The powerful processors in Sony's PlayStation 3 gaming console now have another use: cracking passwords.

New Zealand-based security researcher Nick Breese claims to have used the year-old gaming console to crack passwords at speeds 100 times greater than Intel hardware is capable of.

Breese, a security consultant with Security-Assessment.com, presented his findings to the Kiwicon hacker conference in Wellington, New Zealand.

"Suddenly we have a massive increase in terms of . . . cryptography cracking," he told Next. "Eight-character 'strong' passwords can be broken in a couple of days whereas before it would take weeks."

Speed is important to "brute force" password cracking, which relies on guessing all possible combinations of the characters that make up the password.

The accelerated technique means passwords protecting Office, PDF, ZIP and Lotus Notes ID files can be cracked with breathtaking speed. However, many other password types are handled more securely in software and remain unaffected by Breese's claimed speed increase.

"They're still safe. However, the gap has shrunk a hell of a lot," he says. "If you had access to a thousand PlayStations you could (still) crack an eight-character Linux password in a few days."

Breese's presentation comes just weeks after Russian company Elcomsoft claimed to have accelerated password cracking by a factor of 25 by using the processors found on PC graphics cards.

While expensive, specialist hardware has achieved these speeds already, the PlayStation 3's availability and low cost mean the use of the console for password cracking will become commonplace.

PlayStation 3 can also be used to break basic encryption schemes, Breese says, although widely used ciphers such as the 128-bit Secure Sockets Layer (SSL), used to protect online banking transactions, remain safe. "It'll speed up the attacks but I can't see that it's broken," he says. "(It) is still safe because the people implementing the ciphers foresaw CPU power rapidly increasing."

The gaming console is perfect for cracking passwords because the chips it uses are optimised to rapidly perform the calculations required to model 3-D environments. The computing techniques used to crack passwords are similar.

Breese hopes his research encourages software-makers to beef up their password security. "That's the reason I'm doing this," he says.


http://www.theage.com.au/