User-Selected Passwords Still Getting Cracked

The case against passwords has never been stronger.

While easily guessed passwords have made media headlines, today's password-cracking systems can make short work of passwords, even those created using seemingly complex mnemonic devices. Current cracking techniques, fueled by cheap parallel computation using off-the-shelf graphic processors, can guess trillions of combinations every hour.

The hashed password list stolen from global intelligence service Stratfor's website, for example, contained more than 630,000 passwords randomly generated by the site and consisting of eight alphanumeric characters. Cracking efforts took less than 24 hours to completely recover that portion of the 815,000 hashes in the stolen file, in part because the company had not added a random seed to the hashing algorithm known as "salt," says Steve Thomas, president of PwnedList, a subsidiary of InfoArmor that tracks compromised accounts.

"It has never been easier," Thomas says. "Being able to do 23 billion password possibilities every second ... when you get a dump of hashes, you can very quickly get most, or maybe even all, cracked in a number of hours."

During the past half-decade, three factors have fueled a renaissance in password cracking. While password-recovery programs have gained immense computational power by offloading the intensive calculations of dictionary-based and brute-force guessing to off-the-shelf graphics processors, users continue to use the same mnemonics to create passwords that seem secure while being easily memorized. Yet the insecurity of websites -- from LinkedIn to Stratfor and from RockYou to Sony -- has given researchers real-world lists of millions of hashes from which to uncover the systems that people use to create their passwords.

The result is that, at the same time that the power of cracking programs has skyrocketed, researchers are smarter at guessing the ways that users might create passwords, whittling down the lists of possible passwords. By creating better word lists and more intelligent methods of mangling real words and phrases, hackers and researchers can make an untenable computational problem much more feasible, said Olga Koksharova, spokeswoman for password-recovery firm ElcomSoft, in an e-mail interview.

"Smart guessing is relevant when passwords are not totally random but when there was used some technique to create a password," she says. "In case of totally random passwords, only brute-force attack can help and that is when speed" becomes most important.

[A Black Hat talk discusses shortcomings of the latest technical evolution of hashing passwords for safe storage in databases and proposes a competition to design something better. See Moving Away From Rash Hashing Decisions.]

Yet password crackers have garnered a speed boost as well. Using a single computer with a single graphics card, the oclHashcat-plus program, for example, can check anywhere from hundreds of thousands to tens of billions of combinations each second, depending on the hashing algorithm used to encrypt the entries in the password file.

"The technology is used is graphics cards because they are really good at doing parallel calculations," Robert Graham, CEO of security consultancy Errata Security, said in an e-mail interview. "The current top-of-the-line video card, the Radeon 7970, can do over a billion guesses per second for several popular hashing algorithms."

Yet whether the advances in cracking pose a danger to users is another question. While some attacks rely on guessing a small number of passwords, such as attacks on WordPress and Joomla earlier this year, hackers generally do not spend the time doing offline cracking of passwords, Elcomsoft's Koksharova says. Instead, they use social engineering techniques to gain access to victims' accounts.

Still, users can take a few easy steps to get the most security out of passwords and foil any catastrophic hack. Users should not just use word combinations or phrases with some letters replaced with numbers or symbols; researchers and hackers attempt to attack those types of passwords first.

Choosing an extremely secure password is less important than most people think, Errata Security's Graham says. The most important sites, such as banks and e-mail providers, have rarely had their password files stolen, so it's typically more important for users to ensure they do not the same password on different sites.

"For each site you really care about protecting, make sure it's unique and not shared with any other website," he says. "Otherwise, when those lesser websites get hacked and those passwords get stolen, hackers will be able to break into your important accounts."

Using a password manager may be the best approach because it produces randomized passwords while minimizing reuse. In the end, most passwords just need to defend against a few guesses per second, not a billion, according to Graham.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.