The brute force attack journey: from GPU dominance to CPUs as workhorses… and back again.

Author:Magnus Johansson – Professional Services at MSAB

When a mobile device is locked and access is required for a legal forensic examination, brute force attack—systematically trying passcodes—may be the last resort and, in some cases, the only viable method. In these situations, speed is key: the faster a valid code is recovered, the sooner investigators can continue, advance cases, and reduce backlogs. Over the years, the brute forcing landscape has changed drastically. Mobile operating systems and key derivation algorithms have defined how we address this challenge.

En MSAB hemos seguido de cerca esta evolución y también hemos contribuido activamente a ella. Nuestro recorrido con la tecnología de fuerza bruta refleja cómo ha madurado la informática forense móvil: desde las primeras soluciones basadas en GPU, pasando por el cracking distribuido con CPU, hasta el regreso a la aceleración por GPU con el lanzamiento de BruteStorm Surge.

Around 2016–2017, when I moved from IT to Professional Services at MSAB, I led numerous Access Services operations and supported clients of the Advanced Acquisition Lab (AAL), the predecessor of XRY Pro. At that time, most of the devices arriving were Huawei and other Android phones, usually with versions up to Android 8.0. For those machines we relied heavily on GPU acceleration using the open source Hashcat software. GPUs are extremely efficient for the parallel math operations used in many hashing and key derivation functions, and with well-configured GPU rigs we could achieve extremely fast password recovery times.

Everything changed with the implementation of Huawei's Android 8.1. Until then, Huawei devices were among the most successful when processed with Hashcat and GPU acceleration. Device security updates made GPU cracking ineffective for a wide range of modern devices. Virtually overnight, GPU-based brute forcing became unusable for many Android devices, and we were forced to rethink our strategy.

To overcome that limitation, MSAB developed DBS (Distributed Bruteforcer Software), the CPU-based predecessor of what would later become BruteStorm. DBS could run on virtually any system and aggregate the processing power of multiple computers into a coordinated task. Its client/server mode allowed office machines to contribute available CPU cycles to the same brute force job. Still, CPU clusters couldn't come close to the performance of a modern multi-GPU rig.

GPUs were left behind because kernels must be tailored specifically to each hashing implementation. Manufacturers constantly strengthen device security, and when internal protections change, GPU-based approaches may not work until new support is developed. That was the practical effect of Android 8.1 on Huawei: algorithmic changes that effectively blocked GPU acceleration for certain classes of devices. For years, the industry relied on CPU-based solutions, which were versatile but much slower.

Now, however, GPU acceleration is back. BruteStorm Surge is a custom version of Hashcat that incorporates the necessary patches and optimizations for modern Android targets, including devices with FBE. Returns the raw computing speed offered by GPUs to the process.

The return of GPU acceleration has huge practical implications. A single high-end GPU can perform password cracking about a hundred times faster than a CPU, depending on the algorithm and configuration. Additionally, adding GPUs typically scales performance almost linearly in many workloads: two similar GPUs double performance, three triple performance, and so on, until other system bottlenecks (memory bandwidth, PCIe) appear. This means that an attack that would take hours or weeks on a CPU cluster can be completed in minutes or hours on a GPU cluster. As an example: a rig with many cutting-edge GPUs can reduce runtimes of several years on CPUs to just a few hours, although the exact numbers depend largely on the hardware and attack configuration.

Looking back, it's clear how far this field has come. In 2017, when Huawei's Android 8.1 deployment forced the forensics community to abandon GPU-based cracking, MSAB responded by creating a distributed CPU-based solution that allowed analysts to continue operating. Today, with BruteStorm Surge, we have come full circle, combining the enormous compute advantage of GPUs with the reliability and forensic rigor that characterize the MSAB approach.

This new generation of GPU-powered brute forcing is more than a technical milestone. It's a reminder that forensic tools must continually evolve along with the devices and algorithms they target. Our goal remains the same: to offer our clients legal, efficient and reliable access to digital evidence, wherever technology advances.

read it inmsab.com