Back to Top

The Details:

Scenario:

As a part of authorized penetration tests of companies' internal corporate networks and external e-commerce websites, you have captured a large number of password hashes, and some encrypted files of various types. The hashes are from Active Directory, UNIX systems, LDAP servers, various web application and/or forums, routers, etc. As part of your analysis, your client has asked for password complexity statistics, what their users are doing right and/or wrong related to generating passwords, and identification of weak passwords. You only have 48 hours to complete this effort.

Logistics:

Prior to the start of the contest, KoreLogic will disseminate a set of files encrypted with a long random string, as direct downloads, torrents, or both. Once the contest starts, KoreLogic will publish the decryption string to unpack the files. This way, competitors can pre-download the contest files (some of which will be quite large) so that they are ready to go when the contest starts.

These will contain files of hashes of various types, and also various encrypted files (challenges / hints). Hashes will be things like MD5, Salted MD5s, Blowfish, SHA1, SHA256, SSHA, DES, MD5(md5), NTLM, etc. Challenge files will be encrypted .zip files, .doc's, private key files, truecrypt volumes, etc. (Many surprises and tricks as well).

The passwords will range from being "easy" to extremely difficult to crack. They are not simply randomly generated passwords, which would favor only the person or group with the most GPU/CPU bruteforcing horsepower. Instead, the password files contain passwords based on what we believe are challenging real-world patterns. Passwords will be of varying lengths, patterns, and complexity. Creative password cracking techniques, rules, dictionaries, and tools will be needed. The teams who are smart about the methods they use (i.e., teams who can crack more, with less work) will most likely be the most successful.

Challenge files are worth some points to crack, and then may contain other things: more password hashes inside, or hints that will help in cracking some of the password hashes.

The goal of the contest is simple: score the most points.

Types of Teams:

You have 2 choices in choosing how you compete:

• "Professional" Teams: Teams of people who want to complete for the cash prizes and all the glory of being the best password cracking team on the Internet. At least one member of each team must be physically located at DEFCON.
  
• "Street" Teams: Individuals or groups who are more casual. People who want to play around, small teams of 2-3 people who want to compete but don't want to be competeing with the "big guns". These teams are *NOT* eligible for cash prizes but are competing for bragging rights, and smaller prizes to be announced at a later date.
  

A winning team from each category will be announced at DEFCON closing ceremonies.

Scoring Points
Points are earned in two ways:

1. Each cracked password is worth some points, more points each for harder/slower hash types. For example, FreeBSD MD5 hashes are worth more than UNIX DES; bcrypt (blowfish-based) are worth more than FreeBSD MD5.
2. Some of the challenges are worth a chunk of points, some aren't. Some of the challenges will give hints about some of the plaintexts that may be helpful to crack efficiently (new to 2013 - see below).

The points per hash type, challenge, and bonuses will be announced at a later date.

Teams must provide their results directly to KoreLogic at multiple intervals during the 48 hour contest window. (See the HOWTO for details on how to submit.)

Hint Files
Along with encrypted password hashes, there will be some files/blobs (encrypted .doc or .pdf, encrypted disk images, etc). These, when cracked, will contain some hints about how some of the password plaintexts were generated. For instance, "Policy of 12-character minimum length" or "Requires two of upper case, lower case, numeric, and special characters" or "Many of our users are Swedish" would be helpful in cracking hashes that might otherwise be very dificult to find.

Hourly Challenges
Separate from the main contest, we will be tweeting one password hash every hour that the contest room is open. The first person to show up at the CMIYC contest table with the correct answer will win a small prize (limit one per human). You do not have to be registered or competing in the main contest to claim these prizes.

Rules:

For everyone competing, besides following the directions about how to register and submit (which will be posted soon):

• You MAY use as many systems/cores/GPUs/CPUs as you wish.
  
• You MAY use systems NOT located at DEFCON.
  
• You MAY work with other team members not attending DEFCON.
  
• You MUST ONLY use systems that you are authorized to use.
  
• You MUST NOT attempt to gain unauthorized access to any system used by KoreLogic or another team.
  
• You MUST NOT attempt to interfere with the efforts of another team.
  
• You MUST NOT attempt to steal passwords from or techniques/methods used by another team.
  
• You MUST NOT be on multiple teams or switch teams during the contest--we will assume you stole all the cracks from one or the other.
  
• KoreLogic staff are not eligible for the contest.
  
• The files containing the password hashes will not be released until the start of the contest.
  

For Professional Teams:

• Each professional team must have at least 1 (one) member physically at DEFCON
  
• To be eligible for a prize, you MUST agree to share your techniques / methodologies and describe the resources/tools used to crack the passwords afterwards.
  
• Professional teams roster of member must be FIRM before the start of the contest. There is *NO* trading of plain-texts between the professional and "Street" teams.
  

Any violation of the rules can result in immediate disqualification from the contest. Any illegal activity will be reported.

Differences from the 2012 Contest:

Please note the following differences from the 2012 contest:

• Encrypted files that contain hints about plaintexts or other hashes, and will be worth points by themselves. But there is no "race" to be the first to crack a given challenge file.
  
• Addition of "street" teams which are not competing for big cash prizes.
  
• Addition of hourly challenges, unrelated to the main contest hashes or prizes.
  

Results:

During the contest, KoreLogic will publish updated scores as often as possible.
After the contest ends, KoreLogic staff will validate each submission and will announce the winning teams on Sunday, (time TBD, but certainly before the DEFCON C&E Awards Ceremony). The eligible team with the highest score will be the winner. If there is a tie in total points, the team that submitted their entry first will place higher.

The winning teams will be required to write up their techniques / methodologies, describe the resources/tools used to crack the passwords, and describe any lessons learned.
At the conclusion of the contest, KoreLogic will:

• Announce the winners and award the prizes.
  
• Release the entire password list.
  
• Provide statistics on which types of passwords were totally missed by all teams.
  

Prizes:

KoreLogic will be giving away the following prizes for first, second, and third place in the "Professional" Devision:

• First Place: $600 (or equivalent item)
  
• Second Place: $300 (or equivalent item)
  
• Third Place: $100 (or equivalent item)
  

KoreLogic will be giving away the following prizes for first, second, and third place in the "Street" Devision:

• First Place: TBA
  
• Second Place: TBA
  
• Third Place: TBA
  

There will also be hourly prizes for first-to-crack challenge hashes, these are TBD but on the order of $20 each.
Good luck!

We will be announcing more details soon. In the meantime, please contact defcon-2013-contest@korelogic.com with any questions.