In the previous entry in this series, we talked about how better word lists and better rules led to a renaissance in breaking passphrases (including WPA/WPA2 passphrases). It made the guesses more accurate, thus improving the hit rate before resorting to brute force.
However, technology also played a major factor in the renaissance as well through the use of graphics cards to offload the calculations. It used to be very expensive to get hardware accelerated password cracking technology, because the machines of the past were custom built for this purpose. Today, consumer grade graphics cards available from typical electronics stores are quite adept at this work, and thus an attacker could get massive increases in cracking power for very little money. That's because the work is very easily broken up so that it can be done in parallel. Consumer-grade 3D graphics cards have GPUs (Graphics Processing Units) which are also very good at performing large numbers of calculations in parallel, thus making them well suited for this work. In addition, several graphics cards working in concert can be installed on a single system making even greater speeds possible.
To give you an idea of the scale for what GPU acceleration has done, let’s first look at a generic desktop with no graphics acceleration. A general purpose CPU must perform a variety of tasks, and thus while it's quite capable of performing the calculations to test passphrases, it doesn't specialize in it. With all things being equal, in order to triple the number of password guesses per second, you would need to find a computer with triple the computing power. As you might surmise, it's not easy or cheap to get these types of improvements.
By using the GPU on the graphics card, a 10 fold increase in the number of passphrases per second over baseline became feasible. Thus, it became relatively cheap (high performance graphics cards typically cost on the order of $300 to $500 USD) to get extra performance on a significant order of magnitude.
In the last article, we talked about how optimizing the word lists and rules improved the accuracy for educated guesses. The addition of new technology made brute force more practical than ever. Combined, these improvements are very exciting, but there are still more pieces to the story: virtualization and cloud computing. I'll cover these techniques next.
With all of the excitement created with the addition of the GPU, there were still yet another set of improvements towards the password cracking efforts that were just around the corner: the use of virtualization and cloud computing. I’ll cover these techniques next week.