Slashdot Mirror

← Back to Stories (view on slashdot.org)

Blazing Fast Password Recovery With New ATI Cards

Posted by CmdrTaco on from the feel-safe-yet dept.

An anonymous reader writes "ElcomSoft accelerates the recovery of Wi-Fi passwords and password-protected iPhone and iPod backups by using ATI video cards. The support of ATI Radeon 5000 series video accelerators allows ElcomSoft to perform password recovery up to 20 times faster compared to Intel top of the line quad-core CPUs, and up to two times faster compared to enterprise-level NVIDIA Tesla solutions. Benchmarks performed by ElcomSoft demonstrate that ATI Radeon HD5970 accelerated password recovery works up to 20 times faster than Core i7-960, Intel's current top of the line CPU unit."

48 of 215 comments (clear)

  1. Stop with the advertising by ShadowRangerRIT · · Score: 4, Interesting

    This isn't really about GPUs, it's an advert for ElcomSoft products. The whole summary is in marketing-speak for crying out loud.

    --
    $_ = "wftedskaebjgdpjgidbsmnjgcdwatb"; tr/a-z/oh, turtleneck Phrase Jar!/; print
    1. Re:Stop with the advertising by ShadowRangerRIT · · Score: 3, Informative

      And for the curious, TFA is no better. They're calling it a benchmark so they can advertise more effectively, that's all.

      --
      $_ = "wftedskaebjgdpjgidbsmnjgcdwatb"; tr/a-z/oh, turtleneck Phrase Jar!/; print
    2. Re:Stop with the advertising by Sir_Sri · · Score: 2, Interesting

      And a bit of an and underhanded advert for ATI. 'Password recovery' is an inherently parallel problem that really likes the sort of math gpus do, and not so much the sort CPU's do. The ATI 5000 series are the fastest GPU's available at retail right now, doesn't take a genius to put 2 and 2 together here. Anyone who knows anything about NVIDIA's workstation parts knows they are not radical departures from their current retail chips so saying your new fancy retail part is twice as fast as the workstation version of the other guys last gen part is stating the obvious.

    3. Re:Stop with the advertising by ClosedEyesSeeing · · Score: 2, Insightful

      ... The whole summary is in marketing-speak for crying out loud.

      And for the curious, TFA is no better. They're calling it a benchmark so they can advertise more effectively ...

      You must be new here.

    4. Re:Stop with the advertising by jank1887 · · Score: 2, Funny

      come on. It CLEARLY states that "An anonymous reader" wrote that summary.

    5. Re:Stop with the advertising by Lord+Ender · · Score: 3, Interesting

      As an IT security guy, I found this to be informative, actually. When analyzing the security of a system or organization, I need to know not just what is theoretically possible, but what can be done with already-existing software and hardware.

      This article gives me some idea as to what attacks are currently practical (and for what key lengths).

      When research or engineering achievements come from the commercial (rather than academic) sector, it isn't really reasonable to expect an academic tone. They're tooting their own horn, but they are doing it about something important.

      --
      A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
    6. Re:Stop with the advertising by node+3 · · Score: 2, Insightful

      Having skimmed TFA (actually, TF Press Release) it doesn't sound like there's anything really interesting here other than GPUs are faster are parallel calculations than CPUs. This is already known.

      Cracking WPA and iPod/iPhone backups is still not a feasible task. Instead of 20 billion years (or whatever), it'll now only take 1 billion? Saying "20 times faster" makes it sound like you can already reliably crack these things, and now instead of a few hours, it's only a few minutes. But unless I missed it (and I certainly could have), that's not the case. It's just Moore's Law continuing on, in this case on the GPU instead of the CPU. We already know newer chips will be able to try more keys per second, but we're a *long* way from it being something to have any reasonable level of concern over.

      It strikes me as odd that they actually have a product for this. It may be useful for short key lengths, but not for the things listed in the headline. It's like saying the hydrogen bomb can destroy Jupiter 100 times faster than an atom bomb. It may be technically true, but it's not a practical solution.

