For $62.59, the 8 Character Password is Still Dead

Five years ago, we wrote a post called “The 8 Character Password is Dead,” which was an in-depth look at password cracking in 2017 and how eight-character passwords do not adequately protect organizations.

In that analysis, we broke down the math and how quickly hardware purchased for under $5,000 could make an eight-character length irrelevant. Unfortunately, in just five years’ time, the numbers have gotten worse while infrastructure to perform this testing has become much more readily available for both good and bad actors.

With the rise of cloud computing and subsequently individuals’ access to top-of-the-line computing equipment, the eight-character password ‘standard’ continues to provide little protection to organizations.

Demo time

See the last article for a more in-depth breakdown of the different types of password cracking but in summary, brute force password cracking starts at a given length with one character and increments through each item specified in the character set until all possible combinations have been reviewed. Parameters around what to test can be customized — including the character sets. Any combination of four complexity types can be used for cracking: uppercase letters, lowercase letters, numbers and symbols. However, these are the most common:

  1. Three of four complexity types as it is the Microsoft Windows default
  2. Four of four complexity types as it includes every possible character combination on a US keyboard

Below is a quick video example of using the new cloud capabilities on a “complex” encrypted eight-character password from a standard Windows Active Directory deployment. In this demonstration, we use only brute force techniques and no dictionary list (which is likely faster). Specifically, the second brute force type above (all possible characters) is used:

As you saw, we moved from nothing to cracked password in under three minutes. Any eight-character password would have been cracked in no more than eight hours and cost at most $62.59. As you can imagine, if an organization only requires three of the four complexity requirements, the number of possible combinations drops dramatically and it can cost as little as $2.45 to go through every uppercase, lowercase and number combination.

Real-world example

The application maintains a collection of many major password breaches and their associated hash values. Most popularly, the application allows users to search for their own passwords to determine if they’ve been included in a data breach. We downloaded the entire password list in the same hash format as standard corporate Active Directory environments (NTLM) and selected a ~1% sample or 6.6 million passwords.

Using this sample, within ten minutes, 4 million (61%) of the 6.6 million selected passwords cracked using the same system as above. Within an hour, 4.7 million (71%) passwords cracked. A short video version of this example can be seen here:

The new math

In our previous post, we outlined the capabilities of a system at the time that could be bought for under $5,000. We’ve updated our math to show what can now be achieved for under $8 an hour and with little to no setup. The results are astounding:

For $62.59 ($7.824 x 8 hours), any eight-character active directory password (uppercase, lowercase, number and symbol) can be cracked in AWS on the g4dn.metal instance type. Amazingly, $7.82 per hour allows guessing of as many as 230 billion passwords a second. Below is a screenshot showing live cracking of an eight-character password:

Note: Specific speeds and consistency of speeds may vary based on configuration over long periods of time

The solution

Passphrases. Increasing the length of passwords exponentially increases the difficulty and consequently, the time, to crack (see table above) a given password.

Using long passphrases that are easy to remember not only increases the security posture of the organization but also reduces the possibility of employees saving their passwords in a file or physically writing them down.

Now, more than ever, the eight-character password ‘standard’ is unacceptable. Increasing password length and mandating users use passphrases can dramatically increase any organization’s security posture.

Today its 62 dollars and 59 cents. It’s anyone’s guess how cheap it will be in five more years.

To learn more about our attack and penetration solutions, contact us.

Tom Stewart

Senior Director
Security and Privacy

Subscribe to Topics

End-to-end encrypted messaging options are widely available today. How do these solutions fit into corporate IT and security strategy? Protiviti's Ryan McCarthy shares with Information Week.

#ProtivitiTech #InformationWeek #encryption #security

Join #ProtivitiTech at @SAPinsider 2023! The conference is the must-attend #SAP end-user event of the year, where thousands of @SAP professionals from across the globe come together. Use code PROTIVITIVIP for a discounted rate of $1,899. Register now!

Discover the possibilities of designing QPUs for specific-use cases to boost #quantum speed when Protiviti’s @KonstantHacker dives into this approach with @amarchenkova after implementation at @bleximo led to remarkable results.


Join #ProtivitiTech and #Microsoft for an interactive webinar where our experts will discuss an overview of digital modernization, the benefits of migrating to Cloud SaaS, and how to approach upgrading your ERP.

#Dynamics365 #FinanceTransformation

Join #ProtivitiTech for our #DataPrivacyDay Webinar with @OneTrust for a deep dive and interactive Q&A on the upcoming US State laws set to go into effect in 2023 CPRA, CDPA, CPA, UCPA, and CTDPA. Register today!

Load More