In brief
A product talk about the MK Brute Force module — password cracking inside Mobile Criminalist. The speaker is both MKO's marketing director and the head of development of the module (in her words, a "split personality as a marketer"). The gist: cracking is either a dictionary or a mask, "a mask head-on" is not an option; first the dictionary, then a partial mask — 7.5 hours versus 11 seconds in the demo. For forensic experts and law enforcement.
Key points
- Popular passwords: qwerty, password, guest, admin/admin; Russia 2023–2024 — "Baltika 9", "Sotochka", home and cell phone numbers — "for brute-forcing that's good".
- Any cracking is either a dictionary or a mask; the recommendation to the room — 2FA, always.
- A dictionary is a pre-loaded set of strings (popular ones, leaked ones, self-made ones); faster, but it is unlikely to crack a "safe" password; indispensable for PINs and patterns. The third method is a "dictionary based on personal data": the password manager supplies the data from the extraction (personal data, the first part of emails, phone numbers, surnames) → a dictionary.
- Do not use "a mask head-on": 26 lowercase + 26 uppercase Latin letters + 10 digits + "plus 33, I think, special characters". For 10 characters (approximately): lowercase — 141 trillion, plus uppercase — "more than three quadrillion", plus digits — "more than a quintillion".
- A mask in MK is set with hashcat commands (a fixed value at the beginning or the end,
?a— any character); the speed depends on the GPU/CPU (faster on the GPU) and on the "heaviness" of the hash. - A demo on a ZIP: the hash was recognized automatically, the dictionary (100,000 passwords, GPU) — a miss. A 7-character mask (uppercase and digits): "head-on" — 7.5 hours; a partly custom-written one (3 random + 4 fixed digits) — MFD2025 in 11 seconds; realistically (3 random + 4 digits to crack) — ~51 minutes. The heaviness of the hash is critical: Telegram Local Passcode and Huawei HiSuite are encrypted differently — "much longer".
- The module is a light GUI on top of the interface-less (CLI) hashcat, to lower the barrier to entry; hashcat 7.0 has come out — "we'll soon build it".
- The hash in hashcat format: archives and office documents — in MK Brute Force itself; Telegram Desktop passcode, BitLocker, NTLM — through MK Scout; mobile backups and Apple Notes — through Mobile Criminalist (the "Crack" window).
- There is a free version (mobile via a QR code, desktop from the website); FBE/FDE are not supported ("my pain point"). There is no distributed cracking: the target is the first half of 2026, "I'm not promising anything" (first the core, up to hashcat 7.0).
Tools, artifacts, technologies
- MK Brute Force (the hashcat CLI engine, version 7.0 released; a free version without FBE/FDE), Mobile Criminalist (backups, the cracking window), MK Scout (passes hashes on), the built-in password manager.
- Types: ZIP archives, office documents, Telegram Desktop passcode, Huawei HiSuite, BitLocker, NTLM, Android/iTunes/HiSuite backups, Apple Notes; the demo — a ZIP with the password MFD2025.
- GPU/CPU, distributed cracking — planned; rainbow tables — from the Q&A; AI for dictionaries — an external trend.
Legal and organizational context
No Criminal Code articles and no departmental methodologies were mentioned. What was stated was a ban on building AI into Mobile Criminalist, with a reference to the legislation. The speaker refused to name the provision ("won't answer this question from a legal standpoint") and justified it by architecture rather than by law: MK does not accumulate the user's data, the vendor gets nothing back, and training an AI requires data to come back — "and that would not be good". The moderator Dmitry Yankovoy asked people to put their phones away and not to film — there will be a recording.
Questions from the audience
There is no speaker labeling; lines from the audience without a microphone were transcribed worse, and the names are by ear.
- Ilya (two questions): cracking a physical Android image in the free app; a manual start if it does not begin after the import. → FBE/FDE are not in the free version; if it is not supported — write to support, with the device model.
- San Sanych (by ear): when will distributed brute-forcing come? → The first half of 2026, with no promises.
- San Sanych: have you tried AI for cracking passwords? → No, building it in is prohibited; the idea is "closer to rainbow tables".
- An audience member (name not given): which specific provision prohibits AI? → She will not answer from a legal standpoint; the substance — the data does not go back to the vendor.
- Ilya Anatolyevich (by ear): how do you build a dictionary out of the device's data? → The "dictionary based on personal data", the password manager.
The speaker's position
Her rule is clear: "a mask head-on" is not on, the right way is meaningful hypotheses and dictionaries updated in time. She admits the limitations herself. The tone is a self-ironic presentation, not a polemic; she argues with the room's expectations about timelines and AI.
Quotes
- "Unfortunately, among ordinary users — and fortunately for us forensics people — it usually isn't followed."
- "A head-on mask — I'll say it right away, don't use a mask head-on."
- "…first we run through a dictionary, then we add a mask."
- "…building artificial intelligence into Mobile Criminalist is prohibited. The legislation would object."