HaaS - A Platform for Password Cracking in Distributed Heterogeneous Systems

Traditional passwords and respective cryptographic hashes are still widely used for user authentication. Breaking these hashes, to recover the original passwords, may be necessary for a variety of legitimate reasons. Hashcat, a widely used password auditing tool, is able to exploit the parallel processing power of many GPUs to accelerate the breaking of cryptographic hashes. Moreover, there are already ways of performing this task in a distributed environment, though they face several challenges, including the difficulty of assembling and managing distributed deployments, and using them in a user-friendly and resource-efficient way. This work presents Hashcat-as-a-Service (HaaS), a novel platform that targets these challenges. It combines Hashcat with web technologies, containerization and remote OpenCL middleware, to allow the user-friendly management of Hashcat instances that leverage the processing power of distributed GPUs, including support of instances migration in order to maximize GPU utilization. The evaluation of HaaS in different configurations demonstrated promising results, confirming its ability to handle intensive workloads and its flexibility to adapt to different usage scenarios and resources availability, making HaaS a relevant contribution in the password recovery field.