For the vast majority of us, Windows Task Manager provides all the required information regarding currently running processes, programs, services and network components, and gives a lot of flexibly and control over how you can handle these items. Though that doesn’t keep third-party alternatives from popping up every now and then, and the latest from the lot that we stumbled upon is LISTSP. I won’t really call it an effective replacement to the built-in Task Manager from Windows 8, but it does have a few nifty features that make it stand on its own, the first and foremost of which is the integrated search function that lets you instantly look for any running process or service.
LISTSP is an open-source application, and supports a very flat design that goes well with Windows 8. When launched, it presents similar tabs on top that you’d find in the stock Task Manager app. These include Processes, Services, Drivers and Network, and are pretty much self-explanatory. Each tab displays its relevant items and their pertaining information. For instance, Under Processes, you will see process names, status (running or stopped), PID, priority, memory usage, threshold and so on. The Drivers tab is something new though, and displays information regarding currently loaded drivers on your system related to the connected hardware components like sound, display, network adapters and the like.
LISTSP also lets you perform system power off actions such as shutdown, restart or hibernate, lock, standby and log off from within the app; simply click the Shutdown menu at the top, followed by your desired action from the list. The Search feature I mentioned earlier is probably the most useful bit of the app and since the default Task Manager lacks this option, you can use LISTSP instead for the purpose. It swiftly searches for the typed keyword or phrase in the list, and presents the matched results almost instantly. When you right-clicked an item from the list, the context menu allows you to perform further actions like end the process, change its priority, alter permissions and so on.
Apart from handling current processes, drivers and services, LISTSP also makes it possible to launch a few system tools. For instance, you can directly launch the Device Manager from within the program, which makes sense as you can easily check certain information regarding a driver before removing it under the Drivers tab. Other than that, you may also map a network drive, create a service for the selected process, open its related registry key, and more.
Although it looks quite barebone on the surface, LISTSP is a good app for quickly digging into details for a certain process or service. The app was tested on Windows 8 Pro, 64-bit.
The Pomegranates are not only fruits but also super foods packed with minerals, vitamins, and phytonutrients. Much research has been conducted on the pomegranate’s health benefits, and we are learning more and more about this fruit how it made our body healthy.
The pomegranate is also known as the Chinese Apple or the Granada, and it is well known for its juice and fruit. The origin of pomegranate is Persia and India. The pomegranate is grown in between the season of February and September. The growth of pomegranate is in warm climates. The size is similar to grapefruit and has a reddish color, and this includes essential nutrients.
The pomegranate has high amounts of vitamin C and also has other vitamins such as vitamin A, vitamin B5, and vitamin E. Additionally; it is packed with numerous minerals such as potassium, calcium, as well as iron that provide many health benefits of pomegranate. Pomegranate has many seeds within itself, which are full of fiber.
Pomegranate has three times more antioxidant features than any other antioxidant rich food; it consists of numerous polyphenol such as flavonoids, tannins, catechins, ellagic acid, and anthocyanins. These phytochemicals increase the ability of pomegranate fruits to decrease the effects of disease, aging, and tissue damage. This fruit with softball shape has high nutritional value with low calories.
The nutritional value of the pomegranates alone makes it an excellent source of every day nutrients, but also health benefits are even more remarkable. After drinking the juice of pomegranate or consuming the rise, you will be able to get a dose of anti carcinogens, cancer fighting, as well as anti-inflammatory rich food. The pomegranates promote flow of blood towards hearts, which also promote blood pressure and decrease the risk of heart attack, heart disease and stroke. Pomegranates improve the immune system by reducing viral infections as well as bacteria within the body.
After seeing all above-mentioned health benefits of pomegranate juice and fruit, now you should make this wonderful fruit a part of your diet.
Dell has come a long way with their Latitude series notebooks built for business mobility and the Latitude 6430u is one of their latest offering for people looking for a durable and manageable vPro-enabled Ultrabook.
While I didn’t use this notebook for business purposes so, this review is going to focus on the overall feel and experience of using it in a day-to-day basis away from an enterprise setup and its security which is one of the strengths of this machine.
Design
The Dell Latitude 6430u is a 14-inch business-class Ultrabook with an illusion of being slim due to its magnesium frame contrasting its black lid and underside. It measures just 20.9mm and weighs 3.7 lbs. making it lighter than your typical 14-incher.
Despite its sleek looks, this Ultrabook is feels sturdy and solid. In fact, it is the only one subjected to 16 MIL-STD-810G which is a range of tests done to measure its durability. The lid sports a rubbery matte finish making it immune to fingerprints and contributes to its ruggedly sexy looks. You can also see the LED indicator lights from the outside near the hinge.
On the left side of this notebook you’ll find the charging port, a full-sized VGA port, a USB 3.0 port, headset jack, and a hard switch for the WiFi squeezed in.
On the right side is the LAN port and a powered USB 3.0 port, and the SD card slot that is easily missed because it was set to deep.
Additional ports for HDMI and eSATA/USB combo can be found at the back on both sides of the vent. There’s no optical drive on this one which you probably won’t need anyway.
What’s nice here is that the battery slide can easily be removed and replaced to give it more juice on the go. It can also easily be equipped with 3G/4G mobile broadband if required.
