Since September 2016, a criminal group has been using different versions of the Crysis ransomware to infect enterprise networks where they previously gained access to by brute-forcing workstations with open RDP ports.
According to Trend Micro, the security firm who first discovered the attacks and has been keeping an eye on the group's activities, incidents more than doubled in January 2017, compared to previous months.
While initial attacks only targeted small companies in Australia and New Zealand, according to Trend Micro, the group has slowly expanded to new territories and has also started to target larger enterprises as well.
Prevent Remote Desktop Hacking on Your Network. By Giorgio Bonuccelli. August 20, 2013. DUBrute is an example of a hacking tool used by criminals to attack RDP vulnerabilities for ransom-ware. This tool allows hackers to use dictionary attacks and manually inject malware into RDP networks using port 3389 to perform activities like.
According to statistical data from last month, the group has been very active in targeting healthcare organizations in the US.
The problem: User accounts with weak credentials, open RDP ports
- The answer is Rdp Attack Blocker which is a powerful tool that allows you to protect your Remote Desktop from brute-force attacks. Rdp Attack Blocker works as a Windows Service and constantly watches failed login attempts.
- How to block RDP brute force attacks on your Windows webserver for free. Updated: December 7. – Contains configuration to block Remote Desktop attempts, Microsoft SQL Server login attempts and MySQL Server login attempts by default. Essential admin tools – SolarWinds IP Addres. LibreOffice 4.0 Released.
- Brute Force Remote Desktop Attack To A Windows Server Posted By: technicalguy March 17, 2017 Discovered that some nefarious hacker is trying a brute force Remote Desktop attack to a Windows Server belonging to a customer of ours.
A typical infection goes through the following steps. An attacker picks targets with RDP ports available online and identifies if the computer is assigned to an enterprise network. Alternatively, he can always buy access to previously hacked RDP servers, via marketplaces like xDedic.
Once he purchased or gained access to a computer by brute-forcing the RDP connection with basic username-password combos, the attacker downloads and then manually executes a version of the Crysis ransomware on each of the hacked computer.
If the attacker manages to gain access to multiple workstations inside the same company, Trend Micro says attackers won't shy away from infecting all targets, sometimes with different versions of the Crysis ransomware, each with different features. In one specific case, Trend Micro reported seeing the group install six different Crysis versions in the span of only ten minutes.
RDP connections are a common channel for spreading ransomware
The attack scenario is not 'innovative' in any way since there have been multiple ransomware strains and groups that relied on brute-forcing RDP ports to infect their victims.
The list includes names such as LowLevel, DMA Locker, Apocalypse, Smrss32, Bucbi, Aura/BandarChor, ACCDFISA, or Globe.
In November 2016, an unknown user posted a trove of master decryption keys for the Crysis ransomware on the Bleeping Computer forums. Most of these keys are now outdated.
Related Articles:
Password cracking is an integral part of digital forensics and pentesting. Keeping that in mind, we have prepared a list of the top 10 best password cracking tools that are widely used by ethical hackers and cybersecurity experts. These tools–including the likes of Aircrack, John the Ripper, and THC Hydra–use different algorithms and protocols to crack the passwords on a Windows, Linux, and OS X system.
What is password cracking?
In the field of cybersecurity and cryptography, password cracking plays a very major role. It’s basically the process of recovering passwords to breach (or restore) the security of a computer system. You can easily relate it to repeatedly guessing your phone’s unlock pattern or pin.
So, why do we need to learn about password cracking and the tools used to do so? The purpose of password cracking revolves around recovering the forgotten passwords of our online accounts, computers, and smartphones. Password cracking is also used by system administrators as a preventive measure. They keep checking them on the regular basis to look for the weak links.
Talking about the process of password cracking, most methods involve the use of a computer that generates a vast set of password candidates. A desktop computer tests more than hundreds of millions of passwords per second. A password cracking tool performs this task easily and checks these candidates to reveal the actual password.
The time needed to crack a password is proportional to the length and strength of that password. That’s why users are advised to use complex passwords that are harder to guess. The password cracking speed of a tool also depends heavily on the cryptographic function that’s used to generate password hashes. Thus, a potent hashing function like bcrypt is preferred over the likes of SHA and MD5.
Types of password cracking attacks:
Here’s I’ll be listing various types of password cracking attacks that are generally used by attackers:
- Dictionary attack: This attack uses a file that contains a list of words that are found in the dictionary. This mode matches different combinations of those words to crack your device open.
- Brute force attack: Apart from the dictionary words, brute force attack makes use of non-dictionary words too.
- Rainbow table attack: This attack comes along with pre-computed hashes. Thus, this method is faster.
There are lots of other password cracking techniques like phishing, spidering, social engineering, shoulder surfing etc. Soon, I’ll be discussing them in detail in another article. So, let’s get started with our list of the best password cracking tools of 2016.
Best Password Cracking Tools Of 2016:
Disclaimer: Fossbytes is publishing this list just for educational purposes. We don’t promote malicious and unethical practices.
John the Ripper | Best Password Cracking Tools Of 2016
John the Ripper is one of the most popular password cracking tools available around. This free password cracking tool is chiefly written in C programming language. Encompassing a customizable password cracker, John the Ripper comes as a combination of many password crackers into one suite.
Its ability to autodetect password hashtypes, makes it a preferred choice of ethical hackers to ensure security. A pro version of this tool is also available, offering better features and more effectiveness. Just like the popular hacking tool Metasploit, John also belongs to the Raspid7 family of security tools.
Supported platforms: John the Ripper is available for all major platforms, including Linux, Windows, DOS, and OS X.
Download link: John the Ripper
Love Hacking And Pentesting? Get Started Here
Aircrack-ng | Best Password Cracking Tools Of 2016
Aircrack-ng (ng stands for new generation) is one of the best password cracking tools that hackers use to bump their annoying neighbors off their own Wi-Fi. Note that just like John the Ripper, Aircrack-ng is not a single tool. Instead, it’s a complete software suite that’s used to play with Wi-Fi networks.
In this free suite, you get a tool named aircrack that hackers use to crack WPA or WEP passwords. After analyzing the encrypted password packets, aircrack uses its cracking algorithm to break the passwords.
Using the well know attack techniques like FMS, this password cracking tool makes your job easier. Recently, a new attack named “PTW” has been included in the suite, which reduces the number of initialization vectors to break a WEP key.
Supported platforms: Aircrack is available for Linux, OpenBSD, FreeBSD, OX X, Windows, Android
Download link: Aircrack-ng
RainbowCrack | Best Password Cracking Tools Of 2016
As the name suggests, RainbowCrack makes use of rainbow tables to crack password hashes. Using a large-scale time-memory trade-off, RainbowCrack performs an advance cracking time computation. According to your convenience, you are free to use the command line or graphical interface of RainbowCrack.
Once the pre-computation stage is completed, this top password cracking tool is about hundreds of times faster than a brute force attack. You also don’t need to prepare the rainbow tables yourselves. The developers have made different rainbow tables for LM, NTLM, MD5 and SHA1 available for free.
RainbowCrack’s GPU acceleration is another key feature that allows this free password cracking tool to offload the runtime computation to GPUs, reducing the cracking time even further.
Supported platforms: RainbowCrack is available for Windows and Linux
Download link:RainbowCrack
Cain and Abel | Best Password Cracking Tools Of 2016
This renowned password cracking tool is a dependable software to recover various types of passwords using multiple techniques. Cain and Able lets you easily perform Dictionary, Brute-Force, and Cryptoanalysis attacks to crack encrypted passwords.
This multi-purpose hacking tool also comes with the ability to sniff the networks, record VoIP conversations, recover network keys, decode scrambled passwords, and analyze routing protocols.
Cain and Abel has two components. While Cain is the frontend application to recover your passwords and perform sniffing, Able is a Windows NT service that performs the role of traffic scrambling.
