05-27-2013, 12:34 PM
Hey Guys!
In the last days I was asked couple of times what my opinion on the PHD contest was. It's my personal opinion and may not show the opinion of all team hashcat members.
In my opinion the contest wasn't a real password cracking contest and I'm not saying this because we did not win.
One have to know, there is one major problem in password cracking contests:
Password cracking depends on hardware, like it or not.
To deal with this problem the organizers decided to allow unlimited teamsizes.
That was a clever move of the organizers. Each team now had a good chance to collect the required hardware power by adding members.
But this time the organizers tried to solve the problem with a different approach: It was by not using real-life passwords but instead they created password "pattern". Such patterns have been seen in the past as well but this contest was all about it.
Let me try to explain:
Once a single password was cracked because it hits a words from your dictionary one can try to figure out the pattern that was used to generate it.
If it's the correct pattern one can generate the missing candidates and will crack all the hashes based on that pattern.
Take the bcrypt's for example. Once we found out that the pattern were like:
It's easy to crack all the hashes. That's the reason why the teams were able 100% of all the hashes.
So here's my critic on that:
Organizers lost the focus on the reason why password cracking contests have been made initially
The organizers, usually IT-security companies, wanted to improve their cracking techniques they use in a pentest. They have to find a way to deal with a problem that "breaking" hashes is theoretically not solveable except using brute-force techniques (which takes to long).
The only reason why we're able to crack passwords at such high rates is that most of them are of very simple or medium entropy. Humans do make bad passwords and hashcat is designed to exploit this very efficiently.
When the organizers choose to not use Real-Life passwords they took away one of hashcats key strengths.
Password pattern do not mirror a real-life situation in a pentest
In real-life situation you do not crack 100% of an unknown list. Especially not if it is salted, highly-iterated or use bcrypt or sha512crypt.
A password cracking contest can therefore not base on pattern-finding. Make it a pattern-finding contest then.
Organizers failed to rewrite the rules 1
The idea to give differnt amount of points for different algorithms goes back to CMIYC where the organizers realized that it takes more time to crack bcrypt than to crack MD5. In this case it's correct. The factor is time.
However, it doesn't matter if the pattern you figured out is hashed with bcrypt or md5 since the time it takes to verify does not differ a lot. Therefore there is no sense in giving different points to different algorithms.
Organizers failed to rewrite the rules 2
The number of unlimited team-members bases on the approach to solve the hardware problem. Since this contest was designed so that there is no hardware problem there is no sense in having unlimited membersize, but they still allowed it.
Organizer failed to solve the problem they wanted to solve with their system
So they tried to workaround the teamsize and hardware resource problem by using pattern.
But take a look at the result. There are the 3 teams that are always in the top 3. Nothing changed!
Organizers failed to organize
The contest started officially at 09:00 pm. But guess what, there was no hashlist.
An hour later I was wonder what is going on. So I was searching for #hashrunner on twitter and then found a tweet from a guy who was giving an ip address where the hashlists are.
The crazy thing was they actually were there while on the main contest page there was no info about it (and there is still not).
The upload system had to be fixed, the upload server was often down. That just shows that it hasn't been tested well before going into the contest.
I had the feeling it was rewritten couple of times during the contest as this one shows: http://twitter.com/repdet/status/337821155689893888
When the contest ends, there was no final message from the organizers. They just let all the teams sit in the dark.
There have been "normal" passwords in the contest as well
It wasn't just generated passwords. But then cracking the real passwords had no effect in the point rating. The algorithma that give the required points to win a contest all based on pattern.
There should be no hints
Since there are no such hints in the reality.
My conclusion is the following
I do not like the fact that password cracking contests depend on hardware. But there is no sense in avoiding this.
Find a better way to deal with it but do not lose the focus why we're doing this.
--
atom
In the last days I was asked couple of times what my opinion on the PHD contest was. It's my personal opinion and may not show the opinion of all team hashcat members.
In my opinion the contest wasn't a real password cracking contest and I'm not saying this because we did not win.
One have to know, there is one major problem in password cracking contests:
Password cracking depends on hardware, like it or not.
To deal with this problem the organizers decided to allow unlimited teamsizes.
That was a clever move of the organizers. Each team now had a good chance to collect the required hardware power by adding members.
But this time the organizers tried to solve the problem with a different approach: It was by not using real-life passwords but instead they created password "pattern". Such patterns have been seen in the past as well but this contest was all about it.
Let me try to explain:
Once a single password was cracked because it hits a words from your dictionary one can try to figure out the pattern that was used to generate it.
If it's the correct pattern one can generate the missing candidates and will crack all the hashes based on that pattern.
Take the bcrypt's for example. Once we found out that the pattern were like:
- Indigo -> 1nd1g0?d?d
- Orange -> 0r@ng3?d?d
- Blue -> Blu3?d?d
It's easy to crack all the hashes. That's the reason why the teams were able 100% of all the hashes.
So here's my critic on that:
Organizers lost the focus on the reason why password cracking contests have been made initially
The organizers, usually IT-security companies, wanted to improve their cracking techniques they use in a pentest. They have to find a way to deal with a problem that "breaking" hashes is theoretically not solveable except using brute-force techniques (which takes to long).
The only reason why we're able to crack passwords at such high rates is that most of them are of very simple or medium entropy. Humans do make bad passwords and hashcat is designed to exploit this very efficiently.
When the organizers choose to not use Real-Life passwords they took away one of hashcats key strengths.
Password pattern do not mirror a real-life situation in a pentest
In real-life situation you do not crack 100% of an unknown list. Especially not if it is salted, highly-iterated or use bcrypt or sha512crypt.
A password cracking contest can therefore not base on pattern-finding. Make it a pattern-finding contest then.
Organizers failed to rewrite the rules 1
The idea to give differnt amount of points for different algorithms goes back to CMIYC where the organizers realized that it takes more time to crack bcrypt than to crack MD5. In this case it's correct. The factor is time.
However, it doesn't matter if the pattern you figured out is hashed with bcrypt or md5 since the time it takes to verify does not differ a lot. Therefore there is no sense in giving different points to different algorithms.
Organizers failed to rewrite the rules 2
The number of unlimited team-members bases on the approach to solve the hardware problem. Since this contest was designed so that there is no hardware problem there is no sense in having unlimited membersize, but they still allowed it.
Organizer failed to solve the problem they wanted to solve with their system
So they tried to workaround the teamsize and hardware resource problem by using pattern.
But take a look at the result. There are the 3 teams that are always in the top 3. Nothing changed!
Organizers failed to organize
The contest started officially at 09:00 pm. But guess what, there was no hashlist.
An hour later I was wonder what is going on. So I was searching for #hashrunner on twitter and then found a tweet from a guy who was giving an ip address where the hashlists are.
The crazy thing was they actually were there while on the main contest page there was no info about it (and there is still not).
The upload system had to be fixed, the upload server was often down. That just shows that it hasn't been tested well before going into the contest.
I had the feeling it was rewritten couple of times during the contest as this one shows: http://twitter.com/repdet/status/337821155689893888
When the contest ends, there was no final message from the organizers. They just let all the teams sit in the dark.
There have been "normal" passwords in the contest as well
It wasn't just generated passwords. But then cracking the real passwords had no effect in the point rating. The algorithma that give the required points to win a contest all based on pattern.
There should be no hints
Since there are no such hints in the reality.
My conclusion is the following
I do not like the fact that password cracking contests depend on hardware. But there is no sense in avoiding this.
Find a better way to deal with it but do not lose the focus why we're doing this.
--
atom