To Customer Support To Customer Support
Solved

Hacking Super-Weapon Can Crack Encrypted Passwords In Seconds

  • 6 December 2012
  • 2 replies
  • 43 views
V
Rank
http://www.huffingtonpost.co.uk/2012/12/05/hacking-super-weapon-jeremi-gosney_n_2244333.html?utm_hp_ref=uk
 
Comments anyone?  Any possible impact upon Webroot Password Manager?
Quote:
Passwords are encrypted in many different ways - some with more complex algorithms at their core than others - so the time it takes to crack them can vary massively.
But because many companies, including some popular online services, use outdated or cheaper encryption methods - or store their passwords badly - customers can be put at risk.
Security Ledger said the new system is able to crack the strongest passwords encrypted with two popularly used algorithms, including Microsoft's LM and NTLM, within very short time periods.
The machine is able to test 348 billion NTLM password hashes per second.
A fourteen character LM password would take just six minutes to crack on the system, while NTLM passwords of a similar length would take five and a half hours, according to Security Ledger.
icon

Best answer by DanP 7 December 2012, 16:43

View original

2 replies

DanP
Rank
Userlevel 7
Badge +35
The demonstration shows that just like everything in computing, the speed at which encrypted passwords continues to get faster.  An attacker still needs to first obtain the encrytped passwords in order to crack them with a system like this.
 
From the Security Ledger article that the Huffington Post used as it's source:
 
"Tools like Gosney’s GPU cluster aren’t suited for an “online” attack scenario against a live system. Rather, they’re used in “offline” attacks against collections of leaked or stolen passwords that were stored in encrypted form, Thorsheim said. In that situation, attackers aren’t limited to a set number of password attempts – hardware and software limitations are all that matter."
 
-Dan
Webroot Threat Research
V
Rank
Thanks Dan.  This is good to know.  Hopefully, access to the Webroot database of passwords is not at risk.

Reply


Terms & Conditions

© 2004 - Webroot Inc.

We have recently updated our Privacy Policies. We encourage you to read the full terms here.