  2. Portrayal by Dan+East · · Score: 5, Insightful

    I like the way this is portrayed in a totally positive light, as if a person, upon forgetting the password to their device, is going to go out and buy one of these video cards, install it in a machine capable of supporting it (PSU wattage, bus speed, OS, etc), purchase the proprietary "password breaker" software (sold by the company that authored this "story"), all just to recover their password. I think the typical usage for this type of setup is of a more nefarious sort.

    --
    Better known as 318230.
    1. Re:Portrayal by mcgrew · · Score: 2, Interesting

      You remember that Elcomsoft was the company Dmitry Skylarof was (is?) with? He's the guy who got thrown in a US jail for something he did in Russia that was completely legal in Russia.

      --
      Free Martian Whores!
    2. Re:Portrayal by ElectricTurtle · · Score: 3, Informative

      Being found not guilty does not mean he didn't spend time in jail. Not everybody is released on their own recognizance pending trials.

      --
      I support the Slashcott and will not be reading or commenting from 2/10/14 to 2/17/14. Beta is steaming pile of dog shit
    3. Re:Portrayal by russotto · · Score: 3, Informative

      No, the US jury found him not guilty.

      No, the charges against Sklyarov were dropped and he was released as part of a deal in which Elcomsoft agreed to accept US jurisdiction. The US jury then found Elcomsoft not guilty.

    4. Re:Portrayal by elrous0 · · Score: 2

      I'll take the point of view of 99.999% of people who buy (or more likely pirate) this software, and say that's its primary use will be nefarious.

      --
      SJW: Someone who has run out of real oppression, and has to fake it.
    5. Re:Portrayal by ElectricTurtle · · Score: 2, Informative

      Foreign nationals such as Dmitry Skylarof are usually classified 'high risk of flight' because they are expected to run back to their country if given half a chance, so, yeah, not out of the ordinary.

      --
      I support the Slashcott and will not be reading or commenting from 2/10/14 to 2/17/14. Beta is steaming pile of dog shit
    6. Re:Portrayal by hatten · · Score: 4, Funny

      Wow, I didn't knew clippy could do password cracking!

    7. Re:Portrayal by Anonymous Coward · · Score: 5, Informative

      Dude, I was there. Defcon 9.

      He didn't "enter a hostile country" unless you think the USA hates everybody and is hostile to all.

      Dmitriy broke no US laws and broke no Russian laws. No US entity had complained about his activities before his arrest. He had every right to think he'd not be bothered.

      But he he angered a powerful and amoral US corporation named Adobe, so they had their government lackeys detain him. When Adobe took a horrible blog-beating and a nearly instantaneous sales hit they asked the fedguv to drop the charges and the USA said "no, you turned him in, you don't prosecute DCMA, we do - he stays in jail for a year until we eventually get around to trying him and finding him not guilty". The worm turned on its master, very funny for everyone but Dmitriy's wife and infant children.

      What did Dmitriy do that brought corporate wrath down on him? He revealed in a public forum that Adobe's e-book cipher, which they were shopping to authors as "hard encryption", was ROT-13. I was there when he did it. That's right, Adobe was telling authors that their technology would prevent duplication of their books, but their copy-protection was ROT-13. It's beyond parody.

      Dmitriy revealed to e-book authors that Adobe had ripped them off. For that, he was held in durance vile.

      Why did he do it? Not for the challenge, it was trivial! He did it so people could back up their legally purchased e-Books and so that blind people could read e-books. For that, he was held.

    8. Re:Portrayal by CityZen · · Score: 2, Insightful

      The sub $300 graphics card will probably still be faster than the $1000 CPU, and the high school geek might get a cracked version of the $1200 software, so it's still within his purview.

      In any case, the USD1000 video card is sub $800 now, and will be half that in a few months. The advancement of technology will let all threats eventually percolate down to the lowest levels.

