From 7c9133fc54cc01aa849bb02ad41948f48a984073 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Helder=20Magalh=C3=A3es?= Date: Mon, 21 Sep 2020 17:12:46 +0100 Subject: [PATCH 1/2] Update README.md Improved markdown (rework few
to \); Few typos fixed. --- README.md | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index bbeb149..b6a8b66 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ By means of a dictionary attack, BitCracker tries to find the correct User Passw ## Paper Several journals delayed the publication of our BitCracker paper (almost 3 years, with final rejection after several revisions) which explains the details of our attack, the BitLocker Drive Encryption (BDE) volume format and possible weaknesses in the encryption/decryption procedure. -Finally, we published the paper here: https://arxiv.org/abs/1901.01337 . Please feel free to comment and share. +Finally, we published the paper here: https://arxiv.org/abs/1901.01337. Please feel free to comment and share. ## Requirements @@ -27,7 +27,7 @@ Running the `build.sh` script generates 4 executables inside the `build` directo In order to build `bitcracker_cuda` coherently with your NVIDIA GPU and CUDA version, you need to modify the `src_CUDA/Makefile` chosing the correct SM version. As a reference, you can use the following table: -| GPU Architecture | Suggested CUDA | Makefile | +| GPU Architecture | Suggested CUDA | Makefile | | ---------------- | -------------- | -------------------------- | | Kepler | CUDA 7.5 | arch=compute_35,code=sm_35 | | Maxwell | CUDA 8.0 | arch=compute_52,code=sm_52 | @@ -91,11 +91,11 @@ Output file for recovery password attack: "hash_recv_pass.txt" You can use this type of attack if the storage device has been encrypted with an user supplied password as shown in the following image. ![alt text](http://openwall.info/wiki/_media/john/bitcracker_img1.png) -BitCracker performs a dictionary attack, thus you need to provide a wordlist of possibile user passwords. +BitCracker performs a dictionary attack, thus you need to provide a wordlist of possible user passwords. To start the attack you need: - the `hash_user_pass.txt` file -- a wordlist of possibile user passwords (you need to provide it by yourself) +- a wordlist of possible user passwords (you need to provide it by yourself) A command line example: @@ -168,9 +168,9 @@ As for the user password, BitCracker is able to perform a dictionary attack to f To start the attack you need: - the `hash_recv_pass.txt` file -- a wordlist of possibile recovery passwords +- a wordlist of possible recovery passwords -Generate and store all the possibile passwords it's an hard problem. For this reason, we created a Recovery Password generator named `bitcracker_rpgen`. With this tool you can create a bunch of Recovery Passwords wordlists you can use for your attacks. As an example: +Generate and store all the possible passwords it's an hard problem. For this reason, we created a Recovery Password generator named `bitcracker_rpgen`. With this tool you can create a bunch of Recovery Passwords wordlists you can use for your attacks. As an example: ```./build/bitcracker_rpgen -n 300 -p 10000000 -s 000000-000011-000022-000033-000044-000055-008459-015180``` @@ -203,8 +203,8 @@ The `-d` option enables the possibility to have duplicates in the same Recovery For all the available options, type `./build/bitcracker_rpgen -h`. -**NOTE:** Please note that the amount of possible Recovery Passwords is huge:
-`recovery password = 65536 x 65536 x 65536 x 65536 x 65536 x 65536 x 65536 x 65536`
+**NOTE:** Please note that the amount of possible Recovery Passwords is huge:\ +`recovery password = 65536 x 65536 x 65536 x 65536 x 65536 x 65536 x 65536 x 65536`\ According to our research, the password distribution is uniform and there is no way to find "more probable" numbers. So far, we didn't find a rule to reduce the amount of possible candidates. This means that the Recovery Password attack could take forever (the User Passwod attack is always the preferred one). Soon we'll modify the `bitcracker_rpgen` tool to generate Recovery Password in a casual way rather than in ordered sequence. A command line example: @@ -300,7 +300,7 @@ N.B. Each password requires about 2.097.152 SHA-256 ## John The Ripper We released BitCracker as the [OpenCL-BitLocker](http://openwall.info/wiki/john/OpenCL-BitLocker) format in [John The Ripper](https://github.com/magnumripper/JohnTheRipper) (`--format=bitlocker-opencl`). -The hash files generated by `bitcracker_hash` (see *How To* section) are fully compatible with the John format.
+The hash files generated by `bitcracker_hash` (see *How To* section) are fully compatible with the John format.\ On the GTV100 password rate is about 3150p/s. JtR team developed the CPU version of this attack (`--format=bitlocker`); on a CPU Intel(R) Xeon(R) v4 2.20GHz, password rate is about 78p/s. ## Hashcat @@ -309,7 +309,7 @@ This is a work in progress... ## Changelog -08/16 : New `bitcracker_rpgen` executable to generate wordlists of possible Recovery Passwords
+08/16 : New `bitcracker_rpgen` executable to generate wordlists of possible Recovery Passwords\ 06/14 : User Password attack mode now supports passwords length up to 55 #### What's next @@ -323,9 +323,8 @@ Plase share and test our project: we need your feedback! Special thanks to the John The Ripper team, [Dislocker](https://github.com/Aorimn/dislocker) and [LibBDE](https://github.com/libyal/libbde) projects. -This is a research project in collaboration with the National Research Council of Italy released under GPLv2 license.
-Copyright (C) 2013-2017 Elena Ago (elena dot ago at gmail dot com) and Massimo Bernaschi (massimo dot bernaschi at gmail dot com)
-We will provide some additional info about BitCracker's attack in a future paper. +This is a research project in collaboration with the National Research Council of Italy released under GPLv2 license.\ +Copyright (C) 2013-2017 Elena Ago (elena dot ago at gmail dot com) and Massimo Bernaschi (massimo dot bernaschi at gmail dot com)\ Although we use the GPLv2 licence, we are open to collaborations. -For any additional info, collaborations or bug report please contact us or open an issue +For any additional info, collaborations or bug report please contact us or open an issue. From 75b90096eee5dc72c11e421bb01fbb7481a045d2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Helder=20Magalh=C3=A3es?= Date: Mon, 21 Sep 2020 17:19:49 +0100 Subject: [PATCH 2/2] Update README.md Another typo. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index b6a8b66..9fb10a6 100644 --- a/README.md +++ b/README.md @@ -205,7 +205,7 @@ For all the available options, type `./build/bitcracker_rpgen -h`. **NOTE:** Please note that the amount of possible Recovery Passwords is huge:\ `recovery password = 65536 x 65536 x 65536 x 65536 x 65536 x 65536 x 65536 x 65536`\ -According to our research, the password distribution is uniform and there is no way to find "more probable" numbers. So far, we didn't find a rule to reduce the amount of possible candidates. This means that the Recovery Password attack could take forever (the User Passwod attack is always the preferred one). Soon we'll modify the `bitcracker_rpgen` tool to generate Recovery Password in a casual way rather than in ordered sequence. +According to our research, the password distribution is uniform and there is no way to find "more probable" numbers. So far, we didn't find a rule to reduce the amount of possible candidates. This means that the Recovery Password attack could take forever (the User Password attack is always the preferred one). Soon we'll modify the `bitcracker_rpgen` tool to generate Recovery Password in a casual way rather than in ordered sequence. A command line example: