6 ms·

Cloud password-cracking tool requires only 20 minutes to crack passwords.

35 points by JayNeely 16y ago

todayiamme 16y ago
A really awesome and simple solution would be to ask users to use non obvious sentences as their password. Even better would be to ask them to use a non grammatical sentence with deliberate phonetic spelling variations. Although that would be ineffective against a sophisticated brute force attack to crack the encryption itself over a period of days, but it would be an awesome stopgap.
- JayNeely 16y ago
  2011: Recent review of anonymized data finds 34% of users on major internet services using "This is my password." as their password sentence.
  - todayiamme 16y ago
    You know you could match it against a corpus and reject the password as being too weak. Right now it's just a graphic, but if you become proactive about it by education through a meme or something and reject passwords. Then maybe people will learn. An astonishing number of those users love chain emails. It's certainly not an exclusive set, so why don't we use that? Make it "cool", or something.
- sorbus 16y ago
  Standard password security, basically. At that point, there's a lot more danger from social engineering or people writing down the (long, non-obvious) passwords.
- Groxx 16y ago
  Pass-phrases + minor misspellings are typically non-crackable with billions^x years, barring dictionary attacks (stupidity will always exist). There's no "sophisticated brute force" that would speed it up measurably. Granted, password-hashing reduces the keyspace, often to something possibly-computable to find a collision. But you're still talking up to 36^40 (for SHA1) attempts (that's 1e62, btw).
  - todayiamme 16y ago
    I am not saying that you go through every permutation. What I meant was something like Turing's tricks. The naval Engima was consistently cracked in a short time by the bombe because they learnt that at a particular time of day all ships sent weather reports. Further they were always signed 'Hail Fuhrer/Hitler!". I am pretty sure that modern equivalents must exist in the implementation of cryptography today. The irony is that I am not qualified to comment and the people who are qualified to do so are bound by secrecy not to do so.
    - Groxx 16y ago
      There you're talking a statistical analysis of a code, specifically one based on a "code book", which are vulnerable to attacks like this. Hashes are designed to prevent this by being (ideally) evenly distributed based on input, and salts destroy analysis across multiple clients. To perform that sort of attack, your hash function would have to be "cracked" in some way, like MD5 is (you can create collisions easily - values which resolve to the same hash), and thus almost totally worthless.
      - todayiamme 16y ago
        Thanks for correcting me. By the way, can you recommend any way for me to pick up the fundamentals of modern cryptography?
        Groxx 16y ago
        I wish I could, actually. I've just been picking it up by reading random articles for a couple years now, writing some Rails code, and looking things up (details / best-practices) as I go. Not a route I'd suggest in general, but it works if you're focusing on other things. What got me started & revealed a lot of other cryptography techniques was to look into how Diffie-Hellman[1] and RSA[2] work (they're not too complicated, really), understand what hashing functions do, if not necessarily how, and then look around at news of exploits / attacks. A lot to understanding secure code / techniques is understanding how the attacks work, and a lot of the news around them contain surprisingly-good explanations. Anyone else have suggestions? I could probably use them too. [1]: http://en.wikipedia.org/wiki/Diffie–Hellman_key_exchange http://en.wikipedia.org/wiki/Diffie–Hellman_key_exchange [2]: http://en.wikipedia.org/wiki/Rsa http://en.wikipedia.org/wiki/Rsa
fragmede 16y ago
Title should also include the price - $35 for the most exhaustive search. This kind of speed has been around for a while - at the cost of a $50,000 FPGA box (eg, http://www.picocomputing.com/ http://www.picocomputing.com/). Too expensive for the home user, but I'm guessing the NSA have spent way more, and have much faster computers. A brute force on WPA is also very parallelizable which makes it easy to throw more machines at the problem.
Groxx 16y ago
>Because it is a dictionary attack using a predefined 135-million-word list, there is no guarantee that you will crack the WPA key, but such an extensive dictionary attack should be sufficient for any but the most specialized penetration testing purposes. Wont work against most high-profile targets, then. I find the use of this is probably limited to either a) attacking idiots, or b) attacking idiotic companies who have nobody who understands basic security.
- rufo 16y ago
  >attacking idiotic companies who have nobody who understands basic security Often, it only takes one idiot.
deleted 16y ago
[deleted]

35 points by JayNeely 16y ago

A really awesome and simple solution would be to ask users to use non obvious sentences as their password. Even better would be to ask them to use a non grammatical sentence with deliberate phonetic spelling variations. Although that would be ineffective against a sophisticated brute force attack to crack the encryption itself over a period of days, but it would be an awesome stopgap.