Display
Opening the lid (which you can tilt all the way down) you will be greeted with the 14-inch screen with and its typical 1366 x 768 resolution. The anti-glare screen makes it easy to view under bright conditions or under the glare of office lights. Viewing angles is very average but it’s not that important for an office laptop where contents are usually private. What’s unusual though is that for a Windows 8 notebook, the screen lacks touch capabilities.
Keyboard
One of the things that can make or break a good business laptop is the keyboard experience. Keyboard layout on the Latitude 6430u is quite friendly to users having full-sized arrow keys and a dedicated button for Page Up and Page Dn so you don’t have to deal with the Fn key.
Typing experience is really good on this notebook with its evenly-spaced soft-touch keys that have nice and quiet tactile feedback. I had a pleasant time typing on it and didn’t have to adjust much switching to and from a regular desktop keyboard. The keyboard is also spill-proof and has a backlight you can switch on (Fn + Right arrow key).
On top of the keyboard are three highly-responsive soft buttons to control the sound. The Power button is at the center with the same LED indicator as the one on the lid beside it.
The touchpad reminds us of what the ThinkPad popularized having a pair of click buttons at the top and bottom of the pad. Having another pair of click buttons on top means only one thing, there’s a pointer nub on the keyboard. I guess Dell made it like this so that those coming from ThinkPad laptops won’t have to adjust much. The touchpad also accepts common Windows 8 multi-finger gestures by the way.
Performance
The configuration on the Latitude 6430u ranges from an Intel Core i3 up to a Core i7 processor. Ours come with a 1.8GHz dual-core 3rd Gen Intel Core i5 (3427u) processor, along with 8GB RAM, integrated Intel HD 4000 graphics, and 256GB SSD drive running on a 64-bit Windows 8 OS.
Here’s its Windows Experience Index if you’re curious.
With this set up, running from a cold boot takes about half a minute while waking from a sleep even with lots of applications and browser tabs opened is accomplished in just a few seconds. Business laptops are not meant for gaming but Intel has come a long way with their integrated graphics and with 8GB RAM, this notebook can handle Diablo III and the latest SCII expansion without a hitch even on medium-high settings.
Battery Life
The Latitde 6430u comes with a 6-cell (60Whr) Li-polymer battery. Dell claims that it can go up to 10 hours on a single charge but using it mainly for Word processing and browsing with WiFi always on and some music here and there, I was able to get 7 hours out of it before it started asking for the plug. Not bad at all and with the removable battery, it’s easy to stay connected for a couple of days away from the office.
Verdict
Dell still remains as a top choice when it comes to laptop for the office and the Latitude 6430u cements that choice further having a solid and reliable machine on a sleek-looking package. I love the heft and looks of this notebook, elegant but not too flashy and has the rugged feel to it.
The internals make it real fast for your daily needs and the keyboard is just a joy to use. Although the 3rd USB port at the back is a bit inaccessible for a laptop, you can easily use it for that wireless peripheral’s nano-receiver. Other than that, nothing to complain about the design really.
This configuration that we have retails for Php73,500 but if you can live with just 64GB SSD, that will bring down the cost to Php62,500. Contact your Dell supplier for other pricing configuration that would fit your company’s budget.
The Internet is full of all kind of multimedia content, and it would be fair to say that many of us spend a large chunk of our internet time surfing through YouTube and Spotify, when we’re not watching funny pictures on 9GAG, or stalking others on Facebook and Twitter. Put the social media stalking and funny pictures sites aside, the former two services are probably among the few best sources to stream music online but unfortunately, neither of the two offer a way to record or download your favorite tunes to your local drive for, let’s say, offline listening. So, how about recording the music while it’s being played in the background? Apowersoft Free Online Audio Recorder might come in handy for this. It’s a Java applet-based application that can record any type of audio being played, from both system sound and microphone inputs. Lets take a quick look.
To get started, make sure your system already has Java Runtime Environment (JRE) installed. You can grab it from the Java website, if you don’t have it already. Next, visit Free Online Audio Recorder’s website via the link provided at the end of the post, and hit the ‘Start Recording’ button.
If prompted by the JRE security pop up, simply click the Run button. You can also optionally check ‘Always trust content from this publisher’ to not get prompted by it when running the application again in the future.
You will now land on the application’s main interface, which looks simple, clean and intuitive. It carries Delete, Remove, Rename, Convert and Play buttons at the bottom. The Convert button basically opens up Apowersoft’s online audio converter, which lets you easily convert existing audio files into other formats. Any audio or sound recorded using the app appears in the list at the center. The first step is to select your audio source from where you want to record. The app supports audio inputs from microphone and system sounds, and you can switch between the available options from the Audio Input menu at the top. You may also specify the destination directory of your choice for the output file.
To record the sound, simply click the Start button at the top-left, which in turn displays the record timer along with a sound visualizer representing the current audio fidelity. The application also supports hotkeys to start (F6), stop (F7) and pause/resume (F10) the recording.
Another interesting bit we found is the tasks schedule feature that allows you to create custom schedules for automatically recording the audio at specified time(s).
The application also has a desktop version for Windows that costs $39.95. All in all, it’s an excellent tool for instantly recording sounds from multiple audio inputs. Testing was carried out on Windows 8 Pro, 64-bit.
In revealing the Xbox One, Microsoft needed to spend less time on this and more time on, um, video games.
