- So why is it so easy to crack passwords these days?
Well, first, there's many password breaches that you hear of
where the passwords aren't encrypted at all
so that of course is the easiest way.
But if you actually have to crack the passwords
it's getting easier and easier to crack passwords
for several reasons.
First: We used to only rely on CPUs
and although CPUs are getting faster and faster
so it's easier to crack passwords, now we
also have GPUs that are used to crack passwords as well.
GPUs are oftentimes much faster than relying
on the CPU alone.
It can also distribute the computations
across multiple CPUs and GPUs in order
to crack the same password set
which often really increases the speed of
the password-cracking ability.
There's also weak algorithms that make it
very easy to crack passwords.
We'll show how cracking Windows Lanman and NT passwords
are slightly different, and we can see how really quickly
how the Lanman passwords are much easier to crack
than the NT.
For several reasons, first, the Lanman automatically
takes your password and makes it all uppercase
and then it splits it into two 7-character passwords
and so you can crack all uppercase passwords
into two sub 7-character sets
which makes it very, very easy to crack those passwords,
so there's some algorithms that are just weak
and also there are some operating systems such as Linux
which have salted passwords, which makes it more
difficult to actually crack the passwords
whereas Windows does not have salting in their algorithms
so it is much quicker to crack passwords.
So, on the Windows side, if two individuals have the
same, exact password
the hash is going to look exactly the same in the database.
Whereas, on Linux, if two individuals have the same password
generally because of salting, they will show up
as two different password hashes.
So, weak algorithms is a big issue.
There's also various dictionaries that
have been built over time based off of
rainbow tables or password breaches.
Let's start with password breaches first
since there been so many breaches where peoples'
passwords have been made available online.
These breaches have been public so you can access
some of the passwords that were posted online
and you can use those and your password cracking ability
so it's very really to crack passwords if you have
passwords from previous breaches.
People generally tend to use the same passwords
over and over again.
Second: With rainbow tables, all rainbow tables
don't have all the combination of a password.
They use a reduction function to
actually get a large number of passwords
upwards of 99% of passwords per certain sets
that's within smaller files, so you might have a file
that's a few gigabytes large and it contains
99% of passwords up to 8 characters.
So, rainbow tables does make the password cracking
ability much, much easier.
So, GPUs, like I mentioned, definitely increases the speed
of password cracking.
We're gonna look at some password cracking using
John the Ripper, using CPUs,
and then we're going to look at password cracking
using our GPU with oclhashcat.