25-GPU cluster can brute force Windows password in record time

eremi Gosney, the founder and CEO of Stricture Consulting Group, recently showcased a GPU-based computer cluster capable of brute forcing its way through any standard eight-character Windows password (including upper- and lower-case letter, digits and symbols) in less than six hours.

The machine, powered by 25 AMD Radeon graphics cards, runs the Virtual OpenCL cluster platform. This allows all of the machines / GPUs to act as a single computer. With this configuration, Gosney was able to use a password-cracking suite called ocl-Hashcat Plus that is designed specifically for GPU computing.

The cluster uses the NTLM cryptographic algorithm included in all versions of Windows since Server 2003 and is able to generate and test 350 billion password guesses per second. Once the math is factored in, that equates to every different password combination in only five and a half hours. Gosney said they can now attack hashes about four times faster than they previously could.

VCL virtualization is essentially what makes a system like this possible. GPU computing isn’t exactly new but hardware and software limitations have thus far prevented most people from running more than eight graphics cards on a single computer.

"Before VCL people were trying lots of different things to varying degrees of success," Gosney told Ars Technica. "VCL put an end to all of this, because now we have a generic solution that works right out of the box, and handles all of that complexity for you automatically. It's also really easy to manage because all of your compute nodes only have to have VCL installed, nothing else. You only have your software installed on the cluster controller."

It’s worth pointing out that this method typically only applies to offline attacks due to the fact that most websites limit the number of incorrect password guesses before either locking the account down or enforcing a waiting period.

Either way, experts suggest using a password that is at least nine characters long and doesn’t contain names, words or common phrases.

TechSpot PC Buying Guide

Find and Compare the Best Tech Products

By TechSpot Staff on November 15, 2013

Read user comments (33)

The TechSpot PC Buying Guide offers an in-depth list of today's best desktop PC hardware, spanning four unique yet typical budgets. Whether you're a first time builder seeking guidance or a seasoned enthusiast, we have you covered.

After working on this guide for many years, we learned the biggest pitfall of our previous work along with many other buying guides online: they expire shortly after publishing. Prices change daily, components come and go, and the guides simply degrade in worth until they're eventually rewritten months later. Recognizing this, we're taking an alternative approach.

We will add and update new hardware to the mix as it's released. The four builds will be updated on major product launches and we'll keep monitoring components and their prices over the course of weeks and months to catch anything in-between. We wholly welcome your support and input to keep this guide as fresh as possible. With that out of the way, let's take a look at our four price points: