If I see a user on my system running crack or any of its variants several things are going to happen. First, I am going to kill their process. Second, I am going to lock their account. Third, I am going to file a report of a security breach. It is up to management to decide what to do with that person.
Most sites have appropriate usage statements in place for their computer resources.
Using CPU cycles to try to break someone else's password may not be an appropriate business usage unless you are responsible for the security of the system. Unless you personally paid for the computer and software running on it someone else will decide what constitutes legitimate activity and what is an attack. Someone could make an interesting argument that Doom played over the network by a few individuals constitutes a denial of service attack.