Password Cracking Evolution

In this article, my goal is to show the evolution in password cracking era how hackers/crackers cracked passwords around 10 years ago and how they are cracking them nowadays. Before coming into this topic, first I clarified the concept of a password and its importance in our digital life. A little bit history of password cracking, after that the difference between the Computer Processing Unit (CPU) and the Graphical Processing Unit (GPU). After learning the difference between their working and function, then we will see the practical difference by running some tools.

What Is a Password?

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

A password is a secret word (consisting of string characters) that is used to prove identity in order to gain access to a particular resource. The word "password" consists of two words, "pass" and "word"; it means a word that acts as a pass (secret word) for authentication.Passwords have been used since ancient times. In ancient times, soldiers used passwords as a secret word for entering into a highly restricted area of a kingdom. Now, in modern times, which is the digital age, usernames and passwords make a combination that is used by people during a login process for authentication in digital devices. Digital devices like computer systems, mobile devices, video game consoles, PDA devices, etc., are all protected by passwords. A computer user has passwords for many purposes: logging into a system, for accessing mail accounts, databases, network, websites, applications, etc.

Password Cracking and Its History

Now we already know that why we use password for security reasons and, where security stands, breaches will also occur. Password cracking is typically a process of recovering passwords from stored data in a computer device. The purpose of password cracking is to recover the forgotten passwords but, as a malicious intention, it is used for gaining unauthorized access to a computer system. Password cracking involves two distinct phases, in the first phase the attacker's intention is to dump the hashes of the passwords and in the second phase he tries to crack those acquired hashes. Besides this method, there are alternative ways for password cracking such as by guessing the password, by using malicious tools like keyloggers, phishing attacks, social engineering, dumpster diving, shoulder surfing attacks, etc.

Now we are going into a flashback in history of password cracking—how crackers cracked the password hashes 10 years ago. Some of the famous tools, such as Cain and Abel and John the Ripper were used for cracking the password hashes. These kinds of tools used CPU core power for cracking the hashes into a plaintext form. So if the password is complex and strong (password which includes alphanumeric, special characters), it will take days and years to bring out the plaintext from hash.

But nowadays we don't face the kind of circumstances under which the password is not found after continuously running the systems for many months. Advance cracking techniques are making the cracking times for some conventional passwords uncomfortably short. Using graphical processing units (GPUs) on video cards and loading rainbow tables onto very fast solid state drives (SSDs) are among these. Tools like Hashcat, Rainbow Crack, Cryptohaze Multiforcer, etc., are GPU-supported tools that utilize the GPU cores for cracking the hashes.

In this section we get the point that for cracking any hash there are two factors, the CPU and the GPU, that play an important role in cracking process. In the next section we will learn about CPU and GPU, how they work, and how the GPU works faster than the CPU.

Why GPU and Not CPU?

The CPU, or central processing unit, is where all the program instructions are executed. The GPU or graphical processing unit is meant to alleviate the load of the CPU by handling all the advanced computation necessary to project the final display on the monitor. The CPU is called the brain of a computer and the GPU is called its soul.

Generally, all PCs have integrated chips which render the display images on the monitor. Intel's integrated graphics render only basic graphics used by common applications such as Microsoft Office, basic games with low graphics, and videos. The GPU was originally developed for rendering 2D (two-dimensional) graphics to accelerate the drawing of the windows in graphical interface mode. But the technology developed and a new era arrived of 3D (three-dimensional), which needs faster graphic rendering. The GPU acceleration grew that is faster and more specialized in its task. If we look at it hardware wise, the CPU and GPU are similar but not identical.

Architecturally, the CPU has only few cores/multiple cores with lots of cache memory that can handle few software threads at a time. On the other hand, a GPU has hundreds of cores that can handle thousand of threads simultaneously. A GPU with 100+ cores can process thousands of threads and can accelerate some software by 100x over a CPU alone. The GPU achieves great performance by using heavy parallelism, with hundreds (if not thousands) of cores. This is made possible by pipelining and sharing instruction decoding. A CPU core can execute four 32-bit instructions per clock, whereas a GPU like the Radeon HD 5970 can execute 3200 32-bit instructions per clock. The difference between CPUs and GPUs is that GPUs are highly specialized in number crunching, something that graphics processing desperately needs as it involves millions, if not billions, of calculations per second. Multiple GPUs can also be employed to achieve a single goal, much like the dual-core CPUs currently available. The amount of core depends on the graphic card manufacturer. Nvidia graphics solutions tend to pack more power into fewer chips, while AMD solutions pack in more cores to increase processing power. Nvidia's new graphic card, which is known as GTX Titan, has 2688 cores.