The past week probably hasn't gone exactly as Microsoft had hoped. More than 8 million peoplewatched the reveal of the new Xbox One, but the general tone of the commentary from pundits and players in the days since has been overwhelmingly negative. Gamers on countless message boards and Twitter conversations are up in arms about the lack of demonstrated games, unsettled issues surrounding used games and DRM, and a host of other annoyances big and small. Mainstream columnists have focused on potential privacy concerns for the "always on" Kinect that has to be connected to the system. Investors have seemed largely unimpressed, sending Sony's stock surging while keeping Microsoft's level in the wake of the reveal.
Definitely not Microsoft's ideal start, but perhaps it's what the company should have been expecting given the odd, scattershot focus the Xbox One reveal took. Yes, Microsoft avoided Sony's mistakeoffailing to show the casing for the system, but it failed to emulate Sony's focus in presenting a bevy of technology demonstrations and playable live demos. Compare that to Microsoft's weak software showing: a few uninspiring seconds of generic, Forza car-porn; a confusing, unexplained TV/game hybrid from the creators of Alan Wake; and unfinished wireframe athletes from EA Sports. The only game to get significant time and attention at the Xbox One reveal was Activision's new Call of Duty: Ghosts. That reveal showed off the improved performance of the system, sure, but in an extremely predictable fashion. The display didn't seem in any way exclusive to the Xbox One (as opposed to Sony's exciting Killzone demonstration).
These short snippets of actual gaming were absolutely overwhelmed by talk of the Xbox One's non-gaming features. Microsoft led the hour-long presentation with almost 10 minutes on how the system could be used to easily watch live TV, as if being able to switch inputs without picking up a remote control was the killer app that would cause millions of people to rush out to spend hundreds of dollars on the console. (Oh, and a lot of those features only work in America anyway). Five more minutes were wasted on announcing a Halo television series that had nothing to do with the Xbox One. The series could have easily been announced as successfully through a YouTube video. Even more time was wasted on announcing a "historic" partnership with the NFL that pointedly avoided any concrete discussion of how that partnership would actually improve the couch potato experience in the slightest.
The post-reveal messaging has been just as unfocused, offering confusing, incomplete, or contradictory answers on a number of key questions. How will used games work on the system? Microsoft isn't saying. How often does the system need to connect to the Internet? "Every 24 hours" says Microsoft's Phil Harrison; "forget he said that" says Xbox PR. Should I worry about the Kinect being required and "always on"? No, we have great privacy protection that we aren't discussing in detail. Still not satisfied? Well, it turns out you can turn it off, but we won't have more details until later.
Will independent developers be able to self-publish on the system? No they won't, but, um, maybe they will. Why can't it record TV shows? Why don't we have more concrete information on hardware performance? Why aren't you talking more about the rumbling impulse triggers that are actually kind of cool?
Microsoft must have seen these questions coming. Further, they should have known that—in the absence of any interesting gaming announcements or interesting, next-generation hardware advances to discuss—the attention of the press and gamers would be fixated on the lack of concrete answers. Nebulous promises of "more information coming soon" only fan the flames and increase the pressure on Microsoft's new system.
It's enough to make you wonder what audience Microsoft was actually targeting with its Xbox One reveal strategy. Definitely not gamers, as the lack of game demos and concrete answers to important game-related questions should make clear. You could argue the company was targeting general media consumers, who might be drawn in by talk of integrated TV and Skype capabilities. But that audience seems unlikely to be closely following a console reveal event. Microsoft might have been trying to target investors and analysts with discussions of exclusive EA, Activision, and NFL deals, but if that was the case, the immediate jump in Sony's stock price makes that strategy seem like a failure.
No matter how much Microsoft is positioning the Xbox One as an all-in-one home entertainment center, it is still, at its heart, a game console. That's what makes it different from the smart TVs and Roku boxes and all the other lower-priced devices that can already hook up to your living room screen. And when you're introducing a game console, you really should lead with the games. When you don't, you get the kind of reaction Microsoft has gotten to the Xbox One—overwhelmingly characterized by anger and confusion rather than wonder and awe.
The silver lining for Microsoft in all of this is that there's a good chance this could all being forgotten in a few weeks. Microsoft's E3 showing will doubtlessly focus more on games, including a promised 15 exclusive titles. That event could do a lot to take attention away from the incidental issues that have dominated the conversation thus far. But you only get one chance at a first impression, as the saying goes, and Microsoft wasted it. The Xbox One reveal was the functional equivalent of a throat-clearing, highlighting incidental features rather than those that will be driving the purchasing decisions of the console's core audience.
Sony just announced their latest LTE handset, the Sony Xperia SP set to be available by the end of the month for Php19,990. It joins Sony’s list of LTE-capable handsets which include the Sony Xperia V, Xperia Z, and Xperia ZL.
With Sony’s mobile design expertise, the Xperia SP is yet again a beautiful phone with a premium design. It has a precision-crafted co-moulded aluminum frame for a seamless look that is both sleek and solid. It also has this cool color-changing “transparent element” with illuminations you can customize whenever you get an alert, incoming calls, or even when you’re just playing your music.
The Xperia SP has a stunning 4.6” HD Reality Display with Sony’s latest Mobile Bravia Engine 2 for sharp visuals with superior brightness. The engine makes adjustment to the picture by adding new real-time contrast optimisation to the sharpness enhancement, high-quality color management and noise reduction. Same as what the Bravia TV does.
Powering the Xperia SP is a 1.7GHz dual-core Snapdragon Krait processor with 1GB RAM and 8GB internal storage to go with a microSD slot.
This LTE handset boasts of a fast 8-megapixel camera with HDR and Sony’s Exmor RS for mobile camera technology that allows you to shoot bright photos even under low-light conditions. Front camera is limited to a VGA resolution only though.
Battery on the Sony Xperia SP is rated at 2370mAh. This handset will be available by the end of May in black and white colors for Php19,990.
Sony Xperia SP Specs:
4.6-inch 720 x 1280 HD resolution touchscreen, 319 ppi
It can often be quite hard to think of the online world as a physical entity. For one thing, it isn’t tangible, but it’s still eerie how holding up a ruler to measure something on your screen can blur that distinction momentarily. This, by the way, brings me to an old bone I’ve had to pick with Windows for some time now; how come we don’t have a native solution to onscreen measurement? Holding out your thumb or fingers just isn’t feasible when you want to quantify a window’s dimensions or calibrate the distance between two objects. Well, you could try ScreenRuler to give you some sense of onscreen scale. Let’s find out more about this helpful little utility after the jump.
ScreenRuler is a portable app and doesn’t require installation; just extract the contents of the downloaded zip file and run the EXE file. The ruler appears immediately on top of any files or documents you have open.
The tool can be dragged around and placed next to items on the screen to get a sense of scale, or take an exact measurement in pixels. Right-clicking the ruler will bring down a context menu with more options. The same context menu can also be accessed by right-clicking the system tray icon of the app. ScreenRuler can be switched from horizontal to vertical orientation, making it possible to measure the breadth of a picture, or your screen’s display. Clicking ‘Center on Screen’ once will immediately bring the ruler, whether horizontal or vertical, to the middle of your screen.
Stationery is fun only when it’s customizable, and ScreenRuler takes account of that. You can change the on-screen ruler’s color at a moment’s whim, and even switch from an almost transparent ruler to a thick, opaque one for measuring items with too bright a background, under ‘Color…’ and ‘Opacity’ respectively. Here’s a screenshot of my ruler colored purple and at 100% opacity.
There are times when you want to keep the ruler on top of every other window you open. To do so, make sure you have the ‘Always On Top’ option checked.
ScreenRuler is very simple and a pleasure to use, but it does have a few noticeable shortcomings. For one thing, the program isn’t clear about what scale it’s using. While it may be obvious to many that it’s pixels, many casual users might not figure it themselves. There’s also no magnifying option, like the Tape Chrome Extension offers, so you might not be able to align the ruler next to an object accurately. You can get more than one ruler at a time by launching the EXE file multiple times, but there’s no way to snap or otherwise connect the rulers together. Still, despite these omissions, ScreenRuler is a fun, handy application that comes into its own when you want a quick, no-fuss sense of scale or pixel measurement without an over-riding concern for precision.
ScreenRuler is available for all versions of Windows OS, and was tested on Windows 8 Pro.
Windows requires an active internet connection in order to notify you about important updates from time to time via the built in Update utility. Even though you can set different parameters regarding how updates should be downloaded and installed i.e. automatically or manually, Windows doesn’t allow you to store an update’s installation package to an offline storage, which could come handy to reinstall updates on a fresh Windows build, or to update multiple computers without requiring to re-download each update file on each machine, especially those gargantuan service packs. This is where applications likePortable Update jump into the game. It’s a small portable program that allows you to download and save updates to an external drive, and then use the included update utility to install them on another computer.
Portable Update downloads and stores updates in its cache folder, which is automatically placed on the USB drive on which you’ll be storing and running the program. Once the updates are copied to this folder, you can use the integrated update feature – which basically uses Windows Update API – to install them to any Windows system you want. Lets find out how it works.
To start off, download the ZIP file via the link at the end of this post, and extract its contents to a portable drive. Once launched, the application asks you to download some additional Windows files require to run the program; simply click Yes to let it download them. You can also click the Start button at the top-right to perform the said task.
After downloading the necessary files, the application takes you to its main interface, which carries multiple tabs at the top named History, Search, Download, Install, Services, Settings and Log. The History tab displays a lists of updates already installed on your machine.
The first step is to click the Start button under the Search tab, which makes the tool look for the available update files. This may take anywhere from a few to several minutes depending on how many updates are available. Once examined, Portable Update displays the total number of updates found.
In addition, the list of updates automatically appears under the Search and Download tabs. The next step is to download and install these updates. All you have to do is click the Start button under each tab to get it done. Just connect the USB drive on the target computer when installing updates. The application lets you choose which update files you’d like to download and install by marking them in the list. In addition, Portable Update also lists the services available to run the update process under the Services tab.
The application works on all Windows versions from Windows XP and upwards. Testing was carried out on Windows 8 Pro, 64-bit
Thanks to the XKCD comic, every password cracking word list in the world probably has correcthorsebatterystaple in it already.
In March, readers followed along as Nate Anderson, Ars deputy editor and a self-admitted newbie to password cracking, downloaded a list of more than 16,000 cryptographically hashed passwords. Within a few hours, he deciphered almost half of them. The moral of the story: if a reporter with zero training in the ancient art of password cracking can achieve such results, imagine what more seasoned attackers can do.
Imagine no more. We asked three cracking experts to attack the same list Anderson targeted and recount the results in all their color and technical detail Iron Chef style. The results, to say the least, were eye opening because they show how quickly even long passwords with letters, numbers, and symbols can be discovered.
