I'm not a cryptograhpy expert, I am a web developer trying to determine the origin of a Wordpress blog hack, and how likely it is that it was brute forced.
The administrator account username had been changed from the default "admin" and the password was, I believe, 8-10 characters comprising mixed case alphanumeric characters and symbols (the password has since been changed and extended in length).
Out of curiosity, I was looking at sites which supposedly estimate how long it would take to crack passwords. Supposedly:
- Length: 10 characters
- Character Combinations: 77
- Calculations Per Second: 4 billion
- Possible Combinations: 7 quintillion
58 years to crack
But what does this mean in real world terms?
The site seemed to have been hacked by a rival company with a terrible website and poor English, which I would guess originates from Eastern Europe, Africa or Asia (basically, not even a real rival but someone attempting to make business in the same industry). All they did was post 2 entries of poorly written content promoting their own site.
If it takes 58 years to brute force the password, it's obviously not feasible that the password was hacked with a brute force according to that estimate.
- How many calculations can one computer make?
- What kind of computing power does the average hacker have access to?
- How is a hacker able to leverage the use of multiple machines?
If a rival wanted to hack a website, how easy is it for someone with little experience to download and use tools to brute force a password? How easy is it to pay someone cheap money in a poorer country to perform the hack for you?
The bottom line here is I feel like a brute force attack on what is a fairly useless blog, in order to post fairly useless content which probably won't yield any return at all, is not very likely.
The problem is I don't know enough about the reality of brute force attacks, and how easy they are to perform. If it's something anyone can quickly and simply run, within a short amount of time, then it sounds possible that's what happened. Otherwise, I would like to be able to rule out a brute force attack and look at more likely options such as someone's machine being compromised with a key logger.