1
$\begingroup$

I came across this article from 2 years ago: http://www.dailymail.co.uk/sciencetech/article-2331984/Think-strong-password-Hackers-crack-16-character-passwords-hour.html

They're describing how a team of "hackers" cracked passwords such as this "qeadzcwrsfxv1331" or this "Qbesancon321" in just a few hours. How is that even possible? I've seen before people describing passwords with 12 characters or more (16 in the above case) to take supposedly thousands of years to crack. What's going on in this case? Ok, so in this case the team had the hashed passwords available, but a 16 character password in a few hours?

Improve this question
$\endgroup$
1
  • $\begingroup$ Well, the former at least could be from guessing keyboard patterns. ​ (I don't immediately see such a pattern for the latter.) ​ ​ ​ ​ $\endgroup$
    – user991
    Nov 9, 2015 at 23:37

1 Answer 1

Reset to default
3
$\begingroup$

Like Ricky Demer suggested, qeadzcwrsfxv is a common finger pattern (similar to something like asdfghjk).

The second example falls in the pattern of: Take dictionary word (besancon is the name of a city), uppercase the first letter and add a couple of digits after it (usually 123, 321, 007 or a year like 1998). Then a couple of rule-based alterations are tried: add a random letter, change a letter to a symbol (e.g. s => $) and so on.

A third way one of these passwords could have been cracked is by them being reused from another hack (e.g. the user used a variation of the password he used from linkedin).

In short, humans are very predictable in how they generate passwords.

A truly random password looks like this: T8vWdvLGhpRi9Gb. No discernable words or patterns. Numbers, lowercase and capital letters properly mixed together. A password like this could only be broken by being reused on multiple websites or by being intercepted somehow.

Improve this answer
$\endgroup$
3
  • $\begingroup$ It would be interesting to know how the cracker(s) structured the generative algorithm so that it would try more likely and longer "human" patterns like those in the question before searching for harder passwords. Although this answer is IMO correct, I'm not sure how to begin to search against "decorated" patterns. Clearly there is less entropy, but every shortcut to take advantage of it is a gamble. $\endgroup$
    – Neil Slater
    Nov 10, 2015 at 11:46
  • 1
    $\begingroup$ @NeilSlater You can find an example of how different variations are tried on hashcat's rule-based attack page. Basically, a word (e.g. "besancon") and a rule (e.g. ^Q$1$2$3) are combined into a candidate password. It's also possible that a combinator attack was used and the dictionary happened to include "Q", "besancon" and "123". $\endgroup$
    – Daan Bakker
    Nov 10, 2015 at 17:08
  • $\begingroup$ @DaanBakker That makes more sense now. After having a closer look at that project, I found out that they did use a dictionary attack and also used a list of passwords from a previous hack. $\endgroup$
    – ItM
    Nov 10, 2015 at 18:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.