    9. Re:Portrayal by tirnacopu · · Score: 2, Interesting

      I did this kind of purchase at one time, for a perfectly valid reason. A rogue accountant deleted company data to cover his ass, but was keeping encrypted backups before that. I could undelete several archives, but they were .ace unfortunately, and there are no solutions I am aware of to at least brute-force it (their decompression .dll crashes randomly). If, at the time, someone would have told me that a Radeon card can increase my chances of recovery, I would have bought ten of them instantly.

    10. Re:Portrayal by Rene+S.+Hollan · · Score: 3, Insightful

      Try posting bail when no one else has access to your money or collateral and no one is willing to advance you a loan for that purpose. You first have to get to your lawyer (assuming you have one, and not a public defender who won't give a crap), have him draw up (or use a boilerplate) power of attorney form so s/he can access your funds, have a notary witness your signature at the jail (often not possible since the only physical (non-video) visitor you can have is your lawyer), and take that to your bank during business hours.

      A debit/credit card might work, and you might indeed have it on your person when you are arrested. But, it will be safely stored with your personal possessions, and not provided to anyone other than upon filing in a release form, that your jailer may not approve (generally the deputy overseeing the jail module where you are held). Have you got your debit/credit card number memorized? The expiration date? The code on the back?

      Things that can take a few minutes over the phone can take many days when one is in jail.

      --
      In Liberty, Rene
    11. Re:Portrayal by Rene+S.+Hollan · · Score: 2, Informative

      Bail bondsmen can't help you if you can't post collateral or pay the bond fee.

      The problem isn't not having the resources to post bail. (Well, that is a problem, but a different one.) The problem is not being able to execute the steps to do so.

      --
      In Liberty, Rene
  3. Re:My password. by FireofEvil · · Score: 3, Informative

    1, 2, 3, 4, 5? That's amazing! I've got the same combination on my luggage!

  4. GPUs by Thyamine · · Score: 4, Interesting

    This isn't the first story about how crazy fast GPUs are for crunching. I know very little about that level of hardware, but why aren't we incorporating these types of things into CPUs? Is the coding/assembly so different that it doesn't translate? Do they only do certain kinds of processing really well (it is a GPU after all), so it couldn't handle other more 'mundane' OS needs?

    --
    I will shred my adversaries. Pull their eyes out just enough to turn them towards their mewing, mutilated faces. Illyria
    1. Re:GPUs by godrik · · Score: 2, Informative

      It is in progress in fact. That was the point of intel 80 cores prototype.

      I found funny that with time we keep doing the cycle external processor->co processor->ntergrate in CPU dye -> external processor

    2. Re:GPUs by Anonymous Coward · · Score: 3, Informative

      GPU's are better at doing certain calculations generally, and are very good at parallel processing seeing as graphics can be broken down to be processed parallel very quickly. For this, gpu's have a ton of cores. So in a way processors are indeed starting to follow with multicore systems but it is nowhere near the number GPU's use. High end GPU's now have 480+ processor cores on a card these days, thats a lot more then 4 core intel's ;). But if you had a ton of cores on the processor, each additional one doesn't add too much to actual cpu power as most things must be done linearly, not parallel. Just helps with multitasking really. Which is why a few cores are useful, but overall power of the core is better then having a ton of them. Graphics cards go with a ton of lower speed cores.

    3. Re:GPUs by imgod2u · · Score: 2, Interesting

      To some level, CPU's have been moving to be more GPU like for a long time. SIMD (SSE, AltiVec, NEON) are GPU features that made their way to CPU's. Ditto for parallel, long pipelines. Remember the Pentium 4? That was a huge step in the GPU direction.

      There are two problems with that approach:

      1. Code that isn't pure number-crunching doesn't run well on such a compute model.
      2. The model is almost entirely memory-starved. GPU's have up to a GB of high-speed, dedicated RAM on the card itself. CPU's have to live with high-density (relatively) slot-loaded memory.

      AMD is moving in a direction where the GPU compute parts are fed by the CPU front-end. As we move forward, I suspect we'll see more of a "fusion" if you will (don't sue me) of the two compute models.

