crack.sh

The World's Fastest DES Cracker

Menu

Skip to content
  • Home
  • Get Cracking
  • 100% Guarantee
  • The Technology
  • FAQ
  • Contact

The World’s Fastest DES Cracker

The World’s Fastest DES Cracker

In 1998 the Electronic Frontier Foundation built the EFF DES Cracker. It cost around $250,000 and involved making 1,856 custom chips and 29 circuit boards, all housed in 6 chassis, and took around 9 days to exhaust the keyspace. Today, with the advent of Field Programmable Gate Arrays (FPGAs), we’ve built a system with 48 Virtex-6 LX240Ts which can exhaust the keyspace in around 26 hours, and have provided it for the research community to use. Our hope is that this will better demonstrate the insecurity of DES and move people to adopt more secure modern encryption standards.

The Technology

Behind crack.sh is a system with 48 Xilinx Virtex-6 LX240T FPGAs. Each FPGA contains a design with 40 fully pipelined DES cores running at 400MHz for a total of 16,000,000,000 keys/sec per FPGA, or 768,000,000,000 keys/sec for the whole system. This means that it can exhaustively search the entire 56-bit DES keyspace in:


256 / 768,000,000,000 = ~26 hours
For comparison, the EFF DES Cracker had 29 boards x 64 chips each = 1,856 chips total, each chip did around 48,000,000 keys/sec for a total system speed of 90,000,000,000 keys/sec:


256 / 90,000,000,000 = ~9.2 days
To crack a key in the same amount of time as our system (26 hours) with other modern processors, you would need around:

80,000 CPU cores
~$125,000 per key
(at $0.12 per CPU on EC2)
1,800 GPUs
~$20,000 per key
(at $2.10 per GPU on EC2)

 

Time-Memory Tradeoff Free Jobs

We recently released support for running jobs with the plaintext of 1122334455667788 for FREE! We’re able to do this because we built one of the largest publicly available Rainbow Tables (Time-Memory Tradeoff Attack) for the entire DES keyspace (256). We are able to achieve an average crack time of 25 seconds and a success rate of 99.5%. If our system doesn’t crack your key immediately, it forwards the job on to our brute-force rig which will find the key within a couple days.

6.0TB of NVMe Storage
12 512GB Tables
     6 XCKU060 FPGAs
280 Billion links/sec

25 Seconds
99.5% Success Rate

Frequently Asked Questions

Why are FPGAs so much faster?
DES was originally designed to run in hardware as an ASIC so it's highly optimized toward using the minimal number of transistors. This is great for FPGA and ASIC implementations because it means it doesn't take much space on the chip to build a DES core and therefore we can fit many of them on each chip and run them at high speed. In turn, there is a lot of inefficiency trying to run DES on general purpose processors because most of the operations consist of bit permutations, lookups, and bitwise operations which even when highly optimized (through bitslicing, etc) still don't come close to the efficiency achieved by directly being implemented as transistors or LUTs (in the case of FPGAs).

Why are you charging so much money for this?
It actually isn't that expensive when compared to the cost of cracking DES in the cloud or with GPUs. The system that you're renting time on is over $100k in specialized FPGA hardware and costs money to operate, maintain, cool, and power and we're just charging enough to maintain the system and be able to offer it to the research community in a sustainable manner.

In that case, it's a great deal! How else can I help!
Please let us know what projects your working on! The main reason why this site exists is so we can see what else out there is still using DES and demonstrate to the community that it isn't secure anymore! You can also help out by presenting your research at one of the conferences that we organize :-).

What's the difference between the ASAP! and Take Your Time payment options?
We understand that some people are possibly using this service to perform security audits and require results a little quicker, for that reason we're offering an option to pay extra to get your job handled faster. In turn, many researchers use this service and aren't necessarily on tight deadlines and instead would like to save some money, for that reason we have a super low-cost option.

Why is it more expensive to crack a Known Plaintext job than MSCHAPv2?
Known Plaintext jobs take more time because we always have to go through 100% of the keyspace, whereas MSCHAPv2 only needs to go through ~70% of the keyspace on average before finding both K1 and K2 keys.

