For a number of years I’ve been interested in the security provided by passwords, and the methods being developed to attack password-protected accounts. So I thought I’d see how successfully everyday developers, without specialist knowledge, could hack millions of passwords.

**Ethical Hacking: The real-world passwords used in this experiment were hacked and leaked online by an individual who is not myself. These passwords are now freely available online. Carrying out virtual attacks on leaked passwords like this enables us to educate individuals on the protection provided by their passwords, and can therefore help protect them from real attacks. Before carrying out my work I stripped all personally identifying information from the leaked file.**

People use passwords to protect virtually everything online: from emails to bank accounts, to crypto exchange accounts. While many sites now offer use of two factor authentication (‘2FA’), this often isn’t publicized or enforced, and a huge number of sites still don’t offer 2FA at all. The security passwords provide is therefore critical for protecting the population’s identity and money.

Naturally, the value stored behind passwords has motivated many attacks to be developed against them. There’s a huge number of research papers you can read about complex password cracking algorithms, which use intricate probability and machine learning techniques, and can crack over 90% of passwords.

While it’s scary how good these algorithms are, they don’t feel like a very realistic threat against the general population — how many people really know how to carry these attacks out? Why would they target me?! I decided therefore to take a look at a far more realistic attack: an attacker that knows how to create an AWS instance (or other cloud instance), and can run some open-source software on it.

If you already know about hashing of passwords please skip ‘Brief Background: Storing Passwords’. If you know about offline attacks against hashes please skip ‘Brief Background II: Attacking Hashes’.

Brief Background: Storing Passwords

When logging into a password-protected application, the sequence of events that appears to occur is the following:

1. User enters a password (which is transmitted for approval)
2. Entered password is compared to the password on record
3. Access granted if these match

However transmitting and storing passwords like this is incredibly insecure. For increased security, many systems (though sadly not all) actually store the ‘hash’ of users’ passwords in their database, and not the passwords themselves. You can think of the hash as an irreversible jumbling of the password; if an attacker discovers a password’s hash they cannot reverse the process to discover the password itself.

When a user enters their password in a system like this, the actual sequence of events is the following:

1. User enters password
2. Hash (password) is calculated locally and the hash is transmitted
3. The hash is compared to the hash on record
4. Access granted if these match

Brief Background II: Brute-forcing Hashes

In a system that uses hashing, if an attacker manages to get their hands on the password database, they still cannot see a user’s password. Attacks against such systems cannot reverse a hash to find the corresponding password, and therefore go as follows:

1. Guess a password
2. Calculate the hash of this guess
3. Compare this to the real hash
4. Repeat steps 1–3 until a match is found

This sounds pretty time consuming, however with a machine that can guess thousands of passwords in parallel, you can imagine things start to speed up.

The Attack

Software

The software I used is called Hashcat, which is an advanced password recovery tool, and is known as the “world’s fastest password cracker”. Hashcat is open-source, has sources and binaries downloadable from their website, and has an extensive wiki guide to the tool. It’s safe to say you don’t have to be a specialist to use it.

Hardware

I ran Hashcat on a Nvidia Tesla K80 — a GPU with 4992 cores that you can rent on AWS for $0.90 per hour (P2.xlarge). I started off by looking at the hashing capabilities of the K80, just to see how it fairs in comparison to a standard built-in laptop GPU.

The K80 came out 16 times faster than an average Intel graphics card. The K80 can calculate ~800 million SHA-256 hashes per second… that’s nearly 3 trillion per hour.

The passwords

As stated at the top, the passwords I ran my attack on were leaked by an attacker online. There were over 14 million passwords leaked in the attack, all of which was created by real-world users. I won’t provide a link to the passwords — there’s no need to share them unnecessarily — however I found them easily with a quick google search.

