KoreLogic's Password Cracking Contest at DEF CON
Note: The DEF CON contest has finished

The Details:

Scenario:

Oh no! Your site has been breached! A million of your users' password hashes have been leaked. It's a good thing that you salted those password hashes. But now, you need to know what your risk is. You need to crack your own users' password hashes. So that you can inform the users that their data is at risk. But, you are in an arms race with the "bad guys". So, you better hurry. You only have 48 hours to complete this effort.

Logistics:

Prior to the start of the contest, KoreLogic will disseminate a set of files encrypted with a long random string as direct downloads, torrents, or both. Once the contest starts, KoreLogic will publish the decryption strings to unpack the files. This way, competitors can pre-download the contest files (some of which may be quite large) so that they are ready to go when the contest starts.

These will contain files of hashes of various types, and possibly also various encrypted files (challenges / hints). Hashes will be things like MD5, Salted MD5s, Blowfish, SHA1, SHA256, SSHA, DES, MD5(md5), NTLM, etc. Challenge files could be any kind of encrypted container file, or system OS image that you must figure out how to extract hashes from, etc.

The passwords will range from being "easy" to extremely difficult to crack. Passwords will be of varying lengths, patterns, and complexity. Creative password cracking techniques, rules, dictionaries, and tools will be needed. The teams who are smart about the methods they use (i.e., teams who can crack more, with less work) will most likely be the most successful.

The goal of the contest is simple: score the most points.

Types of Teams:

You have 2 choices in choosing how you compete:

  • "Professional" Teams: Teams of people who want to compete for all the glory of being the best password cracking team on the Internet.
  • "Street" Teams: Individuals or groups who are more casual. People who want to play around, small teams of 2-3 people who want to compete but don't want to be competing with the "big guns". Or big GPUs, whatever the case may be.
A winning team from each category will be announced at DEF CON closing ceremonies.

Scoring Points

Points are earned by cracking hashes and submitting plaintexts.

A twist this year is that every hash is a race. Each hash will be worth many more points for the first team that submits a crack for it. Teams should plan to submit often, and check the stats to see which hashes have been cracked by someone.

The points per hash type, and the "first" bonus per hash, will be announced closer to the contest. In general, slower, more difficult hash types are worth more points. For example, FreeBSD MD5 crypt hashes are worth more than UNIX DES; bcrypt (blowfish-based) are worth more than FreeBSD MD5. (However, the point-value ratios do not necessarily match the work-factor difference between the hash types.)

Teams are encouraged to pre-register. See the registration HOWTO for instructions on generating a PGP keypair and registering a team.

There are also some test hashes available at the download page that teams can crack and submit to test out their submission pipeline and the stats page and list of cracked hashes.

Rules:

For everyone competing, besides following the directions about how to register and submit:
  • You MAY use as many systems/cores/GPUs/CPUs as you wish.
  • You MAY use systems NOT located at DEF CON.
  • You MAY work with other team members not attending DEFCON.
  • You MUST ONLY use systems that you are authorized to use.
  • You MUST NOT attempt to gain unauthorized access to any system used by KoreLogic or another team.
  • You MUST NOT attempt to interfere with the efforts of another team.
  • You MUST NOT attempt to steal passwords from or techniques/methods used by another team.
  • You MUST NOT be on multiple teams or switch teams during the contest - we will assume you stole all the cracks from one or the other.
  • KoreLogic employees are not eligible for the contest.
For Professional Teams:
  • To be eligible to be named as a "Winner", you MUST agree to share your techniques / methodologies and describe the resources/tools used to crack the passwords afterwards.
  • Professional teams roster of member must be FIRM before the start of the contest. There is NO trading of plain-texts between teams.
We do not necessarily require the member lists of Pro teams before the contest starts, but teams should not combine (or split apart) during the contest; we may disqualify one or more parties in such a situation.

Any violation of the rules can result in immediate disqualification from the contest. Any illegal activity will be reported.

Differences from previous contests:

Please note the following differences from previous contests, discussed in greater detail in the relevant HOWTOs:
  • Each hash will be worth more points to the first team to crack it, than to any subsequent team.
  • Instead of submitting all cracks every time, we only need new cracks each time. We provide some feedback when a submission is processed, and publish a list of hashes that have been cracked, so that teams can detect if their submissions are failing for some reason.
  • Instead of submissions being only one plaintext per line, we want hash:plaintext in "potfile" format. Either hashcat potfile (bare hash:plain or JtR potfile (decorated hash:plain) is acceptable.

Results:

During the contest, KoreLogic will publish status and statistics, and a cumulative list of all hashes that have been cracked by somebody.

We anticipate the heaviest server load at the very beginning and the very end of the contest. At those times, updates may be slow to process, but they will be handled in order as fairly as we can manage. If there is a slowdown, it should impact all teams equally, and if we detect a team trying to deliberately degrade the experience for others, we will take action.

After the contest ends, KoreLogic staff will validate each submission and will announce the winning teams on Sunday, (time TBD, but certainly before the DEFCON C&E Awards Ceremony). The eligible team with the highest score will be the winner.

We invite all teams that participate to write up a post-event report. The teams with the most points will be required to write up their techniques / methodologies, describe the resources/tools used to crack the passwords, and describe any lessons learned, in order to be officially declared winners.
At the conclusion of the contest, KoreLogic will:
  • Announce the winners and award the prizes.
  • Release details about the plaintexts.
  • Provide statistics on which types of passwords were cracked vs missed.
Good luck!

We will be announcing more details soon. In the meantime, please contact defcon-2018-contest@korelogic.com with any questions.