Difference between revisions of "Brute force attack"
(Created page with "A '''''Brute Force Attack''''' also known as an '''''Exhaustive Search''''' is a method of cracking a password where every possible combination is tried. Because of this, brut...") |
|||
| Line 16: | Line 16: | ||
==Accelerating the Process== | ==Accelerating the Process== | ||
| − | In computer systems, passwords almost always allow the letters a-z, capital A-Z, numbers 0-9, and a host of special characters like !@#$%^&*. If we assume 100 possible characters, and the password is at most eight characters long, it means we will have to try 10,101,010,101,010, | + | In computer systems, passwords almost always allow the letters a-z, capital A-Z, numbers 0-9, and a host of special characters like !@#$%^&*. If we assume 100 possible characters, and the password is at most eight characters long, it means we will have to try 10,101,010,101,010,102 total passwords. If we assume our PC can try 1,000,000,000 passwords a second, it will take about 116 days to try every password, and for a nine-character-long password, it would take over 32 years! So, why do password crackers even bother with brute force attacks? Because there are several ways to accelerate the process. |
| − | === | + | ===Trying Common Characters First=== |
| − | Unless the system requires an assortment of characters like a capital letter, number, or symbol, most users don't bother with them. Because of this, a brute force system can be setup to | + | Unless the system requires an assortment of characters like a capital letter, number, or symbol, most users don't bother with them. Because of this, a brute force system can be setup to first try passwords made up of just the 26 lowercase letters, and if that fails, trying additional letters. This results in a first attempt requiring only 217,180,147,159 possible password, which, assuming 1,000,000,000 attempts can be made each second, would only take about 4 minutes, or about 1.6 hours for a nine-character-long password. |
| − | === | + | ===Faster Hardware=== |
| − | + | 1,000,000,000 passwords-a-second may seem impressive, but the latest hardware would increase that number significantly, and by taking advantage of multi-core processors and graphic cards, the time it takes to try every combination could be cut to 100th of the time. Specialized hardware has been made to crack passwords, and government or university super computers have also been used for the task, and they can process many times more. | |
| + | |||
| + | ===More Hardware=== | ||
| + | By separating the passwords that need to tried across multiple computers, you can divide the necessary time for each new computer. When spanned across 100 computers, a brute force will be completed 100 times faster. | ||
| + | |||
| + | ==Defenses== | ||
| + | |||
| + | |||
| + | ==Links== | ||
| + | * [https://en.wikipedia.org/wiki/Brute-force_attack en.wikipedia.org/wiki/Brute-force_attack] - Wikipedia. | ||
| + | |||
| + | |||
| + | [[Category: Cryptography]] | ||
Revision as of 17:06, 16 October 2017
A Brute Force Attack also known as an Exhaustive Search is a method of cracking a password where every possible combination is tried. Because of this, brute force attacks are always successful, however, they usually take so much time, they're not worth using.
A mechanical example of a brute force attack is trying every possible combination on a combination lock. This is a tedious process, as even a simple combination lock where the dial has only 30 places and the lock uses three numbers, would require 75 hours to check every combination if we assume it takes 10 seconds per attempt.
A similar system is used with password cracking on computers, where you first try password "a," then "b," and on to "z," then "aa," "ab," and so on. The number of passwords you need to try grows exponentially the longer the password gets.
Brute force attacks have legitimate uses, like when you've forgotten your password. However, they're mostly used for nefarious purposes.
Contents
Process
At its most basic level, a brute force attack is a three step process:
- Generate the next password.
- Try the password.
- If the password was not successful, go to step 1.
Step 2 is the most difficult step because many systems make it difficult to automate trying a password specifically to prevent brute force attacks.
Accelerating the Process
In computer systems, passwords almost always allow the letters a-z, capital A-Z, numbers 0-9, and a host of special characters like !@#$%^&*. If we assume 100 possible characters, and the password is at most eight characters long, it means we will have to try 10,101,010,101,010,102 total passwords. If we assume our PC can try 1,000,000,000 passwords a second, it will take about 116 days to try every password, and for a nine-character-long password, it would take over 32 years! So, why do password crackers even bother with brute force attacks? Because there are several ways to accelerate the process.
Trying Common Characters First
Unless the system requires an assortment of characters like a capital letter, number, or symbol, most users don't bother with them. Because of this, a brute force system can be setup to first try passwords made up of just the 26 lowercase letters, and if that fails, trying additional letters. This results in a first attempt requiring only 217,180,147,159 possible password, which, assuming 1,000,000,000 attempts can be made each second, would only take about 4 minutes, or about 1.6 hours for a nine-character-long password.
Faster Hardware
1,000,000,000 passwords-a-second may seem impressive, but the latest hardware would increase that number significantly, and by taking advantage of multi-core processors and graphic cards, the time it takes to try every combination could be cut to 100th of the time. Specialized hardware has been made to crack passwords, and government or university super computers have also been used for the task, and they can process many times more.
More Hardware
By separating the passwords that need to tried across multiple computers, you can divide the necessary time for each new computer. When spanned across 100 computers, a brute force will be completed 100 times faster.
Defenses
Links
- en.wikipedia.org/wiki/Brute-force_attack - Wikipedia.
