GPU-stuffed monster cracks Windows passwords in minutes
That's what you get for using a crap hashing algo
Customer Success Testimonial: Recovery is Everything
Security researchers have put together a monster number-crunching rig capable of cracking strong passwords by brute force in minutes.
Jeremi Gosney (aka epixoip) demonstrated a machine running the HashCat password cracking program across a cluster of five servers equipped with 25 AMD Radeon GPUs at the Passwords^12 conference in Oslo, Norway.
Gosney’s system means that even strong passwords protected by weak one-way encryption algorithms, notably the one used in Microsoft's LM and NTLM, are vulnerable.
A 14-character Windows XP password hashed using Lan Manager can be cracked from its hash value in just six minutes. LM splits a 14-character password into two seven-character strings before hashing them, which means it's a good deal less secure than an eight character password hashed with other encryption schemes. Brute forcing an eight-character password would take 5.5 hours, Security Ledger reports.
The attack could be run against leaked password hashes but not login methods directly. Since data breaches are by no means rare, this is not much of a barrier against misuse.
Services such as WPACracker and CloudCracker, a cloud-based platform for penetration testers, have already shown that older encryption algorithms and shorter passwords are hopelessly insecure. Gosney's research further underlines the point. ®
COMMENTS
Shock Horror
Old crypto broken by modern hardware.
Hold the press.
Re: Shock Horror
There is actually a registry (or Group Policy) switch in Windows that jumps up system cryptography levels, but not many people know about it or use it (outside of US gov contractors anyway). It's the "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" setting. See http://support.microsoft.com/kb/811833
Though it changes a lot of encryption defaults to AES-256 and SHA1 for hashing (or triple DES on Windows XP and older) I believe you would have to change NTLM authentication separately, like has recommended at http://support.microsoft.com/kb/147706 for over 10 years... Though disabling NTLMv2 is harder to do, rather annoyingly.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
