On the Imminent Advent of Botnet Powered Cracking

Botnets have been becoming increasingly resilient, rampant, larger and powerful in recent years. Going beyond traditionally malicious intents of stealing credentials, sending spam and DDoS, botnet herders have now even begun to monetize CPU cycles of zombie machines under their control, by illegal cryptocurrency mining. Following recent advances in efficient password cracking by the use of Markov chains, Context Free Grammar, and other methods for smart generation of candidate passwords for trial and error, the time taken for breaking hashed passwords has greatly decreased when compared to traditional brute forcing. This paper aims to describe the practicality of a botnet specifically designed to break passwords. Various modes of botnet based password breaking and the advantage in terms of highly accelerated hash rates obtained are discussed. Comparisons with hash rates of cloud-based cracking are also discussed. A load distribution model is shown in which workload is homogenously and uniformly distributed across nodes of varying computing power. This model is designed to be independent of the password guessing algorithm or combination of algorithms used. Also, the resilience of passwords against large search spaced brute force attacks by botnets are studied, and its results extrapolated to smart methods of password guessing.