Is a $30,000 GPU Good at Password Cracking?

Compute energy is rising at a rare tempo. The AI surge has pushed huge funding in GPUs and specialised ‘accelerators’, with distributors constructing more and more highly effective {hardware} to coach giant language fashions.

For cybersecurity professionals, that raises an fascinating query. If the AI bubble cools and this {hardware} finally ends up sitting idle, may or not it’s repurposed for password cracking? And if that’s the case, does that imply passwords are about to grow to be out of date?

To discover that state of affairs, we in contrast two flagship AI accelerators, the Nvidia H200 and AMD MI300X, with Nvidia’s prime client GPU, the RTX 5090. The aim was easy: seeing whether or not a $30,000 AI GPU really has a bonus when cracking passwords.

Establishing the take a look at

The Specops analysis staff has beforehand revealed work analyzing how lengthy it takes attackers to brute-force hashed passwords. In separate checks of MD5, bcrypt and SHA-256, we measured how shortly every algorithm could possibly be cracked utilizing the identical {hardware}.

To see how GPUs influence this course of, we turned to Hashcat, one of the vital extensively used password restoration instruments. Hashcat contains benchmarking capabilities that present how shortly totally different {hardware} can compute password hashes.

This issues as a result of password cracking is finally a numbers recreation. The quicker a system can generate hashes, the quicker it could possibly take a look at password guesses till it finds the right one.

For this comparability, we checked out Hashcat benchmark outcomes for 5 generally encountered hashing algorithms:

• MD5
• NTLM
• bcrypt
• SHA-256
• SHA-512

These cowl the frequent algorithms present in a corporation’s Lively Listing, from older, quick hashes which are comparatively simple to brute pressure, by to trendy algorithms with far stronger cryptography.

That gives a practical base for our three high-end GPUs to face. These merchandise broadly occupy the same efficiency tier of their respective markets, making them helpful reference factors for evaluating enterprise AI {hardware} with client GPUs.

The GPU password cracking outcomes

What is instantly clear is that throughout each algorithm examined, the RTX 5090 outperforms each AI accelerators in uncooked hash era velocity. Throughout a number of capabilities, the RTX 5090 hashes passwords at nearly twice the velocity of the H200.

The value to efficiency comparability is putting. A single H200 is at the least ten occasions the worth of an RTX 5090, so that you would possibly fairly count on far higher efficiency from the AI accelerator in a one-to-one comparability. That merely isn’t the case.

Including to that is that again in 2017, IBM constructed a password-cracking rig utilizing eight Nvidia GTX 1080s, the flagship client GPU of the time.

That system achieved an NTLM hash cracking fee of 334 GH/s. In different phrases, a nine-year-old client GPU rig delivers comparable, or higher, efficiency in password cracking as at the moment’s flagship AI accelerators.

So, when answering the query, ‘is a $30,000 GPU good at password cracking?’, the reply is obvious: no.

The actual threat to organizations

Password cracking doesn’t require unique or specialised {hardware}. Skilled crackers and attackers have already got entry to all of the computing energy they should brute-force weak passwords. In our SHA-256 checks, a password utilizing numbers, higher and lowercase letters, and symbols could possibly be cracked in simply 21 hours.

That’s why implementing stronger passwords is important, and the best protection is size. A 15-character password utilizing the identical mixture of character sorts, hashed with SHA-256, would take round 167 billion years to crack, even with highly effective GPU {hardware}. At that time, brute-forcing merely isn’t a practical assault.

The larger threat is passwords which have already been uncovered in information breaches. This usually occurs by password reuse. You would possibly require staff to create lengthy, advanced Lively Listing passwords and retailer them securely.

However that safety disappears if the identical password is reused on private units, web sites, or functions with weaker safety controls.

If attackers can hyperlink uncovered credentials to a particular particular person, it’s usually easy to establish the place they work and try the identical password towards company accounts. There’s a complete underground market of preliminary entry brokers who concentrate on precisely the sort of intrusion.

This highlights the significance of getting instruments that may detect compromised passwords inside your group. Figuring out uncovered credentials early permits safety groups to reset accounts and block attackers earlier than these passwords are used to realize entry.

How Specops helps

Instruments like Specops Password Coverage assist right here in two essential methods:

• Granular password coverage administration: Our resolution permits safety groups to implement fine-grained password insurance policies nicely past these included in Lively Listing. This contains assist for passphrases, in addition to readymade compliance templates to make sure your group matches crucial requirements. Dynamic suggestions guides customers to create sturdy passwords they bear in mind however are troublesome to crack.
• Steady scanning for breached passwords: The Breached Password Safety characteristic constantly scans your Lively Listing towards a database of greater than 5 billion distinctive compromised passwords. Customizable messages alert customers if their password is compromised.

Finally, organizations shouldn’t depend on passwords as the one line of protection. Multi-factor authentication (MFA) offers a further barrier that protects accounts even when a password is ultimately recovered.

Specops Safe Entry delivers that extra layer of safety to Home windows Logon, RDP and VPN connections.

If you happen to’re desirous about seeing how Specops can assist harden your Lively Listing towards credential assaults, contact us at the moment.

Sponsored and written by Specops Software program.