So I had a password protected PDF file which unfortunately I had forgotten the password for. Knowing some attributes of the password, I had a feeling it would be fairly quick to perform a brute-force method to crack the password. So I used the power of Google to find a free PDF password cracking tool. Yes, this is perfectly legal.
It turns out that this particular tool was originally written for Linux, but someone had graciously used CygWin to compile a Windows version so I could run it on my Windows PC. []
So background for the non techies: A brute-force method is one that essentially tries every possible combination until it succeeds. For something like a PDF file, which is resident on the computer running the algorithm, it can be quite fast.[] In fact, it is SO astonishingly fast that I was inspired to write this blog post.
So my relatively fast, but far from state-of-the-art Pentium 4 machine clocks in at 3.4GHz and has 3GB of RAM. [] This is pretty quick for a single core computer, but quite slow relative to the multi-CPU machines that are readily available today. Anyhow, my ordinary PC can test approximately 41 thousand passwords per second. To put that in perspective, consider a 5-digit random password containing upper-case letters, lower-case letters and numbers (62 different characters per digit). There are precisely 916,132,832 different passwords that can be made this way.[] At the speed of my computer, I can crack ANY 5 digit password following these rules in just over 6 hours. Smaller passwords take less than 6 minutes. Consider that a typical 4-digit numerical ATM card PIN would take a mere quarter of a second to crack.[]
The lesson here is that with a room full of computers (or networks of computers), cracking even significantly longer passwords comes into reach. Using lists of common words, names, etc. (i.e. dictionary attacks) are obviously even faster. This is why your passwords should be A) long, B) contain lots of different characters C) not be common words or phrases and D) not be the same everywhere you use them.
Oh, I remembered that the passwords on the PDF files were numerical and relatively short, which makes for a pretty weak password, but it was sufficient for this need. It took far longer to install the software than it did to crack the password.