Pete Finnigan's Oracle Security Weblog

There was a good blog post titled "The need to ensure that hashed password values are safe" picked up via my Oracle blogs aggregator that discusses Dennis's FPGA cracker and also the importance of not letting the password hashes out of your site.

Laszlo also emailed me today to let me know about http://marcellmajor.com/ - (broken link) Marcell Major's new brute force password cracker for databases that uses the CUDA framework for NVIDIA GPU's to implement the SHA1 algorithm for Oracle 11g database passwords and also SQL Server passwords. The cracker allows a password file to be used and also implements session handling so it can be easily used on security audits of databases. The http://marcellmajor.com/frame_cudadbcracker.html - (broken link) cudadbcracker page is here and the http://marcellmajor.com/cudadbcracker_binaries.zip - (broken link) cudadbcracker binary is here and the http://marcellmajor.com/cudadbcracker_source.zip - (broken link) cudadbcracker course code released under GPLv3 is here.