The list contained 16,449 passwords converted into hashes using the MD5 cryptographic hash function. Security-conscious websites never store passwords in plaintext. Instead, they work only with these so-called one-way hashes, which are incapable of being mathematically converted back into the letters, numbers, and symbols originally chosen by the user. In the event of a security breach that exposes the password data, an attacker still must painstakingly guess the plaintext for each hash—for instance, they must guess that "5f4dcc3b5aa765d61d8327deb882cf99" and "7c6a180b36896a0a8c02787eeafb0e4c" are the MD5 hashes for "password" and "password1" respectively. (For more details on password hashing, see the earlier Ars feature "Why passwords have never been weaker—and crackers have never been stronger.")
While Anderson's 47-percent success rate is impressive, it's miniscule when compared to what real crackers can do, as Anderson himself made clear. To prove the point, we gave them the same list and watched over their shoulders as they tore it to shreds. To put it mildly, they didn't disappoint. Even the least successful cracker of our trio—who used the least amount of hardware, devoted only one hour, used a tiny word list, and conducted an interview throughout the process—was able to decipher 62 percent of the passwords. Our top cracker snagged 90 percent of them.
The Ars password team included a developer of cracking software, a security consultant, and an anonymous cracker. The most thorough of the three cracks was carried out by Jeremi Gosney, a password expert with Stricture Consulting Group. Using a commodity computer with a single AMD Radeon 7970 graphics card, it took him 20 hours to crack 14,734 of the hashes, a 90-percent success rate. Jens Steube, the lead developer behind oclHashcat-plus, achieved impressive results as well. (oclHashcat-plus is the freely available password-cracking software both Anderson and all crackers in this article used.) Steube unscrambled 13,486 hashes (82 percent) in a little more than one hour, using a slightly more powerful machine that contained two AMD Radeon 6990 graphics cards. A third cracker who goes by the moniker radix deciphered 62 percent of the hashes using a computer with a single 7970 card—also in about one hour. And he probably would have cracked more had he not been peppered with questions throughout the exercise.
The list of "plains," as many crackers refer to deciphered hashes, contains the usual list of commonly used passcodes that are found in virtually every breach involving consumer websites. "123456," "1234567," and "password" are there, as is "letmein," "Destiny21," and "pizzapizza." Passwords of this ilk are hopelessly weak. Despite the additional tweaking, "p@$$word," "123456789j," "letmein1!," and "LETMEin3" are equally awful. But sprinkled among the overused and easily cracked passcodes in the leaked list are some that many readers might assume are relatively secure. ":LOL1313le" is in there, as are "Coneyisland9/," "momof3g8kids," "1368555av," "n3xtb1gth1ng," "qeadzcwrsfxv1331," "m27bufford," "J21.redskin," "Garrett1993*," and "Oscar+emmy2."
A screenshot showing a small sampling of cracked passwords.
As big as the word lists that all three crackers in this article wielded—close to 1 billion strong in the case of Gosney and Steube—none of them contained "Coneyisland9/," "momof3g8kids," or the more than 10,000 other plains that were revealed with just a few hours of effort. So how did they do it? The short answer boils down to two variables: the website's unfortunate and irresponsible use of MD5 and the use of non-randomized passwords by the account holders.
Life in the fast lane
"These are terrible passwords," radix, who declined to give his real name, told Ars just a few minutes into run one of his hour-long cracking session. "There's probably not a complexity requirement for them. The hashing alone being MD5 tells me that they really don't care about their passwords too much, so it's probably some pre-generated site."
Like SHA1, SHA3, and most other algorithms, MD5 was designed to convert plaintext into hashes, also known as "message digests," quickly and with a minimal amount of computation. That works in the favor of crackers. Armed with a single graphics processor, they can cycle through more than eight billion password combinations each second when attacking "fast" hashes. By contrast, algorithms specifically designed to protect passwords require significantly more time and computation. For instance, the SHA512crypt function included by default in Mac OS X and most Unix-based operating systems passes text through 5,000 hashing iterations. This hurdle would limit the same one-GPU cracking system to slightly less than 2,000 guesses per second. Examples of other similarly "slow" hashing algorithms include bcrypt, scrypt, and PBKDF2.
The other variable was the account holders' decision to use memorable words. The characteristics that made "momof3g8kids" and "Oscar+emmy2" easy to remember are precisely the things that allowed them to be cracked. Their basic components—"mom," "kids," "oscar," "emmy," and numbers—are a core part of even basic password-cracking lists. The increasing power of hardware and specialized software makes it trivial for crackers to combine these ingredients in literally billions of slightly different permutations. Unless the user takes great care, passwords that are easy to remember are sitting ducks in the hands of crackers.
What's more, like the other two crackers profiled in this article, radix didn't know where the password list was taken from, eliminating one of the key techniques crackers use when deciphering leaked hashes. "If I knew the site, I would go there and find out what the requirements are," he said. The information would have allowed radix to craft custom rule sets targeted at the specific hashes he was trying to crack.
Anatomy of a crack
The longer answer to how these relatively stronger passwords were revealed requires comparing and contrasting the approaches of the three crackers. Because their equipment and the amount of time they devoted to the exercise differed, readers shouldn't assume one cracker's technique was superior to those of the others. That said, all three cracks resembled video games where each successive level is considerably harder than the last. The first stage of each attack typically cracked in excess of 50 percent of the hashes, with each stage that came later cracking smaller and smaller percentages. By the time they got to the latest rounds, they considered themselves lucky to get more than a few hundred plains.
