Mass audit of passwords "one button"

Continuing to torment the hashes obtained from antichat (who needs them?) Did not refrain from creating a fast enough tool that automatically applies the methods discussed in the article . Now the video cards have already been used, and a smoke break was enough for the selection of 60% of passwords. With the speed of over 100 mpwd / s , the use of hybrid technology and frequency analysis, it does not seem surprising that, in general, it should finally force us to reconsider our attitude to the methods of storing passwords for those who still have not bothered with this. Below is a small discussion of the approach used and, of course, the program itself.

The basic idea is the same: trying to make good “pieces” of possible passwords, the concatenation of which will give a suitable password more likely than a random set of characters. Thus, it is possible to implicitly surrender to the algorithm all that we understand as the “human factor”.

Good "pieces" can be obtained by knowing part of the total number of passwords, choosing the most frequently used combinations of characters. In order to reveal the starting number of passwords, you can use brute force, dictionaries and hybrid dictionary attack.

Based on this, passwords like “QWEasdf1 $” should not be considered safe (large characters, small, numbers, special characters, sufficient length — everything seems to be great?), Because they are easily decomposed into a set of possible combinations of characters (QWE, asdf, 1, $ - only four meta characters.
')
Actually automation has been reduced to the following scheme:

• the program loads a list of hashes (a rather large set is assumed, this does not slow down the speed and increases the chances of the success of the scheme);
• there is a direct search for possible combinations (numeric passwords, symbolic characters of limited length, special characters in a small number);
• then dictionaries specified by the auditor are checked, including the concatenation of words from these dictionaries (so that you can quickly find combinations like “ihatethis”);
• the received passwords are divided into pieces, the probability of entry of each piece is considered, a “good” dictionary is compiled;
• the resulting dictionary is an endless search through possible combinations of words.

That is, besides a set of pre-prepared dictionaries and a list of hashes, you no longer need to know / change / tune anything - in fact, the “push to hack” scheme, about which there were a lot of jokes.

I wrote the program in one day, so I don’t expect it to be perfect stability and universality, whatever it works. CUDA technology and CUDA Utilities Toolkit technology are used to use video card power.

Download the sources from here: dl.dropbox.com/u/243445/md5h/src.7z
A Win32 binary is here: dl.dropbox.com/u/243445/md5h/MD5BLAST.exe
(You also need the cutil32 library and the CUDA Toolkit from developer.nvidia.com/cuda-toolkit-32-downloads#Windows )

To get started, you need to create a file hash_list.txt with a list of hashes.

Run the program, and passwords slowly appear in the file passwords.txt. I did not write any binding user-password-password, but is it really necessary?

If you are familiar with CUDA technology, it is possible for optimal performance to change the GRID and THREADS constants for your video card. In addition, with the current settings, the program requires up to 300 megabytes of free video memory (this value can be reduced using the ITERS constant).

I have about 100 megaparols per second on a GTX460 (with an average password length of 15 characters and hashes of about 10,000).