- So, why is it so easy to crack passwords these days?
Well first, there are many password breaches
that you hear of where the passwords aren't
encrypted at all, so that is, of course,
is the easiest way, but if you actually
have to crack the passwords, it's getting
easier and easier to crack passwords for several reasons.
First, we used to only rely on CPUs,
and although, CPUs are getting faster and faster,
so it's easier to crack passwords,
now we also have GPUs that are used
to crack passwords as well.
GPUs are oftentimes much faster
than relying on the CPU alone.
You can also distribute the computations
across multiple CPUs and GPUs in order to
crack the same password set which often
really increases the speed of the password cracking ability.
There's also weak algorithms
that make it very easy to crack passwords.
We'll show how cracking when those
LanMan and NT passwords are slightly different,
you can see really quickly how the LanMan passwords
are much easier to crack than the NT for several reasons.
First, the LanMan automatically takes your password
and makes it all upper case and then it splits it
into two seven-character passwords and so
you can crack all upper case passwords,
and two sub seven-character sets,
which makes it very, very easy to crack those passwords.
There's some algorithms that are just weak
and also, there are some operating systems
such as Linux, which have salted passwords,
which makes it more difficult to actually
crack the passwords, whereas when
those does not have salting in their algorithms,
so it's much quicker to crack passwords.
So on a Windows side, if two individuals have
the same exact password, the hash is going
to look exactly the same in the database,
whereas on Linux, if two individuals
have the same password, generally because of
salting, they will show up as
two different password hashes.
So, weak algorithms is a big issue.
There is also dictionaries that
have been built over time based off
of rainbow tables or password breaches.
Let's start with password breaches first,
since there have been so many breaches
where peoples' passwords have been made available online.
These breaches have been public,
so you can access some of the passwords
that were posted online and you can use those
and your password cracking ability,
so it's really easy to crack passwords
if you have passwords from previous breaches.
People generally tend to use
the same passwords over and over again.
Second, with rainbow tables, while rainbow tables
don't have all the combinations of a password,
they use a reduction function to actually
get a large number of passwords,
upwards of 99% of the passwords per certain sets
within smaller files, so you might have
a file that's a few gigabytes large
and it contains 99% of passwords up to eight characters,
so rainbow tables does make the password cracking
ability much, much easier.
So, GPUs, like I mentioned, definitely
increases the speed of your password cracking.
We're going to look at some password cracking
using John the Ripper, using CPUs, and then
we're going to look at password cracking
using our GPU with OCL Hashcat.