The possibility of dictionary attacks has previously been discussed. We
wondered how hard such an attack would be and found that a few lines of
Java code are sufficient.
With the attached code, little time and basic password lists, we were
able to get access to more than ten accounts with funds. Some of these
accounts had gotten money straight from the genesis block and some at
the time still contained >10,000 NXT.
We want to raise awareness how easy such an attack is, especially
because it can be performed offline. The code is entirely unoptimized
and achieves roughly 3000 tries/sec on a laptop computer. We realise
that the developers have added a warning in 0.3.13.
