The NVIDIA GeForce RTX 4090 isn’t only great for gaming, but it also functions pretty well as a password cracker, according to a recent tweet from security researcher Sam Croley that offers insight on the GPU’s cryptography capabilities. Green team’s flagship Ada Lovelace option for gamers apparently provides twice the performance over the GeForce RTX 3090 for “nearly every algorithm,” an improvement that has prompted researchers to estimate that a system leveraging eight GeForce RTX 4090 graphics cards could crack any eight-character password in 48 minutes. NVIDIA’s GeForce RTX 4090, which the company has described as “beyond fast,” is available now starting at $1,599.
First @hashcat benchmarks on the new @nvidia RTX 4090! Coming in at an insane >2x uplift over the 3090 for nearly every algorithm. Easily capable of setting records: 300GH/s NTLM and 200kh/s bcrypt w/ OC! Thanks to blazer for the run. Full benchmarks here: https://t.co/Bftucib7P9 pic.twitter.com/KHV5yCUkV4
— Chick3nman 🐔 (@Chick3nman512) October 14, 2022
From a Tom’s Hardware report:
This is likely the result of Nvidia still investing a lot of its graphics chip design development to increase its performance on the data-center side. The RTX 4090 shone across the several attack types provided in the HashCat software: dictionary attacks, combinator attacks, mask attacks, rule-based attacks, and brute force attacks.
The researchers estimate that a purpose-built password hashing rig (pairing eight RTX 4090 GPUs) could crack an eight-character password in 48 minutes. According to Statista and from 2017 data, 8-character passwords are the most common among leaked passwords, commanding a 32% share of them. This doesn’t mean that they’re the least safe; it just very likely means that it’s the most common password character length. And they can now be taken out in under an hour by a “specialized” hashing rig.
Of course, that assumes that the password is as least eight characters long and that it follows the required conventions (at least one number and a special character included). When HashCat is driven to test the most commonly used passwords, however, it can bring a theoretical 48 minute cracking operation that attempted all 200 billion possible combinations down to the millisecond range.
Discussion (4 replies)
Join Discussion →This will of course be a problem for encrypted local files (like partitions or password databases etc.) unless access can somehow be forced theough th eapplication that created the encrypted file.
What I don't understand is why things like Fail2Ban or at least forced delays between retries aren't more common than they are.
Heck, by forcing even a single second between password retries you can all but eliminate the problem of brute force password attempts, and it is stupid simple to implement. It ought to be a requirement for all things that require a password.
THIS RIGHT HERE.
The issue is when they get a copy of the hashed user/password list, like the old passwd file on linux systems, or a database dump of the user table.
Yeah, the passwords are all hashed and crypto-whatevered, but you bypass all the other security features and can just run brute force on them all day long.
If you have the table with all of the passwords encrypted, you're not cracking every one. You're running them via a set of known ciphers to determin what the encryption key is, THEN you decrypt them all in mass. That's actually the bigger problem with simple passwords. That simple password is FAR easier to verfiy than what looks like a hash key as a password. THAT is why they don't want people using simple word passwords even if horseboatcarcat is harder for a machine to decrypt. It's about discovering the key that is the issue.