8-Character Windows NTLM Passwords Can Be Cracked In Under 2.5 Hours




Hashcat-logo

BeauHD posted in Slashdot: "HashCat, an open-source password recovery tool, can now crack an eight-character Windows NTLM password hash in less than 2.5 hours.

"Current password cracking benchmarks show that the minimum eight character password, no matter how complex, can be cracked in less than 2.5 hours" using a hardware rig that utilizes eight Nvidia GTX 2080Ti GPUs, explained a hacker who goes by the pseudonym Tinker on Twitter in a DM conversation with The Register. "The eight character password is dead." From the report: It's dead at least in the context of hacking attacks on organizations that rely on Windows and Active Directory.

NTLM is an old Microsoft authentication protocol that has since been replaced with Kerberos. According to Tinker, it's still used for storing Windows passwords locally or in the NTDS.dit file in Active Directory Domain Controllers.

Tinker estimates that buying the GPU power described would require about $10,000; others have claimed the necessary computer power to crack an eight-character NTLM password hash can be rented in Amazon's cloud for just $25.

NIST's latest guidelines say passwords should be at least eight characters long. Some online service providers don't even demand that much. When security researcher Troy Hunt examined the minimum password lengths at various websites last year, he found that while Google, Microsoft and Yahoo set the bar at eight, Facebook, LinkedIn and Twitter only required six.

Tinker said the eight character password was used as a benchmark because it's what many organizations recommend as the minimum password length and many corporate IT policies reflect that guidance. So how long is long enough to sleep soundly until the next technical advance changes everything?

Tinker recommends a random five-word passphrase, something along the lines of the four-word example popularized by online comic XKCD.That or whatever maximum length random password via a password management app, with two-factor authentication enabled in either case.

That is by the way exactly what KnowBe4's Chief Hacking Officer Kevin Mitnick has been saying for the last few years now. Train your employees to create a short passphrase that take years to crack.


Are your user’s passwords…P@ssw0rd?

? Bad guys are constantly coming out with new ways to hack your network while evading detection. KnowBe4’s complimentary Weak Password Test (WPT) checks your Active Directory for several different types of weak password related threats.

wpt02Here's how it works: 

checkmark Reports on the accounts that are affected

checkmark Tests against 10 types of weak password related threats

checkmark Does not show/report on the actual passwords of accounts

checkmark  Just download the install and run it  

checkmark  Results in a few minutes! 

This will take you 5 minutes and may give you some insights you never expected!

Check Your Passwords

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/weak-password-test

 
 

Topics: passwords

Subscribe To Our Blog


Ransomware Hostage Rescue Manual

Recent Posts




Get the latest about social engineering

Subscribe to CyberheistNews