3 ms·
With 8 characters, which is way below all recommendations and using only alphanumeric + the simple special chars on the keyboard you're looking at over 7 * 10^1
by t0mas88 4y ago
With 8 characters, which is way below all recommendations and using only alphanumeric + the simple special chars on the keyboard you're looking at over 7 * 10^14 possibilities.
If you could do 100 million hashes per second (that seems to be possible with hardware looking at crypto stuff), the way I understand the setup you're still up against the 100100 iterations in the key derivation algorithm. So that's 7 * 10^19 hash calculations.
Even with the hardware to do 100 million hashes per second you're looking at nearly 23,000 years.
Let's hope you get a hit at 50% of the space (the expected average case). That's 11500 machine years with beefy GPU accelerated machine. So to bring this to a usable 5 years (and that's already pushing the expiration date of any creditcard you may find in the stolen vault) you'd need 2300 gpu accelerated machines running 24x7.
In AWS terms, with reserved discounts and everything you're going to spend roughly 60 million dollars cracking one vault.
- phillipseamore 4y agoMost accounts created before sometime in 2018 likely have just 5000 iterations and not 100100. Since the iteration count is kept in the clear an attacker would likely begin with them (with the added benefit of an older account might have more data in it). So the likely steps an attacker in possession of the vaults would take: 1) Find all vaults with the lowest iterations 2) Order by some criteria (known money sources: URLs for banks and crypto, known URLs that would have PII information: utilities, telcos, governmental URLs) 3) Start cracking... Or they could skip all that for some quick money. There's no need to crack anything if the URLs can get you money. How much would a dictatorship pay for the identities of everyone with an account at a URL that posts negative information on the regime? A domain.com/wp-admin account could certainly get you killed.
- erros 4y agoJust out of curiosity I booted up a box with 10x RTX A6000 @ 451.6 TFLOPS Speed.#1.........: 38789 H/s (11.17ms) @ Accel:128 Loops:64 Thr:64 Vec:1 Speed.#2.........: 39017 H/s (11.17ms) @ Accel:128 Loops:64 Thr:64 Vec:1 Speed.#3.........: 38894 H/s (11.16ms) @ Accel:128 Loops:64 Thr:64 Vec:1 Speed.#4.........: 39254 H/s (11.02ms) @ Accel:128 Loops:64 Thr:64 Vec:1 Speed.#5.........: 38626 H/s (11.17ms) @ Accel:128 Loops:64 Thr:64 Vec:1 Speed.#6.........: 39448 H/s (10.94ms) @ Accel:128 Loops:64 Thr:64 Vec:1 Speed.#7.........: 39256 H/s (11.06ms) @ Accel:128 Loops:64 Thr:64 Vec:1 Speed.#8.........: 38966 H/s (11.14ms) @ Accel:128 Loops:64 Thr:64 Vec:1 Speed.#9.........: 38870 H/s (11.17ms) @ Accel:128 Loops:64 Thr:64 Vec:1 Speed.#10.........: 39259 H/s (11.01ms) @ Accel:128 Loops:64 Thr:64 Vec:1 Speed.#\*.........: 390.0 kH/s Used the same example as the author with 100500 iterations. I think with some good wordlists, I'd wager a ton of low hanging fruits will be wiped within a reasonable time. If we're talking a threat actor with $$, they'd do some serious damage on this dump. *edit: just wanted to clarify that I think bruteforcing this dump wouldn't be as useful. It would still take a crapload of resources to be effective or useful in that scenario.
- t0mas88 4y agoSo you're doing 4e10 hashes per second or 390k password guesses per second. At what price per hour?
- erros 4y agoUsed vast.ai for this setup: $5.875/hr. Using their API you can likely find better deals and launch a series of different setups and optimize your spending. Hope that helps.
- yardstick 4y agoTo be fair I don’t think nation state actors care about the bill. Be it US, China, Russia, Saudi, etc.
- dylan604 4y agoDo you get extra credit if one of the first accounts you hack has a cloud provider account credentials that you can then spin up more machines to further the attack on someone else's dime?
- latchkey 4y agoI have access to 34,000+ GPUs, right now. All that I need to do is pay for power, which is at lowest rates. Who wants to crack some hashes?
- eli 4y agoWhere are you where power is at its lowest rates?