JayNeely 16y ago
2011: Recent review of anonymized data finds 34% of users on major internet services using "This is my password." as their password sentence.
- todayiamme 16y ago
  You know you could match it against a corpus and reject the password as being too weak. Right now it's just a graphic, but if you become proactive about it by education through a meme or something and reject passwords. Then maybe people will learn. An astonishing number of those users love chain emails. It's certainly not an exclusive set, so why don't we use that? Make it "cool", or something.
sorbus 16y ago
Standard password security, basically. At that point, there's a lot more danger from social engineering or people writing down the (long, non-obvious) passwords.
Groxx 16y ago
Pass-phrases + minor misspellings are typically non-crackable with billions^x years, barring dictionary attacks (stupidity will always exist). There's no "sophisticated brute force" that would speed it up measurably. Granted, password-hashing reduces the keyspace, often to something possibly-computable to find a collision. But you're still talking up to 36^40 (for SHA1) attempts (that's 1e62, btw).
- todayiamme 16y ago
  I am not saying that you go through every permutation. What I meant was something like Turing's tricks. The naval Engima was consistently cracked in a short time by the bombe because they learnt that at a particular time of day all ships sent weather reports. Further they were always signed 'Hail Fuhrer/Hitler!". I am pretty sure that modern equivalents must exist in the implementation of cryptography today. The irony is that I am not qualified to comment and the people who are qualified to do so are bound by secrecy not to do so.
  - Groxx 16y ago
    There you're talking a statistical analysis of a code, specifically one based on a "code book", which are vulnerable to attacks like this. Hashes are designed to prevent this by being (ideally) evenly distributed based on input, and salts destroy analysis across multiple clients. To perform that sort of attack, your hash function would have to be "cracked" in some way, like MD5 is (you can create collisions easily - values which resolve to the same hash), and thus almost totally worthless.
    - todayiamme 16y ago
      Thanks for correcting me. By the way, can you recommend any way for me to pick up the fundamentals of modern cryptography?
      - Groxx 16y ago
        I wish I could, actually. I've just been picking it up by reading random articles for a couple years now, writing some Rails code, and looking things up (details / best-practices) as I go. Not a route I'd suggest in general, but it works if you're focusing on other things. What got me started & revealed a lot of other cryptography techniques was to look into how Diffie-Hellman[1] and RSA[2] work (they're not too complicated, really), understand what hashing functions do, if not necessarily how, and then look around at news of exploits / attacks. A lot to understanding secure code / techniques is understanding how the attacks work, and a lot of the news around them contain surprisingly-good explanations. Anyone else have suggestions? I could probably use them too. [1]: http://en.wikipedia.org/wiki/Diffie–Hellman_key_exchange http://en.wikipedia.org/wiki/Diffie–Hellman_key_exchange [2]: http://en.wikipedia.org/wiki/Rsa http://en.wikipedia.org/wiki/Rsa

fragmede 16y ago

Title should also include the price - $35 for the most exhaustive search. This kind of speed has been around for a while - at the cost of a $50,000 FPGA box (eg, http://www.picocomputing.com/ http://www.picocomputing.com/). Too expensive for the home user, but I'm guessing the NSA have spent way more, and have much faster computers. A brute force on WPA is also very parallelizable which makes it easy to throw more machines at the problem.

Groxx 16y ago

>Because it is a dictionary attack using a predefined 135-million-word list, there is no guarantee that you will crack the WPA key, but such an extensive dictionary attack should be sufficient for any but the most specialized penetration testing purposes. Wont work against most high-profile targets, then. I find the use of this is probably limited to either a) attacking idiots, or b) attacking idiotic companies who have nobody who understands basic security.

rufo 16y ago
>attacking idiotic companies who have nobody who understands basic security Often, it only takes one idiot.

deleted 16y ago

[deleted]