Brief forays in to the world of brute force hacking (an ether wallet)

So recently as the price of cryptocurrencies rose I remembered I had brought some Ether and stuffed them in a “wallet”, as the digital currency savvy folk call them, which was protected by passwords. Password that the 4 year ago me was very careful to select and promptly forget.

I first fished out my wallet keystore(also called UTC file) file which held my private key encrypted by my password. The private key is everything to the wallet (and more importantly the Ether) so at least part of the wallet was saved. I loaded up my wallet in a safe to use (being very careful I’m not landed somewhere else) web app called https://www.myetherwallet.com/ . They improved it impressively since the last century I used it. So all that remained was just a password and some forgotten money was mine to spend frivolously again.

I tried the first several million password combinations that came to mind to no avail. Ethers were just out of reach. So I did the next best thing and succumbed to my lazy side and contacted Ether recovery people that operated on a Trust basis and asked them to “hack” my password. One needs to send their wallet UTC file and some possible old passwords they remember. They take a %20–30 commission on whatever is in your wallet although they can take everything since after they crack your password, the wallet is essentially theirs to do as they please. This, while satisfying my lazy side, did not sit well with the stubborn, the stingy and the ever hungry challenger side which disapprovingly shook his head. I gave up and decided to “brute force” my own password.

“How hard could it be? I’m an experienced software everything, I’ll roll my own brute forcing tool with blackjack and…” the musings of the fool and unwise me were cut short as I wrote “how to brute force ether wallet” to google and was greeted with this.

so no need to roll my own, unexpected

I will not go into the details of the many tools that did not work correctly, most others that were for something else and some that I could not even use but there were indeed many opensource brute forcing tools out there. The one that worked was this: https://github.com/lexansoft/ethcracker.

Ethcracker works with your UTC file, whatever password you could remember and pretty much nothing else. So running the below command, I started my first decent try;

ethcracker211 -pk forgottenmaybepasslist.txt -t mydamnwallet.json

forgottenmaybepasslist.txt is a simple text file with your remembered passwords in new lines, at least in parts. ~c means “it may start with a capital letter I don’t remember.”

~c a
~c b
~c c
~c …
1
2
3

…
!

…

So passwords generated would be any combination of the above lines with some capital versions thrown in. Naturally my first password list file was all characters, all numbers and symbols. At first run I got to see that I would most likely cracking the password around the time of the heat death of the universe, which would not do. Also there was a chance of repeating letters or numbers so I had to add those explicitly to the list. That meant even several universes later I would most likely still be looking for the password.

I then tried a more reasonable approach and narrowed my password list.

~c If
~c I
~c reme
~c mber
1
2
3
!

The result was a more reasonable 4 years left which was, ok I guess but still not good enough.

4 years? No

Next was a finer tuned password list including almost only the values I wanted to be lookingfor , which turned out a 12 hour wait time. I have to say I had 0 hopes of it working, yet somehow, it worked with only a single congratulation but it was all that was needed.

But, a miracle!

I Immediately transferred my ether to a safer, more under control wallet, thanked my cpu and emailed the fine hacker folk that their services were no longer needed and I was also a haxor.

In short, I got extremely lucky blundering through the brute force world and learned a few valuable lessons.

• Make passwords that you can remember whenever
• If your accounts contain the same letters and such but in different places, your other accounts can be hacked if you become a target
• NEVER share your digital currency wallet files unless you are poor like me
• Occasionally recheck if your wallet is still alive and everything works
• Take your time researching something before you dive headlong to it.