open/close all folders
Anime and Manga
- Parodied in Lupin III: Crisis in Tokyo: on encountering a door secured with a password this way, Goemon concentrates, lets out a yell and brings his hand down on the readout. The password falls into place, and an impressed Jigen notes they should try their luck at Vegas. The end credits show them doing just that.
- Jinpei in the 1994 OVA of Science Ninja Team Gatchaman carried one of these as the hacker of the team.
- Detective Conan: Ran has Conan's phone, thinking he's Shinichi and her sent SMS being on it would prove the connection, and decides to crack the password. Birthdates aren't correct, so she decides to start with 0000 and proceeding one digit at a time. After a few hours of trying, she wonders if the password is "Sherlock" in number-format (4869 in Japanese pronounciation being Shi-Ha-Ro-Ku) and it turns out to be right.
- The Matrix both opens and closes with a scene of this, as the Agents lock in on the telephone number. Back in the pre-computer days, telephone routing systems really did use successive digits to determine routing (just as the first three digits still indicate the exchange, modulo number portability). However, this would have resulted in determining the digits from left to right, not randomly as shown in the movies.
- The first Mission: Impossible movie adaptation used a similar method back in the 90s, when this trope might conceivably have been Truth in Television.
- In Terminator 2: Judgment Day, John Connor has a program on his laptop computer that determines ATM PINs this way.
- WarGames may be the Trope Codifier. Near the end of the movie, WOPR tries to figure out the launch codes to the nuclear weapons, randomly locking in on digits as they scroll by the screen.
- Played completely straight by the terrorists in Bloodfist VI to crack the nuclear launch codes.
- Resident Evil. When Kaplan is trying to get the Red Queen's passcode to open the door to her chamber, the passcode appears one digit at a time.
Live Action TV
- In the Doctor Who episode "School Reunion", the code to take control of the universe is partly cracked like this. Micky prevents this from happening... by pulling out the plug.
- So Weird features a variation of this, when a Hangman cheating program is used to guess the name of a fairy. This doesn't work for either. Although Hangman does tell you the moment you get a character right, you only have a limited number of tries, and although it was explicitly stated that the fairy guessing game gave unlimited tries, there's no way the program could know if it got a character right.
- Vengeance Unlimited episode "Critical" — The Bad Guy of the Week and his unwitting genius accomplice play the slots to hack into a police mainframe.
- The final round of UK daytime gameshow Wordplay is this.
- In Lois and Clark, Superman did it at least twice — once with numbers, once with a word he knew was about Norse mythology.
- Season 8 of 24 has CTU cracking an encryption on a super duper ultra maxi encrypted file on a suspect's computer. The updates on how the decryption is coming consist of how many digits of the password have been cracked, and an unnecessarily large display on the wall shows their progress.
- Ash uses a gadget that does this to crack the four digit security code to the employee entrance at a bank in the Hustle episode "The Hush Heist".
- One of Artie's gizmos in Warehouse 13 is a steampunkish variant with a USB connector.
- CSI: NY: Used by a pair of car thieves to crack the security code on a Ferrari in "Cavallino Rampante".
- Leverage: Hardison uses one of these to crack the ten digit code on the electronic lock to the server room in "The Nigerian Job".
- Person of Interest: The Machine uses one in the Season 4 finale to determine the security code of an electrical substation.
- The old NES game Clash At Demonhead featured this after beating the final boss, where you had to crack the code for a bomb that would destroy the world. You (the player) had a number of chances of guessing the code. Each correctly guessed digit locks, and you had to guess the remaining.
- Used as a minigame in Fallout 3 and Fallout: New Vegas. When attempting to hack a locked terminal the player must attempt to guess the correct password from a list of random words and characters in four tries (up to seven if the player manages to find a set of symbols to reset their allowance). An incorrect guess will tell the player how many characters were correct.
- The James Bond game Nightfire featured a handheld gadget that did this so you could get through locked doors in the level. For some reason you push buttons on it as it's working at random intervals.
- Splinter Cell Chaos Theory has electronic lock hacking essentially like this. Except the player has to manually move the cursor over and secure the code fragments, making it a blend of Uplink and Klax.
- The brute-forcer program in the computer cracking "simulation" Uplink. This is deliberate: Uplink has far less to do with actual cybercrime than the movies Hackers, Sneakers and WarGames.
- In Vampire: The Masquerade – Bloodlines, this is the visual effect associated with using the "Hacking" skill on a computer terminal. Given the wide variety of systems represented by that single simple login prompt, this was probably the easiest option.
- At the beginning of Space Quest IV, the planetary coordinates of Roger Wilco's location on Magmetheus are displayed in this manner.
- After fixing a keypad's circuit board in Safecracker, the keypad automatically displays the correct code like this.
- Submachine does this at the beginning of the 6th game. The Edge's defense system checks for alerts by locking in 5 numbers on a 5x5 grid. The particular alert it finds in-game reads "Section 1 maintenance cart - unscheduled movement".
