Dec 202012
 

No password is safe from this new 25-GPU computer cluster

The setup uses 25 AMD Radeon graphics cards and can make 350 billion guesses per second. All eight-character passwords fall in hours; some take only six minutes.

 

C/NET
by Don Reisinger
December 10, 2012

Your really, really strong password just became a little bit easier to break.

Jeremi Gosney, founder and CEO of Stricture Consulting Group, a company that handles password-cracking, has unveiled a computer cluster boasting 25 AMD Radeon graphics cards. The cluster’s horsepower allows it to make 350 billion password guesses per second against the NT Lan Manager (NTLM) security protocol Microsoft has used in Windows Server since 2003.

Ars Technica was first to report on the cluster.

Speaking to Ars in an e-mailed statement, Gosney said that his company’s technology “can attack hashes approximately four times faster” than it previously could. Using a brute force method, the cluster is capable of guessing every single eight-character password containing letters, numbers, and symbols in 5.5 hours. If companies use LM, an earlier password option for Windows Server, the cluster can figure out a password in six minutes.

So, how does the cluster do it? According to Ars, the cluster is running Virtual OpenCL, a platform that makes the GPUs believe they’re all functioning together in a desktop computer. To actually crack a password, Gosney and his team uses a free password-cracker called ocl-Hashcat Plus.

Password security continues to be a major challenge for consumers, corporations, and online services. A so-called “strong” password, which in most cases wouldn’t be broken for days, if not weeks, is now easier and easier to crack with advanced tools. In other words, watch out and create as strong a password as possible.
Direct Link:  http://news.cnet.com/8301-1009_3-57558223-83/no-password-is-safe-from-this-new-25-gpu-computer-cluster/

Nov 052011
 

Security Tip of the Day: Turn On Encrypted Social-Media Connections
Nov 2, 2011
By SecurityNewsDaily Staff

Today’s tip: Turn on encrypted social-media connections
One year ago, it was easy for cyberspies to sit in cafes and snoop on other people’s social-networking posts. Today, Facebook, Twitter and Google+ all let you change your settings so that encrypted (“https”) connections are always on, locking out the creeps.

More tips:

Upgrade to Windows 7
If you’re running Windows XP on a computer that’s no more than 5 years old, you can probably upgrade to Windows 7, which is much more secure and elegant. Download the Windows 7 Upgrade Advisor here to be sure.

Don’t download pirated movies, music or software
Apart from the legal and moral issues involved, it’s not a good idea to download “warez” from the Web. You don’t know where that bootleg song, movie clip or copy of Photoshop came from, and it could easily be riddled with hidden malware.

Check the ATM vestibule before you enter it
Always look around the ATM vestibule as you step through the door. Creeps and muggers like to lurk in the corners. And while you’re at the machine, stay aware of anyone behind you; the rounded mirror atop some ATMs will help with that.

Don’t jailbreak your iPhone or iPad
Unless you really know what you’re doing, never “jailbreak” your Apple iOS device to run unauthorized apps. Doing so opens up your device to malware and exploits that a regularly configured iPhone or iPad user doesn’t have to worry about.

Don’t use public Wi-Fi networks
Unencrypted Wi-Fi networks in public places, such as parks or cafes, are prime hunting grounds for cyberthieves who silently monitor Facebook postings, email and online banking. And if you can find a free Wi-Fi network in an airport, it may have been set up by a scammer.

Check ATMs for skimmers
Crafty crooks make custom attachments that fit onto card slots in bank ATMs to capture your card’s magnetic-stripe data. Tiny pinhole cameras can film you typing in your PIN. Look over an ATM before you use it; if anything looks funny, let the bank know.

Keep your smartphone with you
You wouldn’t leave your computer unattended. Do the same with your smartphone. It’s a pocket computer, capable of doing nearly everything a laptop can — including giving whoever finds it a wealth of personal data. When you’re in a public place, take your smartphone with you when you step away from your seat.

Dedicate a PC to online banking
If your small business banks online, set aside a PC for only that purpose — no email, no Web browsing, no office work — and put heavy-duty anti-virus software on it. Cybercriminals know that small businesses don’t have IT departments to monitor online transactions, and banks don’t have to refund commercial customers if accounts are cleaned out.

Don’t use “off-brand” ATMs
That ATM in the supermarket or convenience store is handy, but who really controls it? Don’t use a stand-alone ATM unless you know the name of the bank it’s affiliated with — and especially avoid an ATM that’s parked out on the sidewalk, with a cable leading back into a store you’d never go into.

