BitCracker is the first open source password cracking tool for memory units encrypted with BitLocker
BitCracker is the first open source password cracking tool for memory units encrypted with BitLocker
BitCracker is the first open source password cracking tool for storage devices (Hard Disk, USB Pendrive, SD card, etc...) encrypted with BitLocker, an encryption feature available on Windows Vista, 7, 8.1 and 10 (Ultimate, Pro and Enterprise editions). BitLocker offers a number of different authentication methods to encrypt a storage device like Trusted Platform Module (TPM), Smart Card, Recovery Password, User supplied password.
By means of a dictionary attack, BitCracker tries to find the correct User Password or Recovery Password to decrypt the encrypted storage device. It has been implemented in CUDA and OpenCL.
Several journals delayed the publication of our BitCracker paper (almost 3 years, with final rejection after several revisions) which explains the details of our attack, the BitLocker Drive Encryption (BDE) volume format and possible weaknesses in the encryption/decryption procedure. Finally, we published the paper here: https://arxiv.org/abs/1901.01337 . Please feel free to comment and share.
To run the BitCracker-CUDA, minimal requirements are:
To run the BitCracker-OpenCL, minimal requirements are any GPU or CPU supporting OpenCL (you can find some help here.
BitCracker requires at least 260 MB of device memory.
We strongly recommend to run your attack on a GPU rather than CPU for performance reasons (see section Performance).
Running the build.sh script generates 4 executables inside the build directory: bitcracker_hash, bitcracker_rpgen, bitcracker_cuda, bitcracker_opencl.
In order to build bitcracker_cuda coherently with your NVIDIA GPU and CUDA version, you need to modify the src_CUDA/Makefile chosing the correct SM version. As a reference, you can use the following table:
| GPU Architecture | Suggested CUDA | Makefile |
|---|---|---|
| Kepler | CUDA 7.5 | arch=compute_35,code=sm_35 |
| Maxwell | CUDA 8.0 | arch=compute_52,code=sm_52 |
| Pascal | CUDA 9.0 | arch=compute_60,code=sm_60 |
| Volta | CUDA 9.0 | arch=compute_70,code=sm_70 |
You need to create the image of your storage device encrypted with BitLocker using, as an example, the dd command:
sudo dd if=/dev/disk2 of=/path/to/imageEncrypted.img conv=noerror,sync
4030464+0 records in
4030464+0 records out
2063597568 bytes transferred in 292.749849 secs (7049013 bytes/sec)Then you need to run the bitcracker_hash executable on your imageEncrypted.img in order to:
If the execution completes correctly, bitcracker_hash produces 1 or 2 output files:
BDE encrypted volumes could have different formats for different authentication methods. If bitcracker_hash is not able to find the Recovery Password on your encrypted image, please open an issue or contact me
An example:
…./build/bitcracker_rpgen -n 300 -p 10000000 -s 000000-000011-000022-000033-000044-000055-008459-015180```
This generates:
-n : number of wordlists-p : number of Recovery Passwords per wordlist-s : generate Recovery Passwords starting from this oneYou can use the default configuration running without options:
./build/bitcracker_rpgen
************* BitCracker Recovery Password wordlists generator *************
Running with this configuration:
### Create 100 wordlists
### Recovery Passwords per wordlist=5000000
### Allow duplicates=No
### Generate starting from=000000-000011-000022-000033-000044-000055-000066-000077
Creating wordlist "bitcracker_wlrp_0.txt" with 5000000 passwords
First password=000000-000011-000022-000033-000044-000055-000066-000077
Last password= 000000-000011-000022-000033-000044-000055-000902-217822
...
…
./build/bitcracker_cuda -f hash_recv_pass.txt -d bitcracker_wlrp_0.txt -t 1 -b 1 -g 0 -r```
Where options are the same as in case of User Password but instead of `-u` you need to specify `-r`. An output example:
... Reading hash file "hash_recv_pass.txt" $bitlocker$2$16$432dd19f37dd413a88552225628c8ae5$1048576$12$a0da3fc75f6cd30106000000$60$3e57c68216ef3d2b8139fdb0ec74254bdf453e688401e89b41cae7c250739a8b36edd4fe86a597b5823cf3e0f41c98f623b528960a4bee00c42131ef
Type of attack: Recovery Password CUDA Threads: 1024 CUDA Blocks: 1 Psw per thread: 8 Max Psw per kernel: 8192 Dictionary: wordlist.txt Strict Check (-s): No MAC Comparison (-m): No
CUDA Kernel execution: Effective passwords: 6014 Passwords Range: 390775-218680-136708-700645-433191-416240-153241-612216 ..... 090134-625383-540826-613283-563497-710369-160182-661364 Time: 193.358937 sec Passwords x second: 31.10 pw/sec
## False Positives
By default, BitCracker does a fast attack (for both User and Recovery password modes) which may return some false positive. In this case you can re-run your attack with the `-m` option which enables the MAC verification (slower solution).
## Examples
To test BitCracker on your system before starting the real attack, we provided several images of encrypted storage devices.
* imgWin7: BitLocker on Windows 7 Enteprise edition OS
* imgWin8: BitLocker on Windows 8 Enteprise edition OS
* imgWin10Compat.vhd: BitLocker (compatible mode) on Windows 10 Pro edition OS
* imgWin10NotCompat.vhd: BitLocker (not compatible mode) on Windows 10 Pro edition OS
* imgWin10NotCompatLongPsw.vhd : BitLocker (not compatible mode) on Windows 10 Pro edition OS with a longer user password
You can attack those images with both User and Recovery password modes, using the wordlists stored in the `Dictionary` folder.
## Performance
Here we report the best BitCracker performances in case of fast attack (default) to the User Password (-u option).
| GPU Acronim | GPU | Arch | CC | # SM | Clock | CUDA |
| ------------ | --------------- | ------- | --- | ---- | ------ | ---- |
| GFT | GeForce Titan | Kepler | 3.5 | 14 | 835 | 7.0 |
| GTK80 | Tesla K80 | Kepler | 3.5 | 13 | 875 | 7.5 |
| GFTX | GeForce Titan X | Maxwell | 5.2 | 24 | 1001 | 7.5 |
| GTP100 | Tesla P100 | Pascal | 6.1 | 56 | 1328 | 8.0 |
| GTV100 | Tesla V100 | Volta | 7.0 | 80 | 1290 | 9.0 |
| AMDM | Radeon Malta | - | - | - | - | - |
Performance:
| Version | GPU | -t | -b | Passwords x kernel | Passwords/sec | Hash/sec |
| -------- | ------ | --- | -- | ------------------ | ------------- | ---------- |
| CUDA | GFT | 8 | 13 | 106.496 | 303 | 635 MH/s |
| CUDA | GTK80 | 8 | 14 | 114.688 | 370 | 775 MH/s |
| CUDA | GFTX | 8 | 24 | 106.608 | 933 | 1.957 MH/s |
| CUDA | GTP100 | 1 | 56 | 57.344 | 1.418 | 2.973 MH/s |
| CUDA | GTV100 | 1 | 80 | 81.920 | 3.252 | 6.820 MH/s |
| OpenCL | AMDM | 32 | 64 | 524.288 | 241 | 505 MH/s |
| OpenCL | GFTX | 8 | 24 | 196.608 | 884 | 1.853 MH/s |
N.B. Each password requires about 2.097.152 SHA-256
## John The Ripper
We released BitCracker as the [OpenCL-BitLocker](http://openwall.info/wiki/john/OpenCL-BitLocker) format in [John The Ripper](https://github.com/magnumripper/JohnTheRipper) (`--format=bitlocker-opencl`).
The hash files generated by `bitcracker_hash` (see *How To* section) are fully compatible with the John format.
On the GTV100 password rate is about 3150p/s. JtR team developed the CPU version of this attack (`--format=bitlocker`); on a CPU Intel(R) Xeon(R) v4 2.20GHz, password rate is about 78p/s.
## Hashcat
This is a work in progress...
## Changelog
Nov 2021: Code updated to run on NVIDIA GPU Ampere using CUDA 11.x
#### What's next
* Provide a multi-GPU implementation
* Provide a Qt interface
## References, credits and contacts
Plase share and test our project: we need your feedback!
Special thanks to the John The Ripper team, [Dislocker](https://github.com/Aorimn/dislocker) and [LibBDE](https://github.com/libyal/libbde) projects.
This is a research project in collaboration with the National Research Council of Italy released under GPLv2 license.
Copyright (C) 2013-2021 Elena Ago (elena dot ago at gmail dot com) and Massimo Bernaschi (massimo dot bernaschi at gmail dot com)
We will provide some additional info about BitCracker's attack in a future paper.
Although we use the GPLv2 licence, we are open to collaborations.
For any additional info, collaborations or bug report please contact us or open an issueNo open issues yet, or sync has not completed.