, since we all know the complexity of the average man's password.
    captainawesome likes this.
  5. marinkvasina

    marinkvasina TechSpot Enthusiast Posts: 259   +9

    Give it time and it will crack that too.
  6. What is the last password it will try in those six hours? I will make that one mine, ZzZZZzzz?
  7. lipe123

    lipe123 TechSpot Guru Posts: 410   +75

    All the more reason passwords needs to go away and everything needs to use one centralized authentication system thats linked to some biometrics or a physical off line key carried by the user.
  8. It still converts into a digital "something" that can be cracked...
  9. cliffordcooley

    cliffordcooley TechSpot Paladin Posts: 5,771   +1,428

    Where are the safeties against such attacks?

    There are logins that make you wait a certain length of time before you can try again, if you fail to enter the correct password in three tries. If the system (once it has been locked down from incorrect entry) required the correct password to be entered three times in a row no quicker than 5 seconds apart, would tremendously increase the time it takes to break passwords.
  10. Fokissed

    Fokissed Newcomer, in training

    Given that there are 94 usable characters for passwords, so each character will increase the total number of passwords 94 times. So a 9 character password will take 94 times as long to crack as an 8 character password. A 10 character password will take 8836 times as long to crack.
    Darth Shiv likes this.
  11. "All the more reason passwords needs to go away and everything needs to use one centralized authentication system thats linked to some biometrics or a physical off line key carried by the user."

    Nah, I'd rather not risk having my digital biometrics cracked and put on the net. Would much rather that be a password if it should happen
     
  12. Fokissed

    Fokissed Newcomer, in training

    AES 256 isn't any better against a brute-force attack than RC4. RC4's weakness is that it can be broken in other ways, not brute-force. Password length is the only way to increase the time it takes to brute-force a password (and the time it takes to hash each password).
  13. Fokissed

    Fokissed Newcomer, in training

    The point of this brute-force is to produce a password with a matching hash as the original password. The hash is easily obtained, it's the password that produces that exact hash which is hard to find.
  14. cliffordcooley

    cliffordcooley TechSpot Paladin Posts: 5,771   +1,428

    So what are you saing? A password can be found once a hash is known, without attacking the system? Seems kind of stup-id to allow a way of breaking a system without confronting the system.

    If this is true, then the failure of using a password is not the password itself but easy access to the hash.
  15. How long this device can crack the password if I add biometric fingerprint lock along the password? :D
  16. fimbles

    fimbles TechSpot Evangelist Posts: 1,232   +119

    Blizzard authenticator to the rescue! :)
  17. RzmmDX

    RzmmDX TechSpot Enthusiast Posts: 178   +25

    I don't know, xkcd has convinced me that random words are much better than random characters for humans to remember and took longer for computers to brute force. Unless the math was wrong.
  18. You can do the math yourself. Since they are brute-forcing the password, adding a single character (chosen from a pool of N different characters) can only increase the cracking time by factor N at worst, N / 2 on average. N is most likely less than 100 (lowercase letters, uppercase letters, numbers and about 20-30 special characters available on keyboard).
  19. Row1

    Row1 TechSpot Maniac Posts: 354   +8

    If the password is not eight characters, solution time goes way up.

    Plus - these people have a way-faster internet connection than I have. If I enter a wrong password by mistake, it takes me a few seconds to enter the next one. The processor power cannot be local. Are the IT guys gonna wheel this frankenprocessor in on a cart anytime someone forgets their password, and plug it in?
  20. misor

    misor TechSpot Addict Posts: 968   +147

    So my password "n0p455w0rd" is no longer safe? :)

    I have no idea why gpu is used to crack passwords rather than the cpu.

    and I have no idea why microsoft is now limiting password characters to a maximum of 16.
  21. cliffordcooley

    cliffordcooley TechSpot Paladin Posts: 5,771   +1,428

    If I am understanding the hash concept, what is stopping anyone from creating a huge cross-reference from password to hash?

    If a hash is so easy to find, what is stopping anyone from reading the hash and then cross-referencing a DBase of hashes to instantly unlock anyones computer?
  22. St1ckM4n

    St1ckM4n TechSpot Evangelist Posts: 3,385   +607

    GPUs have a lot higher bandwidth than CPUs. GPUs are now used in supercomputers, and NVIDIA's CUDA solution has been used for a long time in things like Photoshop/Premiere.



    I'm not going to claim to be an expert, but this is my understanding: it is possible to obtain the hash for a lot of password systems. Not all, but a lot.

    This hash is different for each system. password1 can be hashed to xyz on techspot, but it will be qwerty on gmail. The hashes I believe are made my applying a 'master hash key' to the ASCII password, which as before, is different for each system.
    cliffordcooley and misor like this.
  23. Cristian2k

    Cristian2k Newcomer, in training

    There is usually a password policy that defines how many invalid passwords can you enter before the account got locked, also you can define for how long you can lock it when that limit is reached, and to sum up you can set how often you require the password to be changed. That is why brute force has become obsolete, even more obsolete than NTLM.
  24. platinumsteel

    platinumsteel Newcomer, in training Posts: 27

    Those guys need to run that beast on a WPA password dictionary.. using Elcomsoft Wireless Auditor..that would be insane speeds..lol.haha..Not the easy windows passwords.A cave man could guess that ****.
  25. Arris

    Arris TechSpot Evangelist Posts: 4,534   +92

    Guess that's why "You have been locked out, contact systems admin" after a certain amount of attempts setups are popular.
    Or even the "After the next wrong password you will be locked out for 15 minutes." setups.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.