netmux History of Password Cracking
The appendix in the book contains a History of Password Cracking timeline, and this post is that timeline plus some lead up before 1979.
TL;DR
- 1965, CTSS prints the password file as the message of the day.
- 1971, Multics stops storing the password, which Tom Van Vleck did after Joe Weizenbaum told him not to.
- 1979, Unix
crypt(3), from Robert Morris and Ken Thompson, one-way and salted and slow on purpose. - Their paper calls the attack a key search. The tool that got everyone saying “crack” is Alec Muffett’s Crack, 1991.
- After that it’s John, L0phtCrack, hashcat, and the slow hashes (bcrypt, scrypt, Argon2) trying to limit those tools’ effectiveness.
WHY CALL IT CRACKING?
Ok so this bugs people, and it’s a fair question. If the password is hashed, you are not decrypting it, because there is no key that turns the hash back into the password.
Morris and Thompson, in the 1979 paper, call it a key search. You guess a password, run it through the same function, and compare, and that is the attack.
I don’t see them use “crack” for that, which shows up with Alec Muffett’s Crack in 1991, a wordlist plus rules against Unix passwords, and after that program the later tools kept the name: John the Ripper, L0phtCrack, and hashcat.
The word itself is older than all of them, though. Cracking a safe was a thing long before computers, and that is a part of why “crack” fit so well once the target was a password instead of a vault.
1965, CTSS
Before any of that, on CTSS at MIT in 1965, the password was just sitting in a file. Two users edited files in the same directory. The editor wrote temp files with one fixed name, and the password file got printed as the message of the day on a Friday at 4 p.m., until Bill Mathews froze the machine. Tom Van Vleck tells it better than I can, on his own site.
Tom Van Vleck, and the Multics security writeup.
1971, MULTICS
Joe Weizenbaum told Van Vleck not to store the password. Van Vleck put a one-way scrambler in during October 1971, and the listing is dated 30 October 1971.
The evaluation paper gives the steps, and they’re pretty simple:
- 8 character password. If it’s short, pad it with blanks.
- Drop the high-order two bits of each character. Multics ASCII was 9 bits for a 7-bit character, so 8 characters go from 72 bits down to 56.
- Multiply that by its own low-order 16 bits.
- Reduce modulo 10^19 - 1.
You store the result instead of the password, and Van Vleck later remembered it as squaring the password and throwing some bits away, which is the same idea.
On 21 May 1973 he changed scramble_() to call Roger Schell’s encipher_(). Schell was running the Air Force work to put real security on Multics, and the password goes in as both the key and the text.
Multics did this first, and Unix is the version everybody ended up copying.
1979, UNIX crypt(3)
Early Unix stored the passwords in plaintext in a file that was supposed to be locked down, but copies, backups, and one bad permission meant you had the passwords anyway.
Robert Morris Sr. swapped that for a simulation of the U.S. Army M-209, the WWII cipher machine. If you have the key, the M-209 is easy to run backwards, and finding the key when you know the plaintext and the ciphertext is the hard part, so he used the password as the key and encrypted a constant. That is the first Unix one-way scheme, roughly the Version 3 to Version 6 years, about 1973 to 1975.
Seventh Edition, 1979, is the version that stuck. Morris and Thompson dropped the M-209 code and used a modified DES:
- The password is cut at 8 characters, and those 8 characters are the 56-bit DES key.
- Encrypt a block of zeros 25 times, so each guess is slow on purpose.
- A 12-bit salt is grabbed off the clock and stored in the clear next to the hash, so the same password does not produce the same hash and a dictionary of precomputed hashes does not carry from one user to the next.
That function is crypt(3), and the paper is still the one I send people:
Password Security: A Case History. Robert Morris and Ken Thompson. Communications of the ACM, November 1979, Vol. 22, No. 11, pp. 594-597.
Read it. Robert Morris Sr.. Ken Thompson.
What they landed on is still what you want, which is to store a one-way function, salt it per user, and make each guess expensive. md5crypt, bcrypt, scrypt, and Argon2 are all people turning those same three knobs, and the dates below are when each of those hashes, and each password recovery tool, showed up.
THE TIMELINE
1987, LM hash. LAN Manager uses DES, forces the password to uppercase, and splits it into two 7-character halves, so a crack is two short halves instead of the whole password and LM stays fast.
