Thank you to everyone who played this year at @SAINTCON! We had an awesome time and loved seeing everyone heat up their rooms and test their skills. As far as I'm aware, there was only one graphics card killed in this endeavor (sorry about that @d4rkm4tter).
1st - 53,371,688 - leeroy
2nd - 53,118,862 - ushegoblins
3rd - 3,683,679 - bbbbbbbbbbbbbbbbbbbbbbbbbb
58,620,626 - hashcat
58,014,073 - CynoSure Prime
57,558,570 - john-users
This competition was put on by @SAINTCON. This was our Second time as an official contest. This contest was built for those attending Utah's Premiere Security Conference though we opened it up to external players to play without placing. I @miketweaver (aka bashNinja) headed this competition with @x74x76 (aka th3v0id) running the platform.
The inspiration from this year's contest came from a comment I stumbled on Twitter back on August 3rd. At this point @troyhunt had just released his SHA-1 password set of 320million hashes and @AaronToponce, one of those whom I look up to in the Utah security scene, had a conversation with Troy about the folly of choosing SHA-1 for hashes. Particularly this exchange:
https://twitter.com/AaronToponce/status/893236454754631681
At this point I thought it would be awesome if we could have the Utah Community actually go through and crack these lists. So I recruited th3v0id and we started working. We decided to build a platform with the assumption that we would not have the plaintexts and so they would have to submit the hashes, along with the plain text, and we would need to do a verification. We also wanted to be able to view scores live so we could see how the contestants were doing.
To do this, we created a platform that accepted API calls, and would verify the hashes. This performed HORRIBLY. In our testing, everything was smooth and we could submit 100million passwords in 30 minutes, but in the real world I think we started a fire in the datacenter because that server did nothing but burn 24/7 during the competition. This is something that I want to improve upon before next year. We were receiving thousands of connections a second and the slowest part of the process was searching the database to find if the submitted hash was a valid hash. If anyone has suggestions on how we can build a functional API that accepts the level of traffic and load we need, we'd LOVE to chat. Even more, we'd love to see a github project.
Unfortunately, our competition was too far away from when Troy posted the password list. I watched @TychoTithonus post this gist up just a few days later and hoped/prayed that the DB wouldn't be posted:
https://gist.github.com/roycewilliams/b1de2afbfe5cb71bea16c94042b9bbfc
Then, 26 days later, @cynoprime posted this article:
https://cynosureprime.blogspot.com/2017/08/320-million-hashes-exposed.html
And I knew I was done for. Not much longer after that they majority of the passwords were thrown up on Hashes.org. Darn.
When this happened, I debated for a good while on what to use for our password list. Should we go back to the 100 hashes we used the years prior or should we do something else to get a large number of unsolved hashes?
I debated on this for a good while until I decided that the idea of Troy's HIBP password list was just too much fun to get rid of and to try to simulate it as best I could. Then I began my adventure of creating the list.
-
Since I was going to be emulating troy's list, unsalted SHA1 was the method. Easy.
-
Troy's list was comprised of other PUBLIC password dumps. I needed to pull from password lists that were public, large, and would NOT cause any morality issues. Here's the list I pulled from:
- 1,212,356,398: Crackstation.txt - https://crackstation.net/buy-crackstation-wordlist-password-cracking-dictionary.htm
- 100,128,460: facebook-names-unique.txt - https://wiki.skullsecurity.org/Passwords
- 38,230: Movies.txt
- 655: shakespeare.txt
Ramatis personae and locations from the collected works. Collected by Dan Klein
- 138: cartoon.txt
A collection of characters and titles from comic books.From Bob Baldwin's collection from MIT. Augmented by Matt Bishop and Daniel Klein
- 394,748: english.txt - https://wiki.skullsecurity.org/Passwords
A combination of a couple lists, from Andrew Orr, Brandon Enright, and Seth
- 6,531,084: Wiki-en-all.dic.txt - http://contest-2010.korelogic.com/wordlists.html
- 58,427,178: wikipedia-wordlist-sraveau-20090325.txt - http://blog.sebastien.raveau.name/2009/03/cracking-passwords-with-wikipedia.html
- 4,600,506: 1253_found_sorted.txt - https://hashes.org/download.php?type=leak&id=1253&list=found
- 8,335: 546_found_sorted.txt - https://hashes.org/download.php?type=leak&id=546&list=found
- 4,983,172: 888_found_sorted.txt - https://hashes.org/download.php?type=leak&id=888&list=found
If you pay attention, the numbers don't add up. That's because I didn't take the entirety of every list and I only accepted ASCII chars on most of the passwords.
- I wanted to tweak these passwords JUST a tiny bit. Enough that simple usage of masks would solve it easy. So I created a stupid mangler that would slightly change the passwords:
https://gist.github.com/miketweaver/1453c732b80ca80567087bb76b9d0869
And that was it! Here's the full list of mangled plains:
https://drive.google.com/file/d/0B6BVwVwthrGqdGRZV29UR0J6Q28/view
Down the road, I realized this would have ruined the nested hashes, but... oh well. Sorry about that! I think many of you still solved them.
Here is proof I had the full list before starting the competition:
https://twitter.com/SAINTCONPCrack/status/917998094159138817
All in all, this was a very good competition. We had much higher participation this year and the satisfaction of those who played was much greater than in years past. We're excited to bring attention to the realm of secure passwords and hope that our contest brought a greater awareness to those who attended @SAINTCON.
See you next year!