    4. Re:GPUs by John+Napkintosh · · Score: 3, Informative

      The last sentence nails it. They only do certain types of operations well, and the frequency with which I upgrade GPUs compared to CPUs - or more specifically, the fact that I very rarely replace both at the same time - leads me to believe I'm better off having them separate. Maybe there are parts of the GPU which could be incorporated into the CPU, and I think that might be what the Core i3/5/7 processors are doing with GMA integration.

      --

      Long signatures suck.
    5. Re:GPUs by SuperMog2002 · · Score: 5, Informative

      Is the coding/assembly so different that it doesn't translate? Do they only do certain kinds of processing really well (it is a GPU after all), so it couldn't handle other more 'mundane' OS needs?

      Yes, exactly. CPUs are built from the ground up to do scalar math really, really fast. That lends itself well to doing tasks that must be performed in sequence, such as running an individual thread. However, they've only recently gained the ability to do more than one thing at a time (dual core processors), and even now high end CPUs can only do six calculations at once (6 core processors).

      Meanwhile, GPUs are built to do vector math really, really fast. They can't do individual adds anywhere near as fast as a CPU can, but they can do dozens of them at the same time.

      Which type of processor is best for which job depends entirely on the nature of the math involved and how parallelizable the task is. In the case of 3D graphics, drawing a frame involves tons of vector arithmetic work, which is why your 1 GHz GPU will run circles around your 3 GHz CPU for that task (and is also where the GPU gets its name from). In the case mentioned in the article, password cracking is highly parallelizable: you've gotta run 100 million tests, and the outcome of any one test has zero influence on the other tests, so the more you can run at the same time, the better. By running it on the GPU, each individual test will take a bit longer than running it on the CPU would, but you'll be able to run dozens simultaneously instead of just a few, and will thus get your results much faster.

      CPUs certainly have their place, though. Some tasks simply must be done in sequence and cannot be easily divided up in to seperate parallel tasks. The CPU will get these done much faster, since running them on the GPU would incur the speed penalty without realizing any benefit.

      I've simplified it a bit for the sake of explanation, but that's the gist of it. Hope that helps!

      --
      Sunwalker Dezco for Warchief in 2016
    6. Re:GPUs by ShadowRangerRIT · · Score: 3, Interesting

      That's not really the same thing. The Intel 80 core prototype was still a CPU at heart, they just made improvements to communication. GPUs are quite different. GPUs are designed as primarily floating point processors (though newer ones can do low precision integer math with similar efficiency), but more importantly, they are vector processors with virtually no support for conditional statements and optimized for sequential access to memory instead of random access. They're halfway between dedicated circuitry and a general purpose CPU; what they can do, they do *very* well, and they can generalize a little, but tasks they weren't designed for need to be rewritten to accommodate their quirks, and eventually reach a point of diminishing returns. Integrating GPUs into the CPU will allow more programs to use it (and possibly speed processing and enable new scenarios where the CPU and GPU need to communicate frequently), but for run of the mill computing tasks, the relatively inflexible design of GPUs is a problem.

      --
      $_ = "wftedskaebjgdpjgidbsmnjgcdwatb"; tr/a-z/oh, turtleneck Phrase Jar!/; print
    7. Re:GPUs by imgod2u · · Score: 2, Informative

      My understanding is that even DX10+ compliant GPUs still suffer badly when conditional branching occurs. They can do it, but it basically causes them to throw away everything.

      That's entirely up to the implementation. Today's generations of GPU's don't pay much heed to conditional branching but the upcoming Fermi from nVidia, for instance, does introduce branch prediction and tracking. The API supports conditionals and loops.

      As for Larrabee, while it was designed as a GPU in some ways, I got the impression it still hewed to CPU roots. It was integer based, not floating point based

      *boggle* no it wasn't. The thing was a bunch of 486 CPU's each with a gigantic 128-bit SIMD (read: vector floating point) unit attached. It obviously was not made to do anything but the most rudimentary CPU tasks. Hell, it doesn't even support branch prediction or OoOE.

      They wanted to make all those college raytracer programs practical for use, replacing the current model which is somewhat more fuzzy and less accurate, but *way* faster.

      Erm, no. While it's true that SSE supports 64-bit FP and may have been faster than the double-precision data on current graphics cards *per core*, in aggregate, it still wouldn't be any faster than a typical graphics card. And with Fermi, nVidia has vastly improved its double-precision processing anyway.

  5. Slashvertisement by Anonymous Coward · · Score: 5, Funny

    Hey Editors,

    You forgot a link to the buying page
    For as low as 1.399,- € you can start cracking^Wrecovering passwords today.

    1. Re:Slashvertisement by cOldhandle · · Score: 3, Informative

      In case anyone wants to play around with this tech without paying (or rolling your own): I tried out this free (as in beer) windows software yesterday: http://golubev.com/rargpu.htm It seemed to work very effectively - I was able to brute force 5 lower case letter only passwords on RAR files in a couple of minutes on a GTX260. It also has some advanced options to specify mutations of strings to try, and to use word lists.

    2. Re:Slashvertisement by elrous0 · · Score: 2, Informative

      Agreed, looks more like the kind of "story" we'd see posted by kdawson, not Taco.

      --
      SJW: Someone who has run out of real oppression, and has to fake it.
  6. Huh? by blackjackshellac · · Score: 2, Informative

    Is this supposed to be a good thing? Sounds like someone's password encryption algorithm needs some upgrading to me.

    --
    Salut,

    Jacques

  7. Re:My password. by Jazz-Masta · · Score: 2, Funny

    Great! now when I go into the bank with my stack of Radeon cards they'll call security.

  8. Out of curiosity... by Anonymous Coward · · Score: 2, Interesting

    I keep hearing stories about using GPUs for non-GPU computations, but has anybody here tried it?

    What does your screen look like while a program like this is running?

    1. Re:Out of curiosity... by cbope · · Score: 3, Informative

      Normal. Running GP-GPU or CUDA apps has no effect on output to the screen. We do it for medical imaging processing.

    2. Re:Out of curiosity... by Anonymous Coward · · Score: 2, Funny

      Good point. Why would I assume a graphics card operation would have any effect on graphics? I've only ever used mine to take ice off the windshield.

    3. Re:Out of curiosity... by Anonymous Coward · · Score: 2, Informative

      The display buffer for a 1920x1200 screen with 24-bit colour takes less than 7MB. Even a fairly low-end graphics card will have at least 128MB of memory. In other words, there's plenty of memory for a program running on a GPU without needing to piss on the display buffer.

      If your screen is just displaying a bunch of 2D windows, then the 100s of cores in your GPU will be sitting idle. Again, computations running on the GPU will have no impact on what you see.

    4. Re:Out of curiosity... by ShadowRangerRIT · · Score: 2, Informative

      I run the Folding@home GPU client on my GeForce 8800 GTX. On Vista and later OSes (pre-Vista, the driver model wasn't well adapted to GPGPU and this leads to a polling driven communication scheme which is really inefficient), the effect on resources is unnoticeable aside from during games (where I kill the client to reduce jerkiness); the GPGPU work is lower priority and gets shunted aside from rendering, though the latency involved is a problem for graphics intensive games. For less demanding work and general usage, it's unnoticeable; the GPU is perfectly capable of drawing the screen and curing Alzheimer's at the same time. :-)

      --
      $_ = "wftedskaebjgdpjgidbsmnjgcdwatb"; tr/a-z/oh, turtleneck Phrase Jar!/; print
    5. Re:Out of curiosity... by Waffle+Iron · · Score: 2, Funny

      What does your screen look like while a program like this is running?

      Well I haven't kept up with the latest developments, but if it's anything like the Sinclair ZX80 I'm posting from, the screen goes blank gray when you start actively computing. Then it returns to normal when the answer is ready.