True to that pattern, Gosney's first stage cracked 10,233 hashes, or 62 percent of the leaked list, in just 16 minutes. It started with a brute-force crack for all passwords containing one to six characters, meaning his computer tried every possible combination starting with "a" and ending with "//////." Because guesses have a maximum length of six and are comprised of 95 characters—that's 26 lower-case letters, 26 upper-case letters, 10 digits, and 33 symbols—there are a manageable number of total guesses. This is calculated by adding the sum of 956 + 955 + 954 + 953 + 952 + 95. It took him just two minutes and 32 seconds to complete the round, and it yielded the first 1,316 plains of the exercise.
Beyond a length of six, however, Gosney was highly selective about the types of brute-force attacks he tried. That's because of the exponentially increasing number of guesses each additional character creates. While it took only hours to brute-force all passwords from one to six characters, it would have taken Gosney days, weeks, or even years to brute-force longer passwords. Robert Graham, the CEO of Errata Security who has calculated the requirements, refers to this limitation as the "exponential wall of brute-force cracking."
Brute-force cracks work well against shorter passwords. The technique can take days or months for longer passcodes, even when using Amazon's cloud-based EC2 service.
Recognizing these limits, Gosney next brute-force cracked all passwords of length seven or eight that contained only lower letters. That significantly reduced the time required and still cracked 1,618 hashes. He tried all passwords of length seven or eight that contained only upper letters to reveal another 708 plains. Because their "keyspace" was the sum of 268 + 267, each of these steps was completed in 41 seconds. Next, he brute-forced all passwords made up solely of numbers from one to 12 digits long. It cracked 312 passcodes and took him three minutes and 21 seconds.
It was only then that Gosney turned to his word lists, which he has spent years fine tuning. Augmenting the lists with the "best64" rule set built into Hashcat, he was able to crack 6,228 hashes in just nine minutes and four seconds. To complete stage one, he ran all the plains he had just captured in the previous rounds through a different rule set known as "d3ad0ne" (named after its creator who is a recognized password expert). It took one second to complete and revealed 51 more plains.
"Normally I start by brute-forcing all characters from length one to length six because even on a single GPU, this attack completes nearly instantly with fast hashes," Gosney explained in an e-mail. He continued:
And because I can brute-force this really quickly, I have all of my wordlists filtered to only include words that are at least six chars long. This helps to save disk space and also speeds up wordlist-based attacks. Same thing with digits. I can just brute-force numerical passwords very quickly, so there are no digits in any of my wordlists. Then I go straight to my wordlists + best64.rule since those are the most probable patterns, and larger rule sets take much longer to run. Our goal is to find the most plains in the least amount of time, so we want to find as much low-hanging fruit as possible first.
Cracking the weakest passwords first is especially helpful when hashes contain cryptographic salt. Originally devised to thwart rainbow tables and other types of precomputed techniques, salting appends random characters to each password before it is hashed. Besides defeating rainbow tables, salting slows down brute-force and dictionary attacks because hashes must be cracked one at a time rather than all of them at once.
But the thing about salting is this: it slows down cracking only by a multiple of the number of unique salts in a given list. That means the benefit of salting diminishes with each cracked hash. By cracking the weakest passwords as quickly as possible first (an optimization offered by Hashcat) crackers can greatly diminish the minimal amount of protection salting might provide against cracking. Of course, none of this applies in this exercise since the leaked MD5 wasn't salted.
With 10,233 hashes cracked in stage one, it was time for stage two, which consisted of a series ofhybrid attacks. True to the video game analogy mentioned earlier, this second stage of attacks took considerably longer than the first one and recovered considerably fewer plains—to be exact, five hours and 12 minutes produced 2,702 passwords.
As the name implies, a hybrid attack marries a dictionary attack with a brute-force attack, a combination that greatly expands the reach of a well-honed word list while keeping the keyspace to a manageable length. The first round of this stage appended all possible two-characters strings containing digits or symbols to the end of each word in his dictionary. It recovered 585 plains and took 11 minutes and 25 seconds to run. Round two appended all possible three-character strings containing digits or symbols. It cracked 527 hashes and required 58 minutes to complete. The third round, which appended all four-digit number strings, took 25 minutes and recovered 435 plains. Round four appended all possible strings containing three lower-case letters and digits and acquired 451 more passwords.
As fruitful as these attacks were, Gosney said they were handicapped by his use of a single graphics card for this exercise.
"For example, you'll notice that when I was doing hybrid attacks, I appended 2-3 digits/special but then only did digits with length 4," he explained. "This is because doing digits/special for length 4 would have taken a really long time with just one GPU, so I skipped it. Same with when I started appending lower alpha/digits, I only did length 3 because length 4 would have taken too long with just one GPU."
No doubt, Gosney could have attacked much larger keyspaces had he used the monster 25-GPU cluster he unveiled in December. Because the graphics cards in the five-server system scale almost linearly, it's able to harness almost all of their combined power. As a result, it can achieve 350 billion guesses per second when cracking password hashes generated by Microsoft's NTLM algorithm. And it could generate similar results when going up against MD5 and other fast hash functions.
The remaining hybrid attacks in stage two continued in the same vein. By the time it was completed, he had cracked a total of 12,935 hashes, or 78.6 percent of the list, and had spent a total of just 5 hours and 28 minutes doing it.