Upgrade your Adobe Flash Player
If you’re still running Adobe Flash Player 9 or earlier, upgrade it now. The browser plug-in, used for YouTube and online games, has a long history of malware exploits. Check which version you have here, and don’t download upgrades from anywhere other than the Adobe website.

Install anti-virus software on your Mac
Think Macs are immune from viruses? Far from it. There have been three major Trojans targeting Macs in the past six months, and Steve Jobs’ creations are just as susceptible to malware as are Windows machines.

Don’t give out your Social Security number
Does the doctor’s office want your Social Security number? Too bad. They don’t need it, and they should know better. Your Social Security number is the bedrock of your financial identity, and the only people who need it are you, your employer and the IRS.

Avoid suspicious smartphone apps
Steer clear of unofficial online stores offering cheaper versions of your favorite smartphone apps. Cybercriminals seed third-party websites with malicious apps that are loaded with malware. Stick to trusted app stores like the iTunes Store and the Android Market, and read the user comments to see if the app has a bad reputation.

Encrypt your USB flash drives
They’re cheap, they’re everywhere, they’re often given out for free. USB flash drives are also easily lost. If you have any flash drives containing information that you’d rather not strangers see, encrypt them with free or inexpensive encryption software.

Keep a low credit balance on your iTunes account
Account hijackings on iTunes are more common than you’d think. Hundreds of users have had their credit balances wiped out by scammers who racked up big charges on apps, movies and music. (In most cases, Apple has refunded the credit.)

Don’t post vacation photos until you get back
Facebook and Flickr are handy for relatives and friends to see your vacation photos. They’re also handy for burglars who check the date on each photo to see if you’re still away. Turn off auto-posting of photos on your smartphone, and wait until you’re back home to post those frisky beach snaps.

Lock your computer’s screen
When you step away from your desk, make sure no one can browse your machine. On a PC, hit the Windows key and “L” on the keyboard. On a Mac, go into System Preferences, then Security & Privacy, and check “Require password immediately after sleep or screen saver begins.” Put the Mac to sleep, or activate its screen saver, as you step away.

Don’t put your kids’ names on their backpacks
Embroidering “Timmy” or “Suzie” on a backpack just makes it easier for creeps and perverts to address your child by name at the bus stop. Your child already knows his or her own name; strangers don’t need to know as well.

Create a PIN lock for your voicemail
No passcode for your voicemail? Then anyone with phone-number “spoofing” software can call your carrier’s voicemail number and get right into your account. Enable the passcode, and don’t stick with the carrier’s default PIN, such as “1234″ or “9999″ — hacker and creeps already know those.

Put a screen lock on your smartphone
Your smartphone may be valuable, but even more valuable is all the personal information you’ve got on it. To make sure anyone who finds or steals it can’t see your data, enable the screen lock, which asks for a PIN or pattern before the phone can be used. (The phone can still be answered if it rings.)

Don’t write your address on your keychain
If you found a set of keys in the street with a tag that read “1313 Mockingbird Lane, Dubuque, Iowa” on it, you’d track down the owner, right? Not if you’re a thief. In that case, you’d go right to the house and rob it. Attach a cellphone number to your keys instead of an address — and don’t include your name.

Don’t re-use passwords
When you create a new online account, create a new password. That way, if a hacker or identity thief gets hold of the password to one of your accounts, he won’t have the password to all the other online accounts you have.

Enable wireless encryption
Most home wireless routers are set by default to transmit signals unencrypted. But that lets anyone snoop on your Internet traffic. Set your router to encrypt its transmissions, and pick a strong password so that only those machines you permit can access it.

Create a strong password
Passwords such as “1234″ are easy to remember, but they’re also easy to guess. Create a strong password by using a long word or phrase (at least eight characters) that’s not in the dictionary and mixing in capital letters, numbers and punctuation marks.  For example, “wassup dude” could become “wA55uPd00d3!” It would take a very long time to crack that.

Don’t “friend” people you don’t know
On social networking sites, it’s often tempting to expand your circle of acquaintances. But do you REALLY need to “friend” your cousin’s brother-in-law’s work buddy? People on your “friends” list have access to personal information about you that you might not want the world to see.  If you don’t really know them, don’t friend them.

Install anti-virus software on your smartphone
Every iPhone, BlackBerry, Android or Windows phone is actually a mini-computer, one that needs anti-virus software just as urgently as a regular PC. With both free and paid AV apps available for each platform, there’s no excuse not to get one.

Direct Link: http://www.securitynewsdaily.com/security-tips-of-the-day-1192/