GPU Cracking: massively parallel hash attacks

GPU cracking refers to the use of graphics processing units to perform massively parallel hash attacks against captured password hashes. Unlike a CPU, which handles a small number of threads simultaneously, a modern GPU contains thousands of shader cores capable of computing hash functions in parallel. This architecture makes GPU cracking orders of magnitude faster than CPU-based attempts. Algorithms such as MD5, NTLM, and SHA-1 are particularly vulnerable because they are computationally lightweight by design. A single consumer-grade GPU can test billions of NTLM candidates per second. Attackers typically obtain hashes through credential dumping (LSASS, SAM database, NTDS.dit) and then transfer the hash file to an offline cracking rig, where no account lockout policy applies. The offline nature of the attack is critical: once hashes are exfiltrated, the cracking process is entirely outside the defender's visibility. Stronger, memory-hard algorithms like bcrypt, scrypt, or Argon2 significantly slow GPU cracking by design, because they require large amounts of RAM per candidate tested, neutralizing the parallelism advantage of a GPU.

Detecting GPU cracking activity focuses on identifying the upstream steps that make cracking possible, since the cracking itself occurs offline. The primary detection surface is credential dumping. On Windows systems, monitor Event ID 4656 and 4663 for handle requests to the LSASS process, and Event ID 10 in Sysmon logs for cross-process memory access targeting lsass.exe. Mimikatz and similar tools trigger these events reliably. Extraction of the NTDS.dit file generates Event ID 4769 for Kerberoasting-style ticket requests and VSS shadow copy access events (Event ID 8222). EDR solutions should alert on suspicious LSASS memory reads originating from non-system processes. On the network side, watch for large file exfiltration events following any credential-access alert, as attackers stage hash files before transferring them. Honeytoken accounts with weak, known passwords can serve as canaries: if a honeypot hash is cracked and the account is used, an authentication alert fires immediately. Password audit tools like Manticore or internal LDAP queries can identify accounts still using legacy hash formats such as LM hashes, which crack in seconds even on modest hardware.

Red Team operators use GPU cracking primarily with Hashcat, the de facto standard tool supporting CUDA and OpenCL backends. Hashcat accepts dozens of hash types identified by a numeric mode flag: mode 1000 for NTLM, mode 13100 for Kerberoasting TGS tickets, mode 2500 for WPA2 handshakes. Attack modes include straight dictionary attacks (-a 0), combinator attacks (-a 1), mask attacks for structured brute force (-a 3), and rule-based attacks (-a 0 with -r) that apply transformation rules to a wordlist. The rockyou.txt wordlist combined with the best64.rule ruleset recovers a large proportion of real-world hashes in minutes on modern hardware. For organizations hardening against GPU cracking, the most effective countermeasures are enforcing strong hashing algorithms for stored credentials, requiring long passphrases above 15 characters to defeat mask attacks, disabling LM hash storage via Group Policy, enabling Credential Guard on Windows 10 and later to isolate LSASS in a virtualization-based security enclave, and auditing Active Directory for Kerberoastable service accounts with weak passwords. Rotating service account credentials and applying fine-grained password policies to privileged accounts further reduces the exploitable attack surface.