Almost two years ago, the Specops research team analyzed how long it took to crack passwords hashed with the bcrypt algorithm.
Using newer, more powerful hardware, the researchers revisited that previous research creating a new table of Bcrypt cracking times in this just-published report Cracking bcrypt: New-gen hardware speeds up password hacking. The reason for the revisit is two-fold: the AI boom causing a glut of consumer hardware, as well as the arms-race in consumer graphics performance.
The focus on compute power for both consumers and enterprises whether for general purpose compute (GPGPU) or training LLMs has caused arguably all three major graphics vendors to focus more heavily on compute performance than they may have in the past. This shows in the performance of Nvidia’s recent 50-series, as well as AMD’s upcoming transition to the ‘UDNA’ architecture. Specops research team investigated what this boom and renewed focus on compute means for the difficulty of cracking a leaked password hash, and the future security of passwords.
Short, non-complex passwords can still be cracked relatively quickly, highlighting the huge risks of allowing users to create weak (yet very common) passwords such as ‘password’, ‘123456’, and ‘admin’. However the high cost factor of bcrypt makes longer passwords extremely secure against brute force attacks thanks to its slow-working hashing algorithm. Once a combination of characters are used in passwords over 12 characters in length, the time to crack quickly becomes a near-impossible task for hackers. This shows the value of enforcing longer passwords.
This research coincides with the latest addition of over 70 million compromised passwords to the Specops Breached Password Protection service. These passwords come from a combination of our honeypot network and threat intelligence sources.
To view the complete Specops research report, visit Cracking bcrypt: New-gen hardware speeds up password hacking
Microsoft Seizes 338 Sites to Disrupt RaccoonO365’ Phishing Service
Posted in Commentary with tags Microsoft on September 16, 2025 by itnerdToday, Microsoft’s Digital Crimes Unit said it disrupted RaccoonO365, the fastest-growing tool used by cybercriminals to steal Microsoft 365 credentials, by seizing 338 websites associated with the popular service and cutting off criminals’ access to victims.
Microsoft posted a blog post on the seizure here: https://blogs.microsoft.com/on-the-issues/2025/09/16/microsoft-seizes-338-websites-to-disrupt-rapidly-growing-raccoono365-phishing-service/
Erich Kron, security awareness advocate at KnowBe4, commented:
“Clearly, email phishing continues to be a major threat that organizations face on a daily basis. Phishing services make it far easier for unskilled attackers to be able to play in the cybercrime game, while not necessarily being cyber savvy themselves.
“Credential theft through phishing can be especially dangerous because people tend to reuse passwords across different accounts and services, meaning, if a bad actor can trick someone out of their password, they may not only have access to that account, but others as well.
“The social engineering threats drive home the reason that organizations need to have a well-established human risk management (HRM) program in place that will educate users on ways to spot fake login pages and help them understand why credential reuse is so dangerous. In addition, MFA should be deployed wherever possible to make things even tougher for attackers in the event they do steal someone’s credentials.”
This blog post is very much worth your time to read as it shows how threat actors are evolving to be increasingly more effective and dangerous.
Leave a comment »