Think that your eight-character password consisting of lowercase characters, uppercase characters and a sprinkling of numbers is strong enough to protect you from a brute force attack?
Jon Honeyball writing for PC Pro has a sobering piece on how the modern GPU can be leveraged as a powerful tool against passwords once considered safe from bruteforce attack.
[…]The results are startling. Working against NTLM login passwords, a password of “fjR8n” can be broken on the CPU in 24 seconds, at a rate of 9.8 million password guesses per second. On the GPU, it takes less than a second at a rate of 3.3 billion passwords per second.
Increase the password to 6 characters (pYDbL6), and the CPU takes 1 hour 30 minutes versus only four seconds on the GPU. Go further to 7 characters (fh0GH5h), and the CPU would grind along for 4 days, versus a frankly worrying 17 minutes 30 seconds for the GPU.
It gets worse. Throw in a nine-character, mixed-case random password, and while a CPU would take a mind-numbing 43 years to crack this, the GPU would be done in 48 days.
Well you could always switch out those nine-character, mixed case random passwords every 30-40 days… or you could just use my new (TM) Three Factor Authentication:
1) Password
2) Rectal Scan
3) Urine Test
(Patent Pending)
Or you could use my approach–every password is the subject matter plus “bobbo”…..and then nothing is “a secret” to begin with.
The time wasted in protecting meaningless information is staggering. Yea, how many days have been spent by Comcast to make sure no one deletes HBO from your Triple Play Package?
Meanwhile, Wells Fargo will transfer money out of my account to any of their larger preferred corporate customers just on their say so.
Everywhere I look, its all BS.
This applies to offline password attacks only, eg:
Someone obtains a copy of your truecrypt volume (or encrypted file containing all your passwords) and can then try as many passwords as their computer can, at their leisure.
This does not apply to online passwords. The server (website) cannot respond in any reasonable timeframe, to confirm or deny the success of a password guess for this attack to have any chance.
Lesson to learn, do not host an encrypted file containing your passwords on your homepage. (At least, not without enrypting it with a looong password)
🙂
Well, actually…
Steve Gibson of GRC was addressing this issue is last week’s episode of Security Now! He wrote a password brute force calculator at http://tinyurl.com/44x8csm
He shows how you can use easy to remember, but hard to brute force, passwords.
By simply changing the above password from “G5q4zO%yt” to “G5q4zO%yt”, it is changing from being cracked in 1.7 hours to 1.74 centuries.
The key to protecting your password form a brute force attack is to maximize the “search space” of the password in two dimensions.
(1) Use at least 1 upper case alpha, 1 lower case alpha, 1 digit, and 1 special character. That forces the attacker to use a vastly wider character set.
(2) Use 10 or more characters. This is the length, when multiplied by the wider character set, makes your password damn hard to brute force.
The key to Gibson’s Haystack solution is not that the password is really random (and impossible to remember). It is that it is maximizing the search space.
Quit nice… check it out.
Yank–the two passwords look exactly the same. Did you change them? How so?
While I understand the “search space” concept, how does the cracking program know what space is used? Why not use all special characters?
Just a casual Tuesday.
Most online bank accounts will lock you out of your account after a few incorrect password attempts so you wouldn’t get far with a brute force attack.
I agree with Simon. How can you brute force a password that is set to disable after 3 tries?
That being said cracking NTLM passwords require that you have the hash. And the encryption scheme for NTLM is very weak.
The same would not hold true for an advanced algorithm like DES, AES, IDEA, blowfish, etc.
Just to follow up on what Yank said, the goal isn’t to maximize the randomness of your password, but to make it a member of a massive password space. So instead of “g^R(iP0” you could use the (seemingly) easy password “….G0ld…..” which to a human looks simple but takes massively more resources to crack for a computer algorithm.
I don’t know: but it looks like to me that “brute force crackers” are assumed to start with all lower case letters, then I suppose all upper case letters, then mix them? Then they move on to adding numbers? Then they move on to adding symbols?
Otherwise, the “search space” is the same for all brute force techniques. So now, my brute force safe password could be: DUbobbo#
or might a devilishly clever brute force cracker use the algorhythm I guess at above in reverse?===thereby reducing the search time by months?
Remember, the first thing to do when cracking a password is to Kill Baldrick.
Security is an interesting subject, made more interesting by the naivety of the technocrat.
You may, perhaps, understand how to make things appear complicated (for security reasons) but all this can be brought to nought by a failure to understand simpler matters.
A well known British bank in the past introduced an eighteen figure compulsion on passwords. Great! you might think. Unfortunately most cannot remember eighteen figures, so what did they do, write them down! I used to come across these (passwords) regularly dymo labelled to the tops of the office desk drawer, in the little Red, or Black book (never, it seemed in other colours). when working on networks in offices.
Then, there was the case of the network which wouldn’t start. I turned up and asked for the password. “Only Sharon knows that.” I was told. “So which one of you is Sharon?” I asked
“She’s on a walking holiday in Spain” I was told. “Surely there’s something you can do.” “Actually you may not realise this, but passwords are designed to keep you out!”
I believe Sharon returned from her (non-contactable holiday) to find she was now unemployed.
My advice? Remove the hard disc and lock it in the bloody safe! Also, have another one off the premises (well backed up of course).
Let burglars pinch the computers, they are replaceable. Data is not.
This is a link bait piece. Sure, theoretically you could do that locally, but the internet is the biggest slow down for a dictionary attack. Also, most sites use encryption that purposely takes longer to hash your password so that it takes even longer.