  9. boo by Anonymous Coward · · Score: 5, Informative

    boo slashvertisement

  10. 103000 passwords per second. So? by roman_mir · · Score: 2, Informative

    On that one ATI board that get 103K passwords per second and only 4K on the latest quad-core intel (which by the way, is almost 26 and not 20 only times faster.)

    So that's wonderful. How many passwords are there in 1024 bit SSL encryption? 1024 asymmetric is equivalent to 80 symmetric algorithm, so that's like 2^80 passwords, right?

    Let's say 100,000 passwords per second, that's 10^5.

    Google says this: (2^80 / 10^5 ) / (3600 *24 *365*1000) = 383 347 863

    383.3 million years to go through every password in 2^80 possibilities.

    In reality, of-course, not every combination is used, many passwords can be eliminated by heuristic and also it helps to have a good dictionary file handy, from which to generated most likely password combinations. That probably cuts down from 383 million years to something much more ATI friendly. Of-course we need to use stronger cypher.

    As a final note: at last I understand why Hugh Jackman needed the 7 monitor setup, each one must have been used as an output device for the video card it was connected to. Obviously the video cards were the actual power behind all that hacking!

    --
    You can't handle the truth.
  11. Re:My password is safe by idontgno · · Score: 5, Funny

    Dude, haven't you heard? It's really insecure to use such a short password. And yours is surely the shortest EVAR.

    --
    Welcome to the Panopticon. Used to be a prison, now it's your home.
  12. Re:My password. by Mister+Whirly · · Score: 2, Insightful

    Bluetooth keyboard, duh.

    --
    "But this one goes to 11!"
  13. Re:My password. by BrokenHalo · · Score: 2, Funny

    Great! now when I go into the bank with my stack of Radeon cards they'll call security.

    No, you're only doing them a favour by "recovering" their passwords.

  14. Someone should revoke Taco's privileges... by thefuz · · Score: 2

    This is a blatant advertisement. Who's responsible for letting junk like this through? Has your account been hacked, CmdrTaco (or should we now call you CmdrSPAM)? It's bad enough stories are often duplicates and days/weeks old. This is just sh*tty spam.

  15. Re:My password is safe by Linker3000 · · Score: 5, Funny

    Try resetting someone's password to 'obvious' when they call in with a 'forgotten password'. Then see how long you can string them along by saying "I've reset your password - the new one's obvious..."

    Caller: "What? Like my surname?"
    You: "No, it's obvious"
    Caller "First name?"
    You "No"
    Caller "letmein?"

    Yeah, it's been a bad day!

    --
    AT&ROFLMAO
  16. Re:103000 passwords per second. So? by WuphonsReach · · Score: 4, Insightful

    At 103000 attempts per seconds, that's... 421 years oh.

    Still within the realm of cracking, especially if those passwords guard a few million dollars of assets. 421 years sounds like a lot until you add things like:

    - Crossfire or SLI where you have multiple boards installed
    - Setup half a dozen machines to work on the problem
    - Apply a botnet to the problem
    - Future improvements in technology
    - Apply some heuristics to the guessing process

    All of which can easily shave off at least 2 orders of magnitude and possibly 3 orders of magnitude. Which reduces that 421 years down to a few months (or worse).

    8 character passwords are pretty much dead in the water now. Or at least they need to be phased out within the next few years. Or protected by rate-limiters which control how fast passwords can be tried. (Personally, I always assume that the attacker has the stored hash and can apply parallelism to the attack. Which means that rate limiters should not be relied on to prevent cracks.)

    --
    Wolde you bothe eate your cake, and have your cake?
  17. Re:What about....? by Ant+P. · · Score: 2, Informative

    Not really. GPUs are good at going really fast in a straight line. Throw so much as an "if" statement at them and they become about as fast as a P2. The closest you'd get to what you're describing is a Cell PCI-E card, or Intel's vapourware Larrabee.

    Though if all you want is to use your old stuff on a new PC, you can get ISA/PCI card motherboards that run off the host's power/peripherals.