5 ms·
Not only that: "Kaspersky analyst Dmitry Bestuzhev cracked the hash for the password Sept. 17 just hours after Symantec put out a public request for help" How
by miles 14y ago
Not only that: "Kaspersky analyst Dmitry Bestuzhev cracked the hash for the password Sept. 17 just hours after Symantec put out a public request for help"
How is it possible to crack 900gage!@# in a few hours?
- forgotusername 14y agoAV companies like to share samples with each other, so guessing they had at least a bit of a head start. Still, brute forcing a 10 character password that uses the full ASCII printable character set looks like it'd require.. 9,500 years on a single high end GPU. No idea what the current state of cracking is, but probably they used some rules based approach (like John the Ripper used to have) to massively reduce the search space.
- emmelaich 14y agoNote that !@# is just shift-1, shift-2, shift-3. So not unlikely that it would appear in a rules based approach. The password is numbers, english word, keyboard-sequence.
- scottmcf 14y agoThanks for that explanation. Being accustomer to a UK keyboard layout this didn't occur to me (as shift 1-3 is !"£ here).
- dredmorbius 14y agoAre you saying JtR no longer has a rules-based approach, or that it's no longer used? It's still actively maintained. http://www.openwall.com/john/ http://www.openwall.com/john/
- forgotusername 14y agoI'm saying I haven't tried to crack a password in about 12 years :)
- dredmorbius 14y agoFair enough.
- est 14y agoYou have no idea how brute force md5 was like. You just look up a 80TB db table full of hash strings. http://www.cmd5.org/password.aspx http://www.cmd5.org/password.aspx
- moxie 14y agoI run cloudcracker.com, which would have gotten this pretty quickly. If you look at public password compromises, the components of this password "900", "gage", and "!@#" each appear pretty frequently. So using a data-driven approach to build context free grammars based on real-world passwords you've found or already cracked will get passwords like this every time. Basically, everyone thinks they're clever when they choose a password, but for the most part people are all being "clever" in the same way. If you think up your password, chances are you've lost.
- miles 14y agoThanks for your reply, Moxie! How would cloudcracker fare against the four-word combos recently popularized by xkcd[1]? Even if it were known that the password was made up of four English words, what sort of time frame might it require to crack? 1 http://xkcd.com/936/ http://xkcd.com/936/
- defen 14y agoThe comic claims an entropy of 44 bits for a 4-word phrase. That means 11 bits per word, so a dictionary of 2048 words, which sounds reasonable for "common English words". A single ATI 5970 can compute 2300M SHA-1 hashes per second. So you're looking at about two and a half hours to run through the entire keyspace. Fewer on a farm (which Amazon will rent to you for a few bucks). That's assuming you know the dictionary, of course. Of course, if the password is hashed with bcrypt or scrypt it will take much longer, although I'm not sure how to do that calculation.