I was watching The Girl with the Dragon Tattoo, and this female hacker was really good at hacking. My question is, how is it possible for her to crack passwords besides the brute force approach? I can't think of anyway besides it. And if that's the case, then why do movies make hackers out to be geniuses, if there isn't any way of doing it?

  • 2
    In once scene she was writing SQL, which i thought was pretty leet, although there was no mention of sql injection... – rook Jan 25 '12 at 22:05
  • I think she was just connected directly to the sql console or had a offline db copy. – Krzysztof Kotowicz Jan 26 '12 at 11:11
  • 3
    It's worth pointing out, while this isn't reflected in the movie, if an attacker has physical access to the machine, even for a short while, the there's very little that can stop him from taking control of it. – tylerl Feb 13 '12 at 6:25

First, movies are unrealistic in these regards. It's no different than the "realism" of zooming in on security cameras and cleaning up the images. It's just not realistic, but it makes for good entertainment and helps with plot advancement.

However, that said, there are plenty of people with easy-to-guess passwords. I know plenty of otherwise intelligent people who don't bother with good passwords, don't change them frequently, etc. Intelligence is no deterrent to bad password management, and therefore, super-villains and bad guys are just as likely to have easy-to-guess passwords.

If I were to try to crack into an account without brute force, I'd start with the basic easy-to-guess passwords, and count on the stupidity of the people I'm trying to hack. Or I'd resort to social engineering. "I'm from the helpdesk and I need to get rid of a virus on your PC. Can you give me your username and password so I can log in and do it?" (You'd be surprised how many people fall for this.)

An easy way to induce "willing suspension of disbelief" for the sake of password cracking in the movies, I tend to favor the "weak password" scenario as it's the most realistic.

| improve this answer | |
  • 1
    That said, zooming in on security camera footage or random images is possible if the resolution of the recorded image exceeds that of the display. But once you exceed the available pixels extrapolation will only get you so far. – Xantec Jan 25 '12 at 16:23
  • 3
    True, but in my experience, most systems have a much lower resolution on the camera than your average PC display. Perhaps high-end ones, or military-grade cameras are a different story, but most commercial camera security systems just don't have that high a resolution. (We often have to try to read license plates from our systems where the cameras are less than 15 yards away and it's hard.) But our systems are around 5 years old. They could be better now. – David Stratton Jan 25 '12 at 16:26
  • And we're not even considering people using the same word for both their login and password... – Bertrand Moreau Jan 25 '12 at 17:26
  • 2
    "weak password" that's amazing, I've got the same password on my luggage! – Ben Brocka Jan 25 '12 at 22:20
  • 1
    I think David was talking about the CSI security camera work where they take an ATM's camera feed, look across the street and adjust the angle, then increase the resolution to 4k and read the license plate. While your 5 year old cameras are old, they are not that old, if you can actually make out some of the license plate out. – Ramhound Jan 26 '12 at 13:02

Pretty much all the hacking techniques in the Girl With The Dragon Tattoo are real and used regularly by not only the bad guys, but also law enforcement, penetration testing teams, and security auditors. (caveat - I read the book and watched the original film...they may have changed everything)

Sure, Hollywood dramatises them, but in this case, not by much. I have managed teams of individuals who can do the things shown in this film, and in my dim and distant past, I did some of them myself.

Regarding video feeds from CCTV cameras, there are now a few companies with systems that pull information from multiple frames to interpolate/extrapolate high quality stills. But no, you can't turn the view round to face the opposite direction the camera was facing (Enemy of the State). And you can't zoom in and pan indefinitely (Blade Runner)

| improve this answer | |
  • 1
    Or zoom in on a water droplet from across the street as per Red Dwarf. :-) – logicalscope Jan 26 '12 at 5:53
  • 1
    The hacking part was much more Hollywood-ish in Fincher's version. My favourite was mentioning that the (OS X) laptop (HDD? OS? home dir?) is encrypted and leaving it logged in numerous times during the movie. Even the screensaver didn't force the login prompt. – Krzysztof Kotowicz Jan 26 '12 at 11:17

In almost every computer security paradigm the weakest link is the human portion. Some security algorithms are just plain bad which helps hackers. Social engineering and stupidity go a long way toward making hackers look really good before suspension-of-disbelief is required too.

Here is an interesting calculator that gives you a rough idea of different computing power scenarios and how long a brute-force attack would take.


Using a password like "power" you get a result of less than a millionth of a second with an array of computers designed for brute-force and a worst-case online attack time frame of less than 4 hours. On the other hand a password like "1We^gold" gives a simulated attack time of 1.12 minutes with the same super-computer, but over two thousand centuries using an online dictionary based attack.

All that to say, on one hand ANY password that doesn't lock out guesses can be brute-forced on a long enough timeline or with enough computing power. The Hollywood question then becomes, is it easier to convince the audience that the password was weak or that the hacker has access to a super-computing array? The second option would be nice for a change, but usually the issue is either just ignored or explained by the target's weakness.

| improve this answer | |

A variation on brute-force (dictionary) type attacks target password hashes in databases. One (possibly plausible) method alluded to here using databases and passwords is a Rainbow Attack.

Using a set of pre-computed hashes with a poor salt and fast/weak hash scheme (like MD5) that matches the hashing scheme in the database of passwords can result in a set of matches pretty quickly without having to use super-computing resources.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy