1. Password Recovery
Solutions
Andrey Belenko
Security Researcher, CISSP
a.belenko@elcomso-.com

2. More
than
15
years
in
Password
Recovery
Agenda
 About us
 Types of passwords
 Hardware acceleration
 Distributed password recovery
 QQ passwords
 iPhone/iPod/iPad backup passwords

3. More
than
15
years
in
Password
Recovery
About us
 Established in 1990, privately held
 Based in Moscow, Russia
 Resellers worldwide
 Customers from Fortune 500, military and
governmental institutions
 Patent-pending technologies (GPU
acceleration, Thunder Tables)
 100+ file formats supported
h0p://www.elcomso-.com

4. Industry Certified and Acknowledged
 Microsoft Gold Certified Partner
 Intel Software Partner
 NVIDIA Registered Developer
 Member of the Association of
Shareware Professionals (ASP)
 Member of the Russian
Cryptology Association (RCA)

5. Password Protection Types
" Reversible passwords transformation
Instant recovery

6. Instant Recovery

7. Password Protection Types
" Reversible passwords transformation
Instant recovery
" One-way password transformation
Can reset password

8. Password Reset

9. Password Protection Types
" Reversible passwords transformation
Instant recovery
" One-way password transformation
Can reset password
" Encrypted documents
Break encryption
Guess password

10. Breaking Encryption

11. Password Guessing

12. Password Guessing

13. Problems
• «Salt»
– Rainbow tables don’t work
• Strong crypto
– Key search attacks not possible
• Iterated transformations
– Trying password takes longer
Key is to test smart and fast!

14. How to Increase Speed?
So-ware
• No
special
hardware
OpFmizaFon
• Limited
speedup
(10-­‐20%)
Special
• Convenient
to
use
Hardware
• Not
very
cost-­‐effecFve
Common
• Cost-­‐effecFve
Hardware
• Might
require
user
experFse
Distributed
• Scalable
compuFng
• Difficult
to
manage

15. Supported Hardware
GPU:
• NVIDIA GeForce
• NVIDIA Tesla
• ATI Radeon
• ATI FireStream

16. Supported Hardware
Tableau TACC1441 (FPGA)

17. Performance (WPA)
2x
TACC1441
29000
TACC1441
14500
HD5970
103000
GTX
480
30000
GTX
295
22000
Core
i7
920
4000
0
20000
40000
60000
80000
100000
120000
Passwords
per
Second

18. Distributed Password Recovery
Server
LAN
Controller
Internet/WAN
Workers

19. Distributed Password Recovery
• Needs little traffic and bandwidth
• Can work over LANs and WANs
• Scales (almost) linearly with number of
nodes
• Workers can join and leave
• Nodes can use hardware acceleration

20. QQ Passwords
• Password is not stored in clear
• QQ 2005 stores MD5 hash
• QQ 2009 stores encrypted MD5 hash
– Encryption key depends on hardware
• Can extract hash and run password
recovery
• Use any tool for cracking MD5
• Demo

21. iPhone Backup Passwords
• 100 millions iPhone/iPod touch/iPad sold
• iTunes backs up device regularly
• Backup contains lots of valuable info
– Contacts, call logs, SMS, e-mail accounts
– Photos
– Location history
– Application files (cleartext password)

22. iPhone Backup Passwords
• Device can encrypt backups
• Need original password to decrypt
• Not same as passcode!
Elcomsoft & Oxygen provide solution for
handling encrypted backups!

23. iPhone Password Breaker
• Supports iPhone/iPod touch/iPad backups
• Supports iOS 4 and iTunes 9.2
• Wordlist and bruteforce attacks
• Hardware acceleration with NVIDIA and
ATI GPUs and Tableau TACC1441
• Use Oxygen Forensic Suite to decrypt and
analyze

24. Thank You!