One of the things Gosney and other crackers have found is that passwords for a particular site are remarkably similar, despite being generated by users who have never met each other. After cracking such a large percentage of hashes from this unknown site, the next step was to analyze the plains and mimic the patterns when attempting to guess the remaining passwords. The result is a series of statistically generated brute-force attacks based on a mathematical system known as Markov chains. Hashcat makes it simple to implement this method. By looking at the list of passwords that already have been cracked, it performs probabilistically ordered, per-position brute-force attacks. Gosney thinks of it as an "intelligent brute-force" that uses statistics to drastically limit the keyspace.
Where a classic brute-force tries "aaa," "aab," "aac," and so on, a Markov attack makes highly educated guesses. It analyzes plains to determine where certain types of characters are likely to appear in a password. A Markov attack with a length of seven and a threshold of 65 tries all possible seven-character passwords with the 65 most likely characters for each position. It drops the keyspace of a classic brute-force from 957to 657, a benefit that saves an attacker about four hours. And since passwords show surprising uniformity when it comes to the types of characters used in each position—in general, capital letters come at the beginning, lower-case letters come in the middle, and symbols and numbers come at the end—Markov attacks are able crack almost as many passwords as a straight brute-force.
"This is where your attack plan deviates from the standard and becomes unique, because now you're doing site-specific attacks," Gosney said. "From there, if you start hitting upon any interesting patterns, you just start chasing those patterns down the rabbit hole. Once you've fully exploited one pattern you move on to the next."
In all, it took Gosney 14 hours and 59 minutes to complete this third stage, which besides Markov attacks included several other custom wordlists combined with rules. Providing further evidence of the law of diminishing returns that dictates password cracking, it yielded 1,699 more passwords. It's interesting to note that the increasing difficulty is experienced even within this last step itself. It took about three hours to cover the first 962 plains in this stage and 12 hours to get the remaining 737.
The other two password experts who cracked this list used many of the same techniques and methods, although not in the same sequence and with vastly different tools. The only wordlist used by radix, for example, came directly from the 2009 breach of online games service RockYou. Because the SQL-injection hack exposed more than 14 million unique passwords in plaintext, the list represents the largest corpus of real-world passwords ever to be made public. radix has a much bigger custom-compiled dictionary, but like a magician who doesn't want to reveal the secret behind a trick, he kept it under wraps during this exercise.
Killing hashes
Like Nate Anderson's foray into password cracking, radix was able to crack 4,900 of the passwords, nearly 30 percent of the haul, solely by using the RockYou list. He then took the same list, cut the last four characters off each of the words, and appended every possible four-digit number to the end. Hashcat told him it would take two hours to complete, which was longer than he wanted to spend. Even after terminating the run two after 20 minutes, he had cracked 2,136 more passcodes. radix then tried brute-forcing all numbers, starting with a single digit, then two digits, then three digits, and so on (259 additional plains recovered).
He seemed to choose techniques for his additional runs almost at random. But in reality, it was a combination of experience, intuition, and possibly a little luck.
"It's all about analysis, gut feelings, and maybe a little magic," he said. "Identify a pattern, run a mask, put recovered passes in a new dict, run again with rules, identify a new pattern, etc. If you know the source of the hashes, you scrape the company website to make a list of words that pertain to that specific field of business and then manipulate it until you are happy with your results."
He then ran the 7,295 plains he recovered so far through PACK, short for the Password Analysis and Cracking Toolkit (developed by password expert Peter Kacherginsky), and noticed some distinct patterns. A third of them contained eight characters, 19 percent contained nine characters, and 16 percent contained six characters. PACK also reported that 69 percent of the plains were "stringdigit" meaning a string of letters or symbols that ended with numbers. He also noticed that 62 percent of the recovered passwords were classified as "loweralphanum," meaning they consisted solely of lower-case letters and numbers.
This information gave him fodder for his next series of attacks. In run 4, he ran a mask attack. This is similar to the hybrid attack mentioned earlier, and it brings much of the benefit of a brute-force attack while drastically reducing the time it takes to run it. The first one tried all possible combinations of lower-case letters and numbers, from one to six characters long (341 more plains recovered). The next step would have been to try all combinations of lower-case letters and numbers with a length of eight. But that would have required more time than radix was willing to spend. He then considered trying all passwords with a length of eight that contained only lower-case letters. Because the attack excludes upper case letters, the search space was manageable, 268instead of 528. With radix's machine, that was the difference between spending one hour and six hours respectively. The lower threshold was still more time than he wanted to spend, so he skipped that step too.
So radix then shifted his strategy and used some of the rule sets built into Hashcat. One of them allows Hashcat to try a random combination of 5,120 rules, which can be anything from swapping each "e" with a "3," pulling the first character off each word, or adding a digit between each character. In just 38 seconds the technique recovered 1,940 more passwords.
"That's the thrill of it," he said. "It's kind of like hunting, but you're not killing animals. You're killing hashes. It's like the ultimate hide and seek." Then acknowledging the dark side of password cracking, he added: "If you're on the slightly less moral side of it, it has huge implications."
Steube also cracked the list of leaked hashes with aplomb. While the total number of words in his custom dictionaries is much larger, he prefers to work with a "dict" of just 111 million words and pull out the additional ammunition only when a specific job calls for it. The words are ordered from most to least commonly used. That way, a particular run will crack the majority of the hashes early on and then slowly taper off. "I wanted it to behave like that so I can stop when things get slower," he explained.
