GPU: Compute Power, Password Cracking, and the Attack Vector Nobody Patches

The GPU was built for graphics. It became the most powerful password cracking tool ever created. It is also one of the least monitored components in your security stack.

WHY IT MATTERS FOR SECURITY

A modern CPU has 16–32 high-performance cores. A modern GPU has 4,000–16,000 shader cores running in parallel. For the same operation repeated across millions of inputs — the GPU wins by 100x.

Password hashing is exactly that kind of workload.

WHAT THIS MEANS FOR CREDENTIALS

MD5 hash rate on a single RTX 4090: 164 billion hashes per second. bcrypt (cost factor 10): 184,000 hashes per second — by design.

An attacker with one consumer GPU can: — Exhaust the 8-character alphanumeric keyspace in under 1 hour using MD5. — Process billions of NTLM hashes per second — the format Active Directory stores locally. — Crack a 10-character MD5 password in hours with a wordlist and rules.

MD5, SHA-1, and NTLM are broken at scale by consumer hardware. bcrypt, scrypt, and Argon2id provide real resistance. 16+ characters against bcrypt: decades. 8 characters against MD5: minutes.

HASHCAT AND REAL ATTACKER BEHAVIOR

Hashcat is open source, GPU-accelerated, and the industry standard. Red teams and attackers use the same tool on the same hardware. The RTX card running your ML pipeline is identical to the one cracking your password dumps.

COVERT CRYPTOMINING

GPU-targeting malware runs silently on endpoints. A GPU at full mining load draws 300–400W continuously. Fan noise rises. Power spikes. Performance drops. Yet most EDR tools do not monitor GPU process allocation.

Detection: — Monitor GPU utilization via nvidia-smi or WMI GPU counters — Alert on sustained high GPU load from unexpected processes — A workstation with no ML workload should idle near 0% — Sustained 90%+ GPU load from an unknown process is an incident

GPU MEMORY ISOLATION GAPS

GPU VRAM lacks the same protections as system RAM. On shared workstations, VRAM from one process may be readable by another after deallocation. Multi-tenant environments amplify this risk.

PRACTICAL STEPS

• FOR DEFENDERS — Enforce bcrypt or Argon2id in every application storing passwords — Audit whether NTLM is disabled or restricted in your AD environment — Add GPU utilization to your endpoint telemetry baseline
• FOR RED TEAMS — Include GPU-accelerated cracking in your credential testing methodology — Benchmark your password policies against current GPU crack rates — Hashcat rule sets model real attacker behavior, not brute force alone

A consumer GPU is the most powerful offline attack tool ever accessible without a data center budget.

Is your password policy benchmarked against current GPU crack rates?