topleft
topright
Cracking 14 Character Complex Passwords in 5 Seconds Print E-mail
Share This -
Digg
Delicious
Slashdot
Furl it!
Reddit
Spurl
Technorati
YahooMyWeb


Dan Dieterle


There has been a lot of talk recently in the security community about high speed GPU (video card) processors being able to crack passwords very quickly.

 

But there is a technology that can crack them even faster. A Swiss security company called Objectif Sécurité has created a cracking technology that uses rainbow tables on SSD drives.

 

/uploads/remoteimg/facf7aaea6b4a02aeb3e92d51c9f3fd0.jpg

 

Apparently it is the hard drive access time and not the processor speed that slows down cracking speed. So using SSD drives can make cracking faster, but just how fast?

 

One article in March of this year stated that the technique using SSD drives could crack passwords at a rate of 300 billion passwords a second, and could decode complex password in under 5.3 seconds.

 

So, how long would a long complex password hold up to the SSD based cracking technology?  

Sounds like we need to put this to the test. Most hackers will crack passwords by decoding the password hash dumps from a compromised computer.

 

So, I pulled several 14 character complex passwords hashes from a compromised Windows XP SP3 test machine, to see how they would stand up to Objectif’s free online XP hash cracker.

The results were stunning.

 

Let’s start out with an easy one. Here is the Administrator password hash from the machine:

aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0

And putting this into Objectif’s tool we get this response:

Password: Empty password…    
Time: 2 seconds

Administrator didn’t set a password, that’s not good…

Okay, that wasn’t 14 characters, let’s try a hard one.

 

How about this one:

Hash: 17817c9fbf9d272af44dfa1cb95cae33:6bcec2ba2597f089189735afeaa300d4

And the response:

Password: 72@Fee4S@mura!    
Time: 5 Seconds

Wow! that took only 5 seconds and that is a decent password.

 

Let’s try a few more:

Hash: ac93c8016d14e75a2e9b76bb9e8c2bb6:8516cd0838d1a4dfd1ac3e8eb9811350
Password: (689!!!<>”QTHp    
Time: 8 Seconds

 

Hash: d4b3b6605abec1a16a794128df6bc4da:14981697efb5db5267236c5fdbd74af6
Password: *mZ?9%^jS743:!    
Time: 5 Seconds (Try typing that in every day!)

And Finally:

Hash: 747747dc6e245f78d18aebeb7cabe1d6:43c6cc2170b7a4ef851a622ff15c6055
Password: T&p/E$v-O6,1@}    
Time: Okay, this one really pushed it to the limits, it took a whole 11 seconds to crack!

 

Very impressive, it took only five to eleven seconds in this test to crack 14 character complex passwords. I was able to create a password that Objectif’s site couldn’t decode; it was using characters from the extended ASII set.

But, unfortunately, I could not log into the XP system using it either.  

 

Want to see how a password would do without having to exploit a system and dump the password hashes?

Objectif allows you to put a password in and it will convert it for you. Then you can place the hash into the cracker and see how it does.

 

I believe that this demonstration shows that relying on passwords alone may no longer be a good security measure.

Many companies and government facilities are moving away from using just passwords to dual authentication methods. Biometrics and smartcards are really becoming popular in secure facilities. 

 

And if the rumors are true, it looks like Microsoft may include facial recognition authentication in the next version of Windows. Time to dust off the old Web Cam…

 

Cross-posted from CyberArms

 

This article was published by Infosec Island.

 




Comments (4)
RSS comments
1. 10-22-2010 10:55
 
Well done; there's nothing like a little hands on testing to put a potentially abstract issue like this into practical perspective. I agree that 2 factor authentication is becoming increasingly critical, but SMBs in particular are going to have a hard time with that.
Registered
 
This e-mail address is being protected from spam bots, you need JavaScript enabled to view it
2. 11-03-2010 12:43
 
Thank you Fred. You may also be interested in my follow up article on passwords greater than 15 character. 
 
It's called "Can't crack it, just pass it". 
 
cyberarms.wordpress.com/2010/10/31/ntlm-passwords-cant-crack-it-just-pass-it/
Registered
 
This e-mail address is being protected from spam bots, you need JavaScript enabled to view it
3. 11-04-2010 13:28
 
It's interesting that Objectif's free password-busting Ophcrack and related decrypting software have been available for years. Yet this is the first I've heard of it. It kind of elevates restricting physical access as a security tool to a new level, doesn't it?
Registered
 
Mark Henricks
4. 11-05-2010 10:31
 
Dan, thanks for the pointer to the follow up article; that Pass the Hash attack is pretty troubling.
Registered
 
This e-mail address is being protected from spam bots, you need JavaScript enabled to view it

Only registered users can write comments.
Please login or register.

 
Share This -
Digg
Delicious
Slashdot
Furl it!
Reddit
Spurl
Technorati
YahooMyWeb
< Previous   Next >




White Paper Library

Copyright © 2007-2014 CIOZones. All Rights Reserved. CIOZone is a property of MMINC Digital Inc.