Trustwave SpiderLabs Uncovers Critical Cybersecurity Vulnerabilities Exposing Manufacturers to Costly Attacks. Learn More

Trustwave SpiderLabs Uncovers Critical Cybersecurity Vulnerabilities Exposing Manufacturers to Costly Attacks. Learn More

Managed Detection & Response

Eradicate cyberthreats with world-class intel and expertise

Managed Security Services

Expand your team’s capabilities and strengthen your security posture

Consulting & Professional Services

Tap into our global team of tenured cybersecurity specialists

Penetration Testing

Subscription- or project-based testing, delivered by global experts

Database Security

Get ahead of database risk, protect data and exceed compliance requirements

Email Security & Management

Catch email threats others miss with layered security & maximum control

Co-Managed SOC (SIEM)

Eliminate alert fatigue, focus your SecOps team, stop threats fast, and reduce cyber risk

Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
The Trustwave Approach
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Platform
SpiderLabs Fusion Center
Security Operations Centers
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

CrackQ: 5 Questions with the Password Cracker's Creator

Trustwave’s global SpiderLabs team is known for its malware reverse-engineering projects, breach investigations, and the thousands of penetration tests it conducts to bolster the security of enterprises across the globe. But the established Trustwave SpiderLabs experts are also recognized for the open-source security projects they release throughout the year. Today, the team has released its latest creation.

Dubbed CrackQ, the tool enhances the experience around Hashcat, a popular password-cracking solution leveraged by Red Teams. To get a better sense of the benefits and iterations we can expect surrounding CrackQ, we caught up with its creator, Dan Turner, principal consultant at Trustwave SpiderLabs.

1. Can you give me a breakdown of what CrackQ is?

Dan Turner: CrackQ does a few things, but primarily it's a queuing system to manage password cracking for an offensive security team. So it's a wrapper around Hashcat, served by a web application for ease of use. Hashcat is the de facto password cracking tool that utilizes the power of graphical processing units (GPU) for high-speed password cracking. GPUs are coprocessor cards historically used for graphical processing like rendering games, but their use has since transcended into other areas such as password cracking, machine learning, and cryptocurrency mining.

To explain what password cracking is; when a password is saved to disk, best practices dictate that it should be saved as a cryptographically hashed string, referred to as a hash. This is a one-way process, so it can't be reversed, but the process can be replicated to check that a password provided by a user matches the hash.

Password cracking is the process of matching a plain-text password to a hash. This is done by guessing the password, but at an incredibly fast rate. We're talking hundreds of billions of guesses per second in many cases.

2. How does it differ from other similar tools currently available?

Dan Turner: Initially I just wanted something written in Python (the other tools are written in different languages) so I could easily add features as the team needed them, but I got a little carried away and it evolved from there.

It uses SAML2 for authentication which can be set up to use multi-factor authentication and can integrate with a single sign-on setup, so it's easier to manage users.

It will improve efficiency with the ability to remove duplicate hashes, move jobs around based on the completion time and other factors like how long it's been running, how many hashes have cracked, etc. It will include an automated option that will automatically choose efficient cracking techniques based on the type of password hash algorithm and a chosen period of time. It handles failures well and will automatically re-queue jobs if they fail due to a system error of some sort. Though it's been very stable in testing, so this has been quite a rare occurrence.

The reporting feature is pretty nice. This will take the results of a password cracking job, a Windows Active Directory domain store for example, and analyze the cracked passwords to produce a report. This will include information relating to timing and speed, but crucially insecure password choices and patterns within an organization, which can help to eradicate those “Changme123!” type of passwords that lurk in many networks. One interesting metric, which I'm quite proud of, is the geolocation chart showing the locations of common password choices. So for example, it will find passwords based on city locations, such as “Chicago2019!”, then highlight these as "heat-spots" on a global map.

There's much more to come with the reports as well, there's a ton of metrics I haven't had time to add yet.

3. Why release something like this when attackers could potentially leverage it?

Dan Turner: Great question, and a question that could be asked of any security tool released to the community. In my opinion, the benefits far outweigh the risks associated with releasing such tools. Generally speaking, security tools are responsibly released only when a patch has been provided by the vendor of the affected product. Releasing such tools forces vendors and administrators to remediate the vulnerabilities they present and they help security personnel to highlight the risks to executives.

More specifically, this tool presents nothing new as such, password cracking tools have been around for decades. Though this tool does make certain aspects of the process easier, it's not going to give attackers anything new to work with. Any skilled threat actor will already be using the techniques included within CrackQ. The real benefits are geared towards large teams who share resources and work to tight deadlines. It's designed to help with that and provide better insights to clients.

4. Are there plans to make iterations in the future? 

Dan Turner: Yes! This is just an initial (alpha) release. In fact, some of the best features are yet to come, but it's at a point where I now feel like I can release it and hopefully receive some further support from the community to help grow the current feature set.

5. How does this help security in the long run?

Dan Turner: In the long run I think it will be quite valuable to our clients and the security community in general. For us, every penetration with a significant password store compromise will include a detailed report analyzing weak areas in password policy. I think it will help to visualize that and perhaps help drive home the message about poor password choices.

To get further information on CrackQ, read Dan’s full blog post on the tool here. Click here to learn more on how the elite Trustwave SpiderLabs team can help your organization.

Marcos Colón is the content marketing manager at Trustwave and a former IT security reporter and editor.

Latest Trustwave Blogs

Unlock the Power of Your SIEM with Co-Managed SOC

Security information and event management (SIEM) systems play a pivotal role in cybersecurity: they offer a unified solution for gathering and assessing alerts from a plethora of security tools,...

Read More

Trustwave SpiderLabs: LockBit 3.0 Ransomware Most Common Malware Used to Attack the Manufacturing Sector

As the manufacturing sector continues its digital transformation, Operational Technology (OT), Industrial Control Systems (ICS), and Supervisory Control and Data Acquisition (SCADA) are becoming...

Read More

Trustwave’s Observations on the Recent Cyberattack on Aliquippa Water Treatment Plant

The attack last week on the Municipal Water Authority in Aliquippa, Penn., that gave threat actors access to a portion of the facility’s pumping equipment has spurred the Cybersecurity &...

Read More