Register Log in

Risk Assessment / Security & Hacktivism

Company puts NVIDA GPUs to work cracking wireless security

NVIDIA wants to see more software developers using CUDA, but password-cracking …

There's a new application from Elcomsoft that explicitly uses NVIDIA development tools to work its magic, but the GPU manufacturer may be less than thrilled about it. NVIDIA's Compute Unified Device Architecture, or CUDA, is a set of development tools (including compiler) designed to simplify the task of coding for the company's GPU products. The toolset has been available since February, 2007, but NVIDIA has heavily emphasized CUDA throughout 2008, touting it as a development platform for the company's upcoming Tegra line of products, and as an important component of GPU software development. NVIDIA fully intends to continue developing top-end GPUs, but the company has broadened its market focus; CUDA, and the development of CUDA-enabled software are both major initiatives.

Elcomsoft's use for the language probably departs from the sorts of software development projects NVIDIA had in mind. A year ago, we covered Elcomsoft's work in GPU-assisted password cracking; now the company is ready to debut a shipping product along the same lines. Elcomsoft boasts that its new "Elcomsoft Distributed Password Recovery" software is quite a piece of work, and describes it thusly. "ElcomSoft patent-pending GPU acceleration technology implemented in Elcomsoft Distributed Password Recovery allows using laptop, desktop or server computers equipped with supported NVIDIA video cards to break WiFi encryption up to 100 times faster than by using CPU only."

The x-axis here presumably represents operations per second

The list of goodies continues. Elcomsoft supports (meaning, can crack) both WPA and WPA2 10 to 15 times faster when using a modest 8800M or 9800M GPU, and up to 100 times faster if you happen to have a GeForce GTX 280 handy. Elcomsoft, of course, envisions only legitimate uses for its software, stressing its applicability to government, forensic and corporate use. Hackers, of course, are not mentioned as a beneficiary, though it's possible that they just might glean some unspecified gain from such software.

Ironically, Elcomsoft then gives a brief security lecture on WEP, WPA, and WPA2. Tongue planted firmly in cheek, the company touts the benefits of WPA/WPA2 over WEP, before noting that CPU-driven brute-force attacks against the consumer-grade versions of these standards could take years. With GPU assistance, however, those years vanish into months, weeks, days, or even minutes depending on how many GPUs you have access to. Elcomsoft claims its Distributed Password Recovery software can retrieve passwords from a variety of sources, including:

  • NT LAN Manager (Microsoft authentication protocol)
  • Boot password recovery for all NT-based OSes
  • Windows Syskey startup passwords
  • Windows Domain Cached Credentials (DCC) passwords.
  • Unix user passwords
  • Oracle user passwords
  • Microsoft Office documents, including Word, PowerPoint, Project 2007, Excel, Money, and OneNote. All applicable versions of these applications from 1997-2007 can be
  • Various OpenDocument (ODF) filetypes, including documents, spreadsheets, and presentations
  • PGP zip archives, PGP with conventional encryption (.PGD), self-decrypting archives (.EXE), whole-disk encryption, and secret key rings

The above is simply a sampling; the full list of crackables is more exhaustive. Elcomsoft doesn't delve into the long-term implications of its own software package—the company is more interested in selling you a copy—but if its claims are true, the ability to suddenly crack existing encryption systems several orders of magnitude more quickly than was previously possible is a problem that must be addressed with a certain degree of urgency. There may be nothing new about the fact that increasing computational power eventually deprecates encryption methods that were once considered practically unbreakable, but such advances typically don't occur overnight. I haven't mathematically figured up the exact degree of difference, but imagine if Intel had introduced the 486 DX2-66 one week, and the Core 2 Duo at 3GHz the week after.

There's a certain short-term window of opportunity here for the quick-minded and well-padded hacker, but long term, software like Elcomsoft's could actually lead to the creation of better encryption standards. Cryptologists working on future standards (AES2, or what have you) will also be able to test those standards more quickly, and for far less money. It's safe to assume that NVIDIA will have introduced faster GPUs by this time, giving future developers an even greater advantage compared to what researchers have previously worked with. For the moment, Elcomsoft's software scales to "just" 64 CPU cores with four GPUs per node for a total of 256 GPUs, but this number will undoubtedly ramp as well. Short-term, this is less-than-great news for the security industry. Long-term, it might improve cryptology standards across the board.

Expand full story

You must to comment.

Need to register for a new account?

If you don't have an account yet it's free and easy.