German Brute Forces SHA1 in 49 Minutes for $2

http://www.itproportal.com/2010/11/19/german-hacks-national-security-agencys-sha1/

by J3L2404 • 16 years ago

9 17 16 years ago

Really poor headline. This has nothing to do with hacking SHA1: it's just a dictionary attack on the passwords in question.

SHA1 (and MD5 and similar constructions) are especially vulnerable because they are fast to evaluate (OpenBSD's Blowfish scheme and cperciva's scrypt feature a scalable amount of work), but this is not a break of SHA1 per se.

Still, a nice demonstration of what GPU programming can do.

goldenthunder2• 16 years ago

Actually brute forcing is exactly what he is going. But grabbing people's password hashes isn't really 'easy' w/ a well designed system.

pilif3• 16 years ago

there's a difference between brute-forcing all possible key combinations and brute-forcing various passwords on a (huge) wordlist.

Brute-forcing all keys will have you check 730750818665451459101842416358141509827966271488 possible keys in average.

Using a dictionary will have you check however many words are in your list.

If course the first method will give you a 100% chance of eventually finding the key, but it will take a very long time.

Brute-forcing the dictionary will take a very short time, but you won't have a 100% chance of finding the key (if it's not on the list).

Now, there might be some mathematical problems in the SHA algorithm that lowers that astronomical number of tries you have to do for a real brute-force attack, but there are none currently known and even with all the parallel GPU power, checking all those keys would take years. Not minutes.

markpercival• 16 years ago

It turns out the 10 passwords he 'hacked' were in the range of 1-6 characters.

More details here: http://www.theregister.co.uk/2010/11/18/amazon_cloud_sha_pas...

blibble2• 16 years ago

If he had just Google'd the hashes he'd have saved himself $2, considering there was no salting.

goldenthunder2• 16 years ago

For anyone that wants to try this out, here is the 'german guy's post on the matter:

http://stacksmashing.net/2010/11/15/cracking-in-the-cloud-am...

regularfry• 16 years ago

The headline is inaccurate; according to http://news.ycombinator.com/item?id=1921848, he cracked SHA1 14 times in 49 minutes.

pilif3• 16 years ago

he ran 14 SHA1 hashes of very poor passwords through his dictionary in 49 minutes.

If these were salted hashes or even just better passwords he'd still be calculating. And he'd STILL be calculating years from now.

cperciva2• 16 years ago

If the passwords were salted, he would have cracked one in 49 minutes instead of 14.

vankap• 16 years ago

Switching to one of the SHA-2 hashes should be good enough till SHA-3 is selected.

tptacek4• 16 years ago

Switching to SHA2 would do absolutely nothing to defend against GPU-optimized brute force dictionary searches.

German Brute Forces SHA1 in 49 Minutes for $2

Related Stories