Slashdot Mirror
Blazing Fast Password Recovery With New ATI Cards
An anonymous reader writes "ElcomSoft accelerates the recovery of Wi-Fi passwords and password-protected iPhone and iPod backups by using ATI video cards. The support of ATI Radeon 5000 series video accelerators allows ElcomSoft to perform password recovery up to 20 times faster compared to Intel top of the line quad-core CPUs, and up to two times faster compared to enterprise-level NVIDIA Tesla solutions. Benchmarks performed by ElcomSoft demonstrate that ATI Radeon HD5970 accelerated password recovery works up to 20 times faster than Core i7-960, Intel's current top of the line CPU unit."
Because it's in my pants!
This isn't really about GPUs, it's an advert for ElcomSoft products. The whole summary is in marketing-speak for crying out loud.
$_ = "wftedskaebjgdpjgidbsmnjgcdwatb"; tr/a-z/oh, turtleneck Phrase Jar!/; print
I like the way this is portrayed in a totally positive light, as if a person, upon forgetting the password to their device, is going to go out and buy one of these video cards, install it in a machine capable of supporting it (PSU wattage, bus speed, OS, etc), purchase the proprietary "password breaker" software (sold by the company that authored this "story"), all just to recover their password. I think the typical usage for this type of setup is of a more nefarious sort.
Better known as 318230.
1, 2, 3, 4, 5? That's amazing! I've got the same combination on my luggage!
This isn't the first story about how crazy fast GPUs are for crunching. I know very little about that level of hardware, but why aren't we incorporating these types of things into CPUs? Is the coding/assembly so different that it doesn't translate? Do they only do certain kinds of processing really well (it is a GPU after all), so it couldn't handle other more 'mundane' OS needs?
I will shred my adversaries. Pull their eyes out just enough to turn them towards their mewing, mutilated faces. Illyria
I think we all know what they really mean. ;)
(Anyway, I'm also impressed by the power shown by the GPUs. Its a good demonstration that some of the new technologies (CULA? CUDA?) that allow "regular" programmers to use this power actually will really speed up some things.)
Hey Editors,
You forgot a link to the buying page
For as low as 1.399,- € you can start cracking^Wrecovering passwords today.
Is this supposed to be a good thing? Sounds like someone's password encryption algorithm needs some upgrading to me.
Salut,
Jacques
Great! now when I go into the bank with my stack of Radeon cards they'll call security.
I keep hearing stories about using GPUs for non-GPU computations, but has anybody here tried it?
What does your screen look like while a program like this is running?
I should hope they could do 20 times better.
boo slashvertisement
On that one ATI board that get 103K passwords per second and only 4K on the latest quad-core intel (which by the way, is almost 26 and not 20 only times faster.)
So that's wonderful. How many passwords are there in 1024 bit SSL encryption? 1024 asymmetric is equivalent to 80 symmetric algorithm, so that's like 2^80 passwords, right?
Let's say 100,000 passwords per second, that's 10^5.
Google says this: (2^80 / 10^5 ) / (3600 *24 *365*1000) = 383 347 863
383.3 million years to go through every password in 2^80 possibilities.
In reality, of-course, not every combination is used, many passwords can be eliminated by heuristic and also it helps to have a good dictionary file handy, from which to generated most likely password combinations. That probably cuts down from 383 million years to something much more ATI friendly. Of-course we need to use stronger cypher.
As a final note: at last I understand why Hugh Jackman needed the 7 monitor setup, each one must have been used as an output device for the video card it was connected to. Obviously the video cards were the actual power behind all that hacking!
You can't handle the truth.
What is with the spin talk here in the title? Basically this just says I need to use better passwords. Speak truths....
Think Deeply.
How dare you call me here! This is an unlisted wall!
So a programmable high end video card can probably be written off on one's taxes as a numerical accelerator? :-)
Finally...someone who understands!
I wanted to get one of those professional car door jimmy kits (the ones with a jimmy for just about every model of vehicle!) that tow truck supply vendors sell "just in case I get locked out of my car", but they had these outrageous demands that I "prove" that I was a legit tow outfit or garage.
The locksmith supply was much the same way when I tried to buy a lockpick set, "just in case I get locked-out of my house".
You can bet I'll be getting this software. I must've forgotten my password because I can't login to my secure wireless network, and I unfortunately don't have physical access to my WAP in order to reset it the cheap and easy way, with a pen tip.
FWIW, I work for $LARGE_US_BANK and we have an 8 character password limit, that MUST be exactly 8 characters, contain a number, etc.etc.etc.
MANY passwords can be eliminated through some social engineering.
I want to delete my account but Slashdot doesn't allow it.
Executes the cellular automata game of LIFE in the blitter chip. Uses a 318 by 188 display and runs at 19.8 generations per second. Author: Tomas Rokicki
So all you have to do to save 190 million years is buy two of them.
Excellent.
Nerd rage is the funniest rage.
no, definitely, you can buy 100,000,000 of them.
Then it's 3.83 years only. With a bulk discount will only cost maybe $10 per card, that's only 1000,000,000 a billion? Chump change for any government. Spend 100 times more money, get results in days.
You can't handle the truth.
How do you put commas and spaces into the combination for your luggage?
You can never go home again... but I guess you can shop there.
None of the additional units save as much time as the second one.
Nerd rage is the funniest rage.
"Password recovery" is about the same swarthy euphemism as "waste management" or "escort service." Why did an advertisement for hacking passwords get on /.? Aren't their IRC channels for that sort of thing?
"I'm not a quack, I'm a mad scientist! There's a difference." - Dr. Cockroach
There have been several documentaries about hacking over the years that demonstrate the use of GPU-based computations. It is soo bad.
Bluetooth keyboard, duh.
"But this one goes to 11!"
This seems to be an update of last year's story, just to mention that the HD5000 series is now supported, and it's faster on the newer, faster video cards.
Well done, sunshine! You've just reduced the number of attempts to break $LARGE_US_BANK passwords to 1370114370683136 (78^8)
At 103000 attempts per seconds, that's... 421 years oh.
(Yes I know it's not going to take until the entire set has been attempted to crack a password.)
Finally had enough. Come see us over at https://soylentnews.org/
Great! now when I go into the bank with my stack of Radeon cards they'll call security.
No, you're only doing them a favour by "recovering" their passwords.
Sure, if they're willing to adopt 'new technology.' Cause in 3 months something twice as fast will be out!
My abilities are only limited by my imagination
its about breaking passwords obvoisly targeting Jennifer the free wifi lady as a potential market
What's the difference between "recovering a password" and hacking into a phone? Shouldn't the summary read "use GPU to break into stolen smart phones."
-- QED
yeah, but the letters are case-insensitive and can use numbers only, no special characters.... that makes for about 6 months on average (300ish days in the worst case).
now... can you run these cards in a SLI configuration, and how many cards can you buy after you've cracked^H^H^H^H^recovered Warren Buffet's account password? :)
ATi is sub-brand of AMD.
Then it sounds even better, we all like when underdog beats 10-times bigger Co.
ok, I understand the differences between linear processing and parallel processing. And the differences between cpus and gpus. And I understand that with some coding, nVidia/Tesla and ATI gpu cards can be used for parallel processing with applications the software (Tesla?) ports to, but will apps like john the cracker and pdfcrack be able to take advantage of the gpu card sitting in my desktop or laptop? Will it take some coding by the maintainers of john and pdfcrack to gain this ability, or is it too complicated? Can other apps take advantage of gpu processing also (I'm thinking apache (multiworker, increased processes instead of increased threads, etc), databases, ethernet, etc.
Better yet, can there be a middle layer, like (God forbid) java, modperl, php's engine or other that can be written as sort of a plugin to nVidia/Tesla or ATI which automates the process of enabling the parallel processing ability of the gpu cards to be used with any app as long as the middle layer ports the gpu abilities to a standard?
Nice to dream about it anyway. Can't wait for 8/16 cores and 8/16 GB standard ram shipping in laptops and low end desktops.
This is a blatant advertisement. Who's responsible for letting junk like this through? Has your account been hacked, CmdrTaco (or should we now call you CmdrSPAM)? It's bad enough stories are often duplicates and days/weeks old. This is just sh*tty spam.
At 103000 attempts per seconds, that's... 421 years oh.
Still within the realm of cracking, especially if those passwords guard a few million dollars of assets. 421 years sounds like a lot until you add things like:
- Crossfire or SLI where you have multiple boards installed
- Setup half a dozen machines to work on the problem
- Apply a botnet to the problem
- Future improvements in technology
- Apply some heuristics to the guessing process
All of which can easily shave off at least 2 orders of magnitude and possibly 3 orders of magnitude. Which reduces that 421 years down to a few months (or worse).
8 character passwords are pretty much dead in the water now. Or at least they need to be phased out within the next few years. Or protected by rate-limiters which control how fast passwords can be tried. (Personally, I always assume that the attacker has the stored hash and can apply parallelism to the attack. Which means that rate limiters should not be relied on to prevent cracks.)
Wolde you bothe eate your cake, and have your cake?
It's clear that it is no longer sufficient to use a string of text entered by a human being as a secure key.
Biometric or physical-token security should be a mandatory peripheral on all computing equipment sold.
For remote access, keys should start in the thousands of bits, and be locked on the client side by biometrics or tokens.
Short of that, failure to secure your data is your own fault.
I am wondering if the CPU cycling is better then the quad core intel chips we use in pcs today, could we not just force a use cpus on vid cards instead of cpus on motherboard to do stuff with? Then i could buy 2 cards, one which could be used as a real vid card, then the other to replace the cpu of the machine, and technically, we could also use this for backwards compatibility, say if we used it in a P3 computer, it would definitely improve performance greatly seeing as now you have a kickass cpu instead of the old P3....???
True, a simple brute force will take nearly forever. However, if you have a good large wordlist with say the top 10 million passwords, then you should be able to "recover" most passwords in much less than a day. Furthermore, if you wish to do a bruteforce method, I would suggest John the Ripper. It will pump out wordlists using frequency tables. Thus your more common passwords alphanumeric passwords will be tested before say *()3s3Ag+%&c. Useful since most induhviduals don't like to memorize random passwords.
And I didn't RTFA, but this slashvertisement sounds strikingly similar to say pyrit/aircrack-ng/jtr available on Backtrack.
How much faster is ATI 5000 compared to a PS3 Cell BE?
Google says this: (2^80 / 10^5 ) / (3600 *24 *365*1000) = 383 347 863
383.3 million years to go through every password in 2^80 possibilities.
Try this: 2^80 / ( 10^5 / s ) in millennia. Or try it with bandwidth calculations.
ded
8 character passwords must remain the minimum allowed. If it goes higher, people can't easily remember them, especially when you are expected to change them every month/quarter/year. I could memorize and be willing to use a 12 character password if I never had to change it. Other mechanisms like running a password app on a portable flash drive, or token based security has advantages and disadvantages.
Really I think the answer has to be exponential rate limiting, where each incorrect guess doubles the amount of time before you can try again, starting with 2 seconds maybe. That gets intolerable for guessing real fast.
where did you get the number 78^8 from? How do you remove every one that doesnt contain a number and whatever other requirements are on there?
That's exactly what the AMD Fusion project is all about (integrating the GPU & CPU together). Google it.
They do if you measure time in X's. Each additional one is one more X.
How about ubiquitous smartcards and let's just get rid of passwords entirely?
Ditto for credit card numbers, or any other technology that involves having somebody authenticate your identity by being provided with a static piece of information that now allows them to authenticate themselves as you.
At that point, you aren't actually measuring time anymore.
Nerd rage is the funniest rage.
I think it is a good idea. That's what I meant by token based security. But it does present a problem for things like smartphones and the coming light tablet computers. Do you carry around a RFID credit card as the token that the phone or computer reads? Do phones and small devices get exempted from this and you use gesture passwords? There are some things to get worked out.
Crap! I never realized that behind the slowness there could be something as organized as a Seti@home project. Most spyware slowing a Joe Blogs' PC enough to call me in for a "computer problem" check used to be due to inefficient and poorly coded spyware.
Any zero-network-access, long-run blackops activity pegging the CPU, fans and heating up cores when the owner isn't watching will have impact the duration of said parts. I owe you one for mentioning what was probably obvious but not known to me before. Most PC fixers do run the usual antispyware cleaning and see if outgoing network lights on the home router show unusual amounts of data moving without a visible cause. Then, we call it a day. You have opened my eyes
Alpha, upper and lower case, numbers, special characters after sanitisation is 78 characters, if I remember correctly.
I may be wrong, but it's a good indication.
Finally had enough. Come see us over at https://soylentnews.org/
Google says this: (2^80 / 10^5 ) / (3600 *24 *365*1000) = 383 347 863
Why on earth did you need Google to say that? They bought math?