The logic of my attack

While Hashcat allows you to perform simple brute-force attacks (where you try every possible password of a specified length), they also have commands for slightly more complex attacks. It’s well known that most people base their password on a word, in various forms:

• Just a word (potentially with different capitalizations) — Password
• A word followed by some numbers/symbols — monkey! or Coffee12
• A word with ‘leet speak’ applied — p4ssw0rd or f4c3b00k
• Multiple words stuck together — isthissecure

And what a coincidence… if you can provide a list of words in a file, Hashcat has different modes built in, that can guess:

• Every word
• Every word with each possible number/symbol appended
• Every word with specified rule(s) applied (i.e. ‘replace every o with a 0’)
• Every combination of words stuck together

So I downloaded a dictionary file containing millions of English words to use in my attack.

From there you can then get a bit more generic, specifying ‘masks’ that Hashcat should try. This means instead of telling Hashcat to try ‘all passwords of length 8’ — which is 7 quadrillion different combinations — you can try every password that is ‘6 lowercase letters followed by 2 numbers’.

So how well did the attack do?

To be honest… it was far, far more successful than I had possibly imagined. Actually scarily successful…

• 2 hours: 48% of the passwords were cracked
• 8 hours: nearly 70% were cracked
• 20 hours: over 80% had been cracked

Call to action

Let me summarize.

20 hours. $0.90 per hour. That’s just $18. 80% of 14 million passwords cracked.

Let that sink in.

That’s scary. Really scary. People need to make their passwords more secure. Replacing ‘o’ with ‘0’ and ‘e’ with ‘3’ does not make your password secure. Adding numbers and symbols to the end of a word doesn’t either. It’s too predictable.

I’m not a security professional — I can’t give you rules that you can follow to make passwords unhackable. It was people following predictable rules that made these passwords so crackable. Be unpredictable. Or better yet, use a password manager like LastPass or 1Password to be unpredictable for you.

20 Hours, $18, and 11 Million Passwords Cracked was originally published in HackerNoon.com on Medium, where people are continuing the conversation by highlighting and responding to this story.

There’s a lot of discussion about blockchain at the moment, on many different platforms and from all industries. It has been hailed as a ‘quantum leap forward’, while others take a more negative view on what its impact will be; however the consensus is that its impact will be huge.

Despite all the attention that blockchain has been getting, there remains a large amount of confusion over what this ‘blockchain’ really is, and how it actually works. In this article I’ll answer each of the following questions:

• What is ‘blockchain’?
• How does blockchain actually work?
• Is blockchain the same thing as Bitcoin? (Hint: no)
• What are the different types of blockchain? How do they differ?
• Why do we care so much about blockchain?

What is ‘blockchain’?

It’s simple really: a blockchain is just a place where records are stored. For example, each record could be a monetary transaction — ‘Alice sent 3 coins to Bob’. The records are stored in such a way that they are ‘immutable’ — no one can maliciously edit them without being detected.

In most computer systems nowadays, records are stored in databases. These databases have rules outlining what information can be stored in each record, and further rules that specify the personnel and programs that are authorised to view and update the data stored. Blockchain works in the exact same way: there are rules laid out as to what information can be stored in each record, and then further rules specifying how this data is to be updated.

The two main differences between a blockchain and the ‘normal’ methods of data storage are:

• How the records are structured in storage, and
• The way that updates and additions to the data occur

These differences combined are what makes the records immutable — they will be explained below.

How does blockchain actually work?

The records in a blockchain are grouped into ‘blocks’. Each of the blocks holds some number, n, of records in the database. Every time n new records have been created, they are grouped together into a single block to be added as the newest block in the chain.

The way that these blocks are then chained together is using a special method called hashing. A function takes in a block, does some crazy merkle and hashing maths that you don’t need to understand just yet, and produces an output called a hash. It can be helpful to see this hash as a short summary of the block — changing the block even a tiny bit will change the hash that is produced. The hash of each block is then stored at the beginning of the next block in the chain. This effectively chains the blocks together, and means that no one can maliciously edit block x (as the hash of block x that’s stored at the beginning of block x+1 will no longer match up).