RECENT FEATURES

Free Cracking of Lanman/NTLMv1/MSCHAPv1
We just released support for cracking DES (using a rainbow table) for plaintexts of 1122334455667788. The system is able to crack these keys in 25 seconds worst case time (for the 2 keys).


“Cloud Cracker”, the former provider of this service, featured on Mr. Robot
If you watched Mr. Robot S2E9 you may have noticed the “CrackSIM” tool that Elliot uses to remotely update a victim’s SIM card with malicious firmware. The mysterious “Cloud Cracker” site that the key gets cracked on references cloudcracker.com, Moxie Marlinspike’s site which has been down for over a year now and used to offload it’s DES cracking capabilities to our system. Since the site has been down, we received requests from the community to bring a new service back online, and that is how https://crack.sh was born.

 

NTLM Challenge Response is 100% Broken
Shortly after Moxie Marlinspike and David Hulton gave their talk on cracking MS-CHAPv2 at Defcon in 2012, Mark Gamache discovered that LANMAN and NTLMv1 authentication is virtually the same as MS-CHAPv2 and further outlined the different cases where this method works for performing a 100% break of Windows Authentication.



Defeating PPTP VPNs and WPA2 Enterprise with MS-CHAPv2
At DefCon 20 researcher Moxie Marlinspike released a tool that reduces the handshake to a single DES (Data Encryption Standard) key which is sent to CloudCracker.com (now crack.sh), a FPGA password cracking service developed by David Hulton where it can be broken online in just under one day.

Site Map

  • Cracking des_crypt() Hashes
  • Cracking Kerberos5 DES
  • Cracking Known Plaintext DES
  • Cracking NETLM/NETNTLMv1 Authentication
  • Cracking NTLMv1 \w ESS/SSP
  • Cracking PPTP VPNs
  • Cracking WPA-Enterprise
  • The World’s Fastest DES Cracker
  • Get Cracking

Contact Us

100% Success Guarantee
Crack.sh guarantees that it will 100% produce a working key for jobs submitted. If for some reason a key isn't found, crack.sh will immediately refund your payment, fix any problem in its system that made it not find the key, and deliver the key to you once it's fixed. The service provided does a 100% search of the entire keyspace so it is guaranteed that if (a) key(s) exists, the system will find it. For standard DES cracking jobs (MSCHAPv2 and KPT) the system searches the entire 256 = 72,057,594,037,927,936 possible combinations. For des_crypt() jobs, crack.sh searches for all possible 8 character combinations (max size) of typeable characters from 0x20 (space) to 0x7e (~) and including the 0x0 (null) character to cover all possible lengths of passwords for a total keyspace of 968 = 7,213,895,789,838,336 possible combinations.

OFAC Disclaimer
Any data provided by ToorCon, Inc., to a user of the “crack.sh DES cracking service” is subject to United States export laws including but not limited to the United States Treasury Department’s Office of Foreign Assets Control (OFAC) regulations (31 Code of Federal Regulations Part 500). OFAC prohibits United States persons and companies and their foreign subsidiaries, from engaging in, facilitating, or approving, transactions by or with persons, companies, governments, government entities, government agencies, quasi government entities, or foreign nationals of, or from, countries embargoed by the United States, currently, Cuba, Iran, Syria, North Korea and Northern Sudan. All such activity is prohibited by United States law and such data cannot be transferred in any way to any person, company or entity in such an embargoed country. The user of this site acknowledges an understanding of this paragraph prior to use of the site, will abide by its terms, will not violate United States export law, directives, regulations or sanctions whether stated here or not; and acknowledges that it is not from a country currently embargoed, sanctioned, or prohibited in any way by the United States Government.

As a user, you further warrant that you are not listed on any United States Government maintained “denied list” including the Commerce Department's Denied Persons List, the Commerce Department's Entity List, the Directorate of Defense Trade Controls List of Statutorily Debarred Parties, or the Treasury Department's List of Specially Designated Nationals.

Any use, receipt, export, re-export or transfer of such data contrary to the above is a violation of United States law and is strictly prohibited by you as the user of this service

© Copyright 1999-2016 ToorCon, Inc. crack.sh is a service of the ToorCon Information Security Conference and is provided for research purposes only.