So now, after this long discussion, we know the reason behind why we use the GPU for cracking passwords. Now we will go through on some practical approach and let us see the effort of password cracking with the CPU and the GPU.

Password Cracking with CPU

So here we are going to crack some hashes with tools, such as Cain and Abel, that utilize CPU power. First of all we need a hash to crack. To create a MD5 hash from a password, there are lots of tools like HashCalc, which creates different types of hashes; online services like http://www.md5hashgenerator.com/ also provide this hash conversion. In our case we are using Xi4rCh as password and we now create an md5 hash from this; after conversion the resulting md5 hash is a52a81807a28e5f92893dd5106c9ce65

Now that we have obtained an md5 hash, start Cain and Abel for cracking this hash.

In the above figure we can see that Cain and Abel has started working but the horrible thing is that the estimated time that is showing for crack that hash is approximately 93years; who will wait for such a long time?

Let us try some different applications such as Microsoft Office products, Winrar, Winzip, and 7zip; all of these applications have password protection. So here we are going to crack one of the password-protected applications.

Here we are using a trial version of a commercial product named Accent RAR password recovery. It supports CPU and GPU cores. But here we will use only the CPU core for cracking. It can crack up to four-character password in this trial period, so we locked a RAR file with a four-character password.

We can see in above figure that the password-protected RAR file pass.rar is analyzed by this software. The RAR version is showing 3.x, protection type SHA1 and 128-bit AES, and the estimated passwords for process is 15,018,570. The average speed which we are getting here is 361 password/sec and the estimated time is showing 11hours and 33minutes, which is long for a four-character password.

So we now understand the capability of a CPU in password cracking.

Password Cracking with GPU

After working with CPU-based tools, now we will do some hands-on with GPU-based tools. The tool that I am going to use here for cracking a md5 hash is called IGHASHGPU. It is a command-line-based tool. The md5 hash that we are going to crack is the same one, a52a81807a28e5f92893dd5106c9ce65

Now we can continue to a further cracking process. Run ighashgpuu.exe and type in these commands:

ighashgpu.exe /h:a52a81807a28e5f92893dd5106c9ce65 /t:md5 /c:csda /max:7 /cpudontcare

Syntax usage:

-c: for defining character sets (caps, small, digits, special, space, all)

-h: hash value

-t: type of hash (MD5, MD4 or SHA1)

-max: maximum password length
 

In the figure above, we can see the average password cracking speed is 1116.8 million per second and estimated time is approximately 11 min. But in our case the password is found in five minutes, which we can see in the figure below. The cracking speed is increases to 1119.1 million. Now we can see here that an alphanumeric password (uppercase, lowercase, and digits) within a six-character length can be cracked in five minutes. The found password is showing Xi4rCh.

We can see here how easily we cracked that hash in few minutes where Cain and Abel would take years for cracking this same hash.

Now we are going to try cracking the password-protected RAR file with the GPU core. Here we will use the same rar file and tool that we used in CPU cracking. But this time we will enable the GPU utilization option in this tool.

As we can see in the figure above, the GPU name is showing and it is enabled. The SP/ALU count tab refers to GPU cores, which is 96, and RAM is 1024MB, which means we have the 1GB graphic card of GeForce GT 620M with 96 cores. Now we will start the cracking process.

The average speed which we are getting here is 656 password/sec and the estimated time is showing 6 hours, 21minutes, which is long for a four-character password.

We remember how much speed we were getting if we utilize the CPU core only, 361 password/sec, with an estimated time of 11 hours, and now we are getting 561 password/sec, with estimated time of 6 hours, so we can see this huge difference in speed and time.

Conclusion

After reading this whole article, now we conclude easily that the GPU works better than the CPU in password cracking.

References

http://searchsecurity.techtarget.com/definition/password

https://en.wikipedia.org/wiki/Password

http://en.wikipedia.org/wiki/Password_cracking

https://en.bitcoin.it/wiki/Why_a_GPU_mines_faster_than_a_CPU

http://blogs.nvidia.com/blog/2009/12/16/whats-the-difference-between-a-cpu-and-a-gpu/

http://www.makeuseof.com/tag/what-is-the-difference-between-an-apu-a-cpu-and-a-gpu-makeuseof-explains/

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

http://www.differencebetween.net/technology/difference-between-cpu-and-gpu/