This data structure could be used to replace an existing database, allowing only a central company to add the updates to the end of the chain. For example, a bank could use a blockchain to store records of all monetary transactions to ensure the records cannot be changed. However, it is possible (and commonplace) to implement a blockchain in a ‘decentralised’ way, removing this central authority, and allowing the updates to be controlled by a larger group of individuals — thereby removing (at least some of) the power the central organisation holds.

The decentralised use of a blockchain can work as follows:

• A large group of individuals each store a copy of the blockchain
• Each new record to be added to the chain is broadcast to the group
• Once enough new records have been created, a group member proposes a new block, B, to the group
• Each member of the group separately decides whether B should be added to their copy of the blockchain. If a record within B is considered incorrect for any reason, then B can be rejected.
• If the majority of the group accept B, then it is added to the chain. If the majority of the group reject B, it is not.

The process of each group member checking the new block tends to be automated by a computer program that checks the validity of the block. For example, if ‘Alice sends 3 coins to Bob’ is a transaction within B, but Alice doesn’t own 3 coins, then the transaction is automatically noted as invalid and B is rejected.

This ‘group’ of individuals could be the entire network of individuals who use the system in question — or could be a smaller group. The larger the group, the more decentralised the network is considered.

Is there just one blockchain?

It is a common misunderstanding that blockchain=Bitcoin. That is when someone says ‘blockchain’, many people think of Bitcoin and are unaware as to what the difference is. Bitcoin is a currency, and it uses a blockchain to store the Bitcoin transactions that occur (every ‘record’ is a transaction e.g. ‘Alice sent 3 Bitcoin to Bob’). Within this blockchain, anyone in the world can choose to be a member of the group of individuals who keep the records up to date, thereby removing the need for a centralised banking authority.

The idea of blockchain was first published in the Bitcoin paper in 2008, and all other blockchains have stemmed from this moment, meaning that while Bitcoin may be the most famous application of blockchain in the world, it is certainly not the only one.

Are there different types of blockchain? How do they differ?

Since the first use of blockchain in 2008 in the launch of Bitcoin, blockchains have been used to track thousands of different items, on hundreds of different blockchains. These blockchains differ in many different ways, the most notable of which are:

• What’s being tracked on-chain — the ‘record’ system allows for any number of different items to be tracked on-chain. This could be real-life items such as your IKEA shipment, or digital items such as monetary transactions (Bitcoin) or execution of code (Ethereum).
• Private vs Public — who can see the blockchain? Is it available to anyone internationally? Or is it only viewable by a select group of people?
• Decentralisation — as mentioned previously, the size of the group who are authorised to update the data stored on the chain affects how decentralised the network is. This group could be one central individual/company who run and control the network, or as large as a network where anyone can take part in the decisions. Having a smaller group in control isn’t always a negative thing — it just depends on the situation in which is blockchain is being used.
• Consensus mechanism — the way in which agreement is reached within the network as to the exact order and contents of blocks being added to the chain. For example, if Alice and Bob both propose new blocks at the same time, the Consensus Mechanism of the network will outline rules to decide which block should be chosen.

Why do we care so much about blockchain?

The invention of blockchain brought something that has never before been possible to the world — a way of decentralising networks without a huge number of discrepancies or uncertainty as to what the current state of information is. This means that there is now the potential to remove the trusted and fee-collecting ‘middleman’ from a large number of everyday services such as banks, insurance firms and auction sites.

Blockchain-based systems are applicable anywhere information is recorded. However the immutability of blockchain records makes it especially powerful where that information is prone to hacks, fraud, or theft. Identity verification. Crowdfunding. Voting. Contractual agreements. These are just a few examples of industries in which companies are already developing new ways of doing business enhanced by blockchain technology.

Stay tuned for future posts that delve into some of the terms mentioned in this article and read about the projects at Token Foundry for more interesting examples of companies using blockchain.

0 to Blockchain in 5 minutes was originally published in tokenfoundry on Medium, where people are continuing the conversation by highlighting and responding to this story.