Supported Platforms: Cain and Abel is available for Windows
Download link:Cain and Abel
THC Hydra | Best Password Cracking Tools Of 2016
Compared to other top password cracking tools, THC Hydra performs hacking attacks using numerous network protocols, including the likes of Asterisk, FTP, HTTP-Proxy, MYSQL, XMPP, Telnet, and more. Using these protocols, THC Hydra performs super fast brute-force and dictionary attacks against a login page.
This free-to-use tool helps the pentesters and security researchers to know how easy it would be to gain remote access to a system. This tool also lets you add new modules to increase the functionality. Via its GitHub page, you can also participate in the development process of THC Hydra.
Supported Platforms: THC Hydra is available for Windows, Linux, Solaris, FreeBSD, OS X
Download link: THC Hydra
Find Best Courses On Hacking And Pentesting Here
HashCat | Best Password Cracking Tools Of 2016
HashCat claims to be the fastest and most advanced password cracking software available. Released as a free and open source software, HashCat supports algorithm like MD4, MD5, Microsoft LM hashes, SHA-family, MySQL, Cisco PIX, and Unix Crypt formats.
This password cracking tool comes in both CPU-based and GPU-based versions, HashCat and oclHashcat/cudaHashcat, respectively. Using a well-documented GPU acceleration, many algorithms can be easily cracked using this tool.
Different types of attacks performed by this tool include brute force attack, combinator attack, fingerprint attack, dictionary attack, hybrid attack, mask attack, table-lookup attack, PRINCE attack, permutation attack etc.
Supported Platforms: HashCat is available for Windows, Linux, OS X
Download link:HashCat
Crowbar | Best Password Cracking Tools Of 2016
Crowbar is a brute forcing tool that’s widely popular in the pen testing scene. It gives you the control to decide what’s submitted to a web server. While most brute forcing tools use username and password to deploy SSH brute force, Crowbar makes use of SSH keys obtained during penetration tests.
This free tool is created to support the protocols that are rarely supported by other popular password cracking tools. Currently, Crowbar supports VNC key authentication, OpenVPN, SSP private key authentication, and Remote Desktop Protocol with NLA support.
Supported Platforms: Crowbar is available for Windows, Linux, OS X
Brute Force Definition
Download link:Crowbar
OphCrack | Best Password Cracking Tools Of 2016
Just like RainbowCrack, OphCrack is another popular and free password cracking tool that uses rainbow tables to crack the password hashes. It’s widely used to crack Windows log-in passwords. Thanks to its ability to import and use hashes from multiple formats and sources, OphCrack is known to crack the passwords of a Windows computer in few minutes.
Available conveniently as a Live CD, a pentester can use it and leave no trace behind. For cracking Windows XP, Vista, and 7, one can also grab freely available rainbow tables. For professional use, larger tables are available for purchase.
Supported Platforms: OphCrack is available for Windows
Download link:OphCrack
L0phtCrack | Best Password Cracking Tools Of 2016
Just like OphCrack, L0phtCrack is known for easily cracking Windows passwords. Using a wide set of attacks like dictionary, hybrid, brute force, and rainbow tables, this password cracking tool can also be deemed useful in sniffing hashes.
It’s a great way to target Windows desktops, networked servers, Active Directory, and primary domain controllers. Its schedule routine audit functionality lets you perform scans at a convenient time.
Supported Platforms: L0phtCrack is available for Windows
Download link:L0phtCrack
DaveGrohl | Best Password Cracking Tools Of 2016
For Mac OS X, DaveGrohl is an open source password cracking tool that’s preferred by the Apple security experts. With a completely modern object-oriented codebase in Version 3.0, DaveGrohl has been made more useful for developers and users.
With the help of dictionary and incremental attacks, this tool lets you crack a password in minutes. Its distributed mode allows you to perform attacks using different computers and crack the same password hash for faster results.
Supported Platforms: DaveGrohl is available for OS X
Brute Force Download
Download link:DaveGrohl
Did you find this article helpful? Don’t forget to drop your feedback in the comments section below.
Bonus: Top 10 Best Hacking Tools | 2017 Edition