Early in the process, Steube couldn't help remarking when he noticed one of the plains he had recovered was "momof3g8kids."
"This was some logic that the user had," Steube observed. "But we didn't know about the logic. By doing hybrid attacks, I'm getting new ideas about how people build new [password] patterns. This is why I'm always watching outputs."
The specific type of hybrid attack that cracked that password is known as a combinator attack. It combines each word in a dictionary with every other word in the dictionary. Because these attacks are capable of generating a huge number of guesses—the square of the number of words in the dict—crackers often work with smaller word lists or simply terminate a run in progress once things start slowing down. Other times, they combine words from one big dictionary with words from a smaller one. Steube was able to crack "momof3g8kids" because he had "momof3g" in his 111 million dict and "8kids" in a smaller dict.
"The combinator attack got it! It's cool," he said. Then referring to the oft-cited xkcd comic, he added: "This is an answer to the batteryhorsestaple thing."
What was remarkable about all three cracking sessions were the types of plains that got revealed. They included passcodes such as "k1araj0hns0n," "Sh1a-labe0uf," "Apr!l221973," "Qbesancon321," "DG091101%," "@Yourmom69," "ilovetofunot," "windermere2313," "tmdmmj17," and "BandGeek2014." Also included in the list: "all of the lights" (yes, spaces are allowed on many sites), "i hate hackers," "allineedislove," "ilovemySister31," "iloveyousomuch," "Philippians4:13," "Philippians4:6-7," and "qeadzcwrsfxv1331." "gonefishing1125" was another password Steube saw appear on his computer screen. Seconds after it was cracked, he noted, "You won't ever find it using brute force."
The ease these three crackers had converting hashes into their underlying plaintext contrasts sharply with the assurances many websites issue when their password databases are breached. Last month, when daily coupons site LivingSocial disclosed a hack that exposed names, addresses, and password hashes for 50 million users, company executives downplayed the risk.
"Although your LivingSocial password would be difficult to decode, we want to take every precaution to ensure that your account is secure, so we are expiring your old password and requesting that you create a new one," CEO Tim O'Shaughnessy told customers.
In fact, there's almost nothing preventing crackers from deciphering the hashes. LivingSocial used the SHA1 algorithm, which as mentioned earlier is woefully inadequate for password hashing. He also mentioned that the hashes had been "salted," meaning a unique set of bits had been added to each users' plaintext password before it was hashed. It turns out that this measure did little to mitigate the potential threat. That's because salt is largely a protection against rainbow tables and other types of precomputed attacks, which almost no one ever uses in real-world cracks. The file sizes involved in rainbow attacks are so unwieldy that they fell out of vogue once GPU-based cracking became viable. (LivingSocial later said it's in the process of transitioning to the much more secure bcrypt function.)
Officials with Reputation.com, a service that helps people and companies manage negative search results, borrowed liberally from the same script when disclosing their own password breach a few days later. "Although it was highly unlikely that these passwords could ever be decrypted, we immediately changed the password of every user to prevent any possible unauthorized account access," a company e-mail told customers.
Both companies should have said that, with the hashes exposed, users should presume their passwords are already known to the attackers. After all, cracks against consumer websites typically recover 60 percent to 90 percent of passcodes. Company officials also should have warned customers who used the same password on other sites to change them immediately.
To be fair, since both sites salted their hashes, the cracking process would have taken longer to complete against large numbers of hashes. But salting does nothing to slow down the cracking of a single hash and does little to slow down attacks on small numbers of hashes. This means that certain targeted individuals who used the hacked sites—for example, bank executives, celebrities, or other people of particular interest to the attackers—weren't protected at all by salting.
The prowess of these three crackers also underscores the need for end users to come up with better password hygiene. Many Fortune 500 companies tightly control the types of passwords employees are allowed to use to access e-mail and company networks, and they go a long way to dampen crackers' success.
"On the corporate side, its so different," radix said. "When I'm doing a password audit for a firm to make sure password policies are properly enforced, it's madness. You could go three days finding absolutely nothing."
Websites could go a long way to protect their customers if they enforced similar policies. In the coming days, Ars will publish a detailed primer on passwords managers. It will show how to use them to generate long, random passcodes that are unique to each site. Because these types of passwords can only be cracked by brute force, they are the hardest to recover. In the meantime, readers should take pains to make sure their passwords are a minimum of 11 characters, contain upper- and lower-case letters, numbers, and letters, and aren't part of a pattern.
The ease these crackers had in recovering as many as 90 percent of the hashes they targeted from a real-world breach also exposes the inability many services experience when trying to measure the relative strength or weakness of various passwords. A recently launched site from chipmaker Intel asks users "How strong is your password?," and it estimated it would take six years to crack the passcode "BandGeek2014". That estimate is laughable given that it was one of the first ones to fall at the hands of all three real-world crackers.
As Ars explained recently, the problem with password strength meters found on many websites is they use the total number of combinations required in a brute-force crack to gauge a password's strength. What the meters fail to account for is that the patterns people employ to make their passwords memorable frequently lead to passcodes that are highly susceptible to much more efficient types of attacks.
"You can see here that we have cracked 82 percent [of the passwords] in one hour," Steube said. "That means we have 13,000 humans who did not choose a good password." When academics and some websites gauge susceptibility to cracking, "they always assume the best possible passwords, when it's exactly the opposite. They choose the worst."