Its downright scary out there for any business office now
I have noticed websites being brought down with generated passwords and wondered
Its amazing how far we have come
WW2 was fought with basic tech and clipboards
Now we have amazing tools – computers , laser printers and the like
Yet where has it got us and where will it all end
Perhaps Rep Wiener has a good excuse at why his twitter account was hacked
Yet his lies led him to where he is
He should resign
The simplest security is the 8-12, easy to remember password / passphrase on a three try lockout. After the lockout, a secondary password is required; your grandmother’s maiden name or first girlfriend’s bra size.
Yes, brute force can solve any password. Only, however, if it has unrestricted access at the number of tries. Restrict the attempts and you have eliminated the power of the brute force. Problem solved.
Obviously, slowing down password tries with timeouts between tries will slow down a hack and might drive a human to distraction but not a machine. So exponentialy longer timeouts might begin to thwart machine hackers ….
Use LastPass to manage your passwords. Unique 14 character passwords are a snap.
By the way, it will take 15.6 million centuries to break a 14 character password* (assuming one hundred billion guesses per second).
*using lower, upper, digit, and symbols
the x tries and you’re locked out form of security is forgetting one thing – not all password cracks are attempted from the outside. These days there’s more and more danger from hackers gaining access to the accounts from within a company’s servers.
>This does not apply to online passwords.
Because most online passwords are stored in clear text in a file at http://company.com/passwd.txt -which is secure because it’s not html right?
Unless it’s a government agency in which case the clear text password file will also be put on a usb key and left in a cab
Further thoughts.
Don’t any of the superbrains realize that anything which is put together by one human can be taken apart and re-discovered by another?
If the enigma was cracked by understanding the thinking of the nasties who were operating it, surely it must occur that ALL passwords can be broken and all that talk of millions of years to crack it is absolute crap!
However. If, as I suggested, the information isn’t there at all (by removing the disk) then then is another order of difficulty. Also. Where is this necessity to be on the internet all the time come from? Do you REALLY need a phone in your ear all day? Are you continuously reading all the books on your shelf? I think most users are swayed by the views of those who make money from all-day internet connection. Honest! It ain’t really necessary. Help to make Jobs, Gates and the rest a little poorer, life isn’t about being plugged in, it’s about other good things – Booze, Drugs, Women, bad-for-you food, laying in bed and – yes – shagging.
Get a life.
So how does this work?
9.8 million guesses per second.
How do you get a system to say “no that’s not it” 9.8 million times per second?
Seriously, I don’t get it.
#21 – it’s easy to copy the password file on a machine you have access to.
Since it’s encrypted there’s no need to keep it secret! So you copy the file to your own machine and try every possible passwd in turn and compare to the encrypted value.
The breakthrough is that it is complicated to encrypt the new guess before comparing it – so it would take too long to try all of them. But with a GPU you can encrypt a billion guesses/second – at least with a weak algorithm like NTLM or MD5
@#21
Think of it as comparing two values. The “Brute Force” algorythm looks at what combinations of characters it takes to come up with the same encrypted value. As others have pointed out, you need access to the encrypted passwords.
These calculations are for a single search across the entire search space. In real lief you will use multiple GPU brute force attacks working on different parts of the search space. Dividing up the work across multiple GPUs greatly decreases the time to discover the match to an encryption key or to a cryptographic hash value.
#22, #23
thanks.
I saw “NTLM login passwords” in the article and #3’s observation that this method was applied to a local file (not a network login), so I was confused. Your explanations make total sense.
All you need is enough disk space. (That should make you look twice at all those cheap terabyte drives [and who’s buying them exactly?])
You can reduce cracking to capturing encrypted passwords as they stream by and doing single seeks on a hard drive.
Its called using a ‘sparse matrix’ space to reverse encode.
The reverse encoding is a computable process that can have taken days and days generating all of the keys off-line. The use of a GPU just speeds up the encryption key generation.
The cracking process then becomes a simple seek, point to the key that generated it, retrieve that key and you’re in. Encrypted text has become clear text.
No key-fob, no complex time based encryption algorithm, nothing can stand up to it.
It uses the encryption process against itself.
#26 Creating a table of all possible key values? Not very practical for modern password solutions. For example, with SHA-256, you have 2**256 possible 32-byte hash values, but there are only 10**12 bytes on a 1TB HDD. In this case, building a complete table for seeking is not a practical solution.
Longer passwords are vital but something as basic as QWERTYasdf!@#$%^&*()123456789?0 pretty much means they aren’t going to get the answer in your lifetime.
If the soft ware requires a two second growing to six or more second delay between guesses then the brute force attack can get seriously bogged down on that as well.
#27
Is isn’t nearly that many combinations. You are only looking at it from the perspective of the hash instead of the input. If you use a five character password with upper case, lower case and numbers, that’s only 550 million combinations (56^5). Far less than 2^256. Six characters expands the combinations to 30 billion but that is still far lower than 2^256.
One element not mentioned in all of this is the effect of salting. If the passwords use salts and pepper (an additional padding value relative to the system as opposed to salts which are different for each user), it makes cracking the passwords substantially tougher. I’ll bet the brute force crack times assume you have access to the salts and pepper if there is any.
The best technique is to use a lengthy passphrase such as the following:
the best technique is to use a lengthy passphrase such as the following
This problem only matters if the thief steals the whole hard drive, and then runs a prolonged attack program against it for a month.
In other words the FBI and the police have taken your hard drive in a raid. Raids are common now that officers can sniff and indicate just like their dogs.
In that case you better be using more than NTLM for encryption of data or you are asking to be raped by the govt.