1988, the Morris worm. Robert Tappan Morris, a Cornell grad student and the son of the Robert Morris who co-wrote crypt(3), wrote and released this worm. One way it spread was a built-in dictionary it tried against accounts, and it was the first time a lot of people saw password guessing running loose on the Internet.
1991, Crack. Alec Muffett wrote it as rules on a wordlist, aimed at Unix passwords, and this is the program I point at when someone asks where the word “crack” came from.
alecmuffett.com. @AlecMuffett.
1993, NTLM. Windows NT 3.1 stores an MD4 of the password, and that hash is still all over Active Directory.
1996, John the Ripper. Alexander Peslyak, Solar Designer, wrote one password recovery tool that would take whatever hash you actually pulled off a box.
1997, L0phtCrack. Christien Rioux (DilDog), Peiter Zatko (Mudge), and Chris Wysopal (Weld Pond) built it for LM and NTLM on Windows, so you didn’t have to stand up a Unix password recovery tool to go after a Windows hash.
l0phtcrack.gitlab.io. @WeldPond.
1999, bcrypt. Niels Provos and David Mazières built it on Blowfish with a cost factor, so when machines get faster you turn the cost up instead of inventing a new hash every few years.
2001, THC-Hydra. van Hauser, The Hacker’s Choice, wrote it for online guessing against logins (FTP, HTTP, SMB, and a long list), so you’re throwing passwords at a service instead of cracking an offline hash.
2001, Cain & Abel. Massimiliano Montoro, oxid.it, put sniff and crack on Windows in one program, and the site is gone, though if you did Windows work in that era you still remember the name.
2003, RainbowCrack. Zhu Shuanglei, using Philippe Oechslin’s time-memory tradeoff, so you pay the compute once and then look the hash up. A salt stops that from working, and since LM, NTLM, and raw MD5 don’t have one, this is the attack those hashes get.
2005, Medusa. JoMo-Kun at Foofus.net built it for online guessing that runs a lot of attempts in parallel.
2006, Ophcrack. Philippe Oechslin again, this time with rainbow tables on a live CD, so you didn’t have to build the tables yourself.
ophcrack.sourceforge.io. Objectif Sécurité.
2009, scrypt. Colin Percival wrote the first password hash that also costs you a pile of RAM, so a GPU or an ASIC can’t just throw arithmetic at it.
tarsnap.com/scrypt. @cperciva.
2009, hashcat. Jens Steube, atom, released oclHashcat as the GPU build in 2009.
hashcat.net. @hashcat. GitHub.
2009, RockYou. About 14 million real passwords out of that breach became rockyou.txt, and if you’ve cracked a hash you’ve started there.
2010, PasswordsCon. Per Thorsheim ran the first conference that was just about passwords, in Bergen, Norway.
passwordscon.org. @thorsheim is marked closed, and the bio there points at Bluesky and Mastodon.
2010, Crack Me If You Can. KoreLogic ran it at DEF CON 18, and team hashcat won the first one.
2011, mimikatz. Benjamin Delpy, gentilkiwi, wrote mimikatz to pull credentials out of memory, so on plenty of engagements you never crack a hash because the password is already there.
blog.gentilkiwi.com. @gentilkiwi. mimikatz.
2012, Responder. Laurent Gaffie released it as an LLMNR, NBT-NS, and mDNS poisoner that answers the name-resolution requests Windows throws around and catches the NTLMv1 and NTLMv2 hashes.
github.com/lgandx/Responder. @PythonResponder.
2012, 25 GPUs. Jeremi ‘epixoip’ Gosney measured about 350 billion NTLM guesses a second, which is what a fast hash looks like when you point a room of GPUs at it.
2013, PACK. Peter Kacherginsky, iphelix, wrote PACK to build masks and rules from passwords you’ve already cracked.
2015, Argon2. Alex Biryukov, Daniel Dinu, and Dmitry Khovratovich won the Password Hashing Competition with a memory-hard hash.
password-hashing.net. The spec.
2015, CrackMapExec. Marcello Salvati, byt3bl33d3r, wrote it to walk a bunch of Windows hosts and use the credential you’ve already got, which is another case where you don’t have to crack the password.
2015, hashcat goes open source. atom open sourced Hashcat and usage explodes making it the modern standard.
2023, NetExec. Pennyw0rth and the folks who picked it up kept CrackMapExec alive.