- Grand Theft Auto:
- In Grand Theft Auto: Chinatown Wars, when breaking into high-end cars, Huang Lee has to use his PDA to find the immobilizer's PIN in order to start the car without the alarm going off.
- In Grand Theft Auto V, if the player chooses the "Roof Entry" approach on the fifth heist, breaking into the FIB's west coast headquarters and wiping out incriminating data on Steve Haines, Michael De Santa has to use two programs in order to hack the terminal. The second program is a password cracker using the slot machine method.
- Sally and her hand-held widget hack into something of Robotnik's this way in Sonic Sat AM. A train and some acrobatics were involved in this scene as well.
- A giant binary version of this is used by ReBoot's Megabyte, twice. The first time he used it to hack into stolen files from Dot's organizer; files which happened to contain hundreds of binome PIDs. The second time he used it to extract a portal command from Phong's mind.
- Daemon's infected Guardians try this too, but fail when the "locked-in" numbers show up as little mouse symbols. Mouse is just that good.
- One episode of Godzilla: The Series had the Monster of the Week be a machine that attacked and hacked a nuclear silo to wipe out humanity by starting a nuclear war. It guessed the launch code this way.
- Some implementations of RSA encryption are vulnerable to an attack like this (called a timing attack). When a bit in the key is 1, the system must run a mathematical operation, which it skips if the bit is 0. Obviously, doing something takes longer than doing nothing. A persistent attacker can figure out the bits of the key, one at a time, based on this timing alone. Adding a random delay to each operation makes this attack take longer, but still work. Modern implementations fix this hole by delaying when the bit is 0 so it takes the same amount of time as a 1.
- Another related example was an early UNIX attack where you could tell how many characters in your attempt were correct by measuring how long it took, since the password check would only compare digits until it hit an incorrect one.
- The old WEP encryption standard for wi-fi networks was SO bad that hackers could actually mount an attack that guessed the key bytes one after another, and "locked in" them when successive guesses polarized towards some value. Not that different from the way Joshua tried to break in the missile silos...
- A Padding Oracle Attack is where a poorly configured web service will return a bad padding error when the attacker's guess of the last byte of the plaintext string is incorrect. The one value of the 256 available that does not return the error is the correct byte. On a CBC mode encryption scheme, the attacker than can then roll forward one byte and repeat the attack until the entire message is decrypted Slot Machine style.
- The Nintendo Wii's code signing system which prevents unlicensed programs from running on a non-debug console had a bug similar to the last one. The "key" (sort of like a password) was checked until a "NULL" byte was reached. A hacking group found that Zelda's key had a NULL byte fairly early, so they could bruteforce out to the null byte and didn't have to figure out the rest of the key. This exploit (called the "strncmp bug" because of the way the Wii used strncmp instead of memcmp [memcmp doesn't stop at null bytes]) paved the way for dozens of others, and nowadays you can run anything on the Wii.
- Additionally, the disc drive authentication protocol returns the message about an incorrect password immediately after each digit is guessed, making it trivial to figure out the password.
- The LanManager hash, used to store user passwords in all versions of Windows up to and including XP, is a form of this. It can't be broken one character at a time, but it is split into two 7-character chunks - which makes it vulnerable to simple lookup tables or plain brute force. For exactly this reason it was partially phased out in XP (maintained only for backwards compatability with NT 4 servers) and completely removed in Vista. note
- Wifi Protected Setup has the same mistake: it splits an eight-digit number in half, checks the first four digits, then checks the last four. Because of this and another mistake, it turns what should take 100,000,000 guesses into something that only takes 11,000.
- A bug in Windows 95/98/Me allowed an attacker to discover passwords for shared folders and printers in a very Hollywoodian way.
- Not that it needs to guess all of the characters in the first place.
- One old operating system allowed user programs to handle their own paging, swapping pages of memory in when not already present. The password verification algorithm on this system only read characters from the supplied password until the first character which did not match the correct password. Thus, a program could place a password such that the first unknown character appeared at the end of a page, with the next page swapped out; if the password verification read past that character, the program got asked to page in the next page, and it knew that character worked. Repeat for each character of the password. The fix, as in most cases, involved changing the password verification algorithm to always read the entire password, regardless of whether it matched or not.
- A significant number of poorly-designed cryptographic systems are vulnerable to attacks that work one character at a time, trying different characters in a position before moving to the next. This is often due to programmers who don't understand the difference between authentication and encryption. Most often, it is caused by a programmer using an encryption algorithm (designed to protect data from being read) to solve an authorization problem (where you want to protect data from forgery). This can also happen if a programmer designs a new authorization technique rather than using HMAC or an asymmetric key algorithm.
- "CRIME" exploit of two common security protocols. A text with two matching parts compresses better, thus if an attacker can supply one part and the rest is fixed, a short text can indeed be picked character-by-character, through varying the crafted part and looking which ones cause the compressed message length to drop.
- The Daily WTF had one example of a password system coded like that.