Concrete figures on password cracking in the wild

Question

While password guessing is a science, not every attacker out there is up-to-date with the latest advances or cares to invest in GPUs or FPGAs.

It's easy enough to test online password guessing attacks by opening a honeypot, and they mostly focus on trivial passwords and don't even target default passwords that much. But online guesses are quite different from offline guesses when a password database has been exposed.

Have there been studies or at least cases showing how strong a password has to be in order to resist guesses by run-of-the-mill attackers? How “sophisticated” does an attacker have to be to use tools such as John the Ripper?

APT and security researchers are outside the scope of this question.

(Context: is Jeff Atwood's assertion that strong passwords are useless because attackers will stick to the “low-hanging password fruit” realistic?)

Answer 1

There are essentially two types of attack: targeted attacks (APT, high value targets, personal attacks) and attacks of opportunity (low hanging fruit).

So, you're interested in offline attacks against leaked databases of passwords: the answer is that SOMEBODY will bother to put JTR, OCL Hashcat, or similar tools against that database. And that person/persons/group is looking to sell the retrieved credentials en masse to spammers, bank account hijackers, etc.

If you want an example: http://blogs.computerworld.com/20272/hackers_crowdsource_help_to_crack_nearly_6_5_million_leaked_linkedin_passwords http://nakedsecurity.sophos.com/2012/06/06/linkedin-confirms-hack-over-60-of-stolen-passwords-already-cracked/

After all, why else leak the password DB if you're not going to crack them?

Answer 2

Not every password leak is the same. The hash function used by the application and the application's password policy should dictate what tools you use to break the hashes. A good resource on this topic is Look Back on 2012′s Famous Password Hash Leaks – Wordlist, Analysis and New Cracking Techniques. In short, they where able to break the majority of password hashes using a blended approach.

If the application isn't salting passwords, or the salt is very small then a Rainbow Table is the tool of choice. Rainbow Tables are precomputed and freely available. This is the fastest method of exhausting a key-space (especially if you have a raid 0 array!). For these reasons a rainbow table is usually the first method of cracking if one can be used.

John the Ripper is able to work with wordlists and generate "leet speak" mutations on words. If a password is just a dictionary word or leet speak of a word, then John the Ripper can crack this hash. Unlike rainbow tables, John the Ripper can work accept the salt as an argument, which does not impede cracking.

If the application is using key stretching with bcrypt or pbkdf2, then an FPGA and GPU is almost worthless. In the 2012 leaked hash analysis, GPU's where able to crack about 48% of passwords, this is mainly because bcrypt and pbkdf2 are not commonly used.

... but in practice quantity isn't everything. I completely disagree with Jeff Atwood on this "low hanging fruit" approach. The account that is the most valuable is the administrative account, often there is only a single password hash that the attacker wants to break and they will do whatever they can to break this hash. As a penetration tester, breaking an administrative password hash is a great finding in a report and an excellent link in a chained attack.