I was a one man cracking team again this year at the Defcon password cracking contest. I used my own software along with John the Ripper. No fancy, high-priced GPUs and no proprietary, closed-source software. I won two first place prizes by cracking most of the TrueCrypt volumes before anyone else. I cracked these on an old Intel Celeron running Debian GNU/Linux that serves as the gateway into my home network. Also, I cracked most of the fast hashes on an old Intel Atom netbook running OpenBSD. Efficiency is so under-appreciated these days. I used a few EC2 extra-large CPU instance to crack most of the harder hashes. My final, over-all position was 7th place, although I held 5th place for most of the contest. There were 17 registered teams.

• Word Machine
• TCHead - For TrueCrypt Cracking
• John The Ripper

• cracks.txt

• Note to GnuPG Mailing List

It was fun. Thanks to jpd (my former colleague from the ITSO) for getting the registration code for me. Thanks to KoreLogic for hosting the contest. I found a small memory leak in TCHead and discovered a few other interesting things about TrueCrypt volumes. This is my last year participating in the contest as a one man team. The same big teams always win and the little guys stand no real chance. Here are my suggestions for future contests:

1. Create team divisions so that big teams with dozens of members and dozens of GPUs would only compete with each other. Sort of similar to divisions in boxing (heavy weights, middle weights, light weights). That would make for a more evenly balanced contest and ensure that small teams have just as much of a chance to win as the big teams.
2. Provide bonus points to teams that use software they wrote themselves or hardware they built themselves from scratch. Anyone can download and execute other people's software and/or buy lots of high-priced video cards. Neither of those require much thought or creativity and neither of those are a cool hack suitable for Defcon.

Experimenting a bit this afternoon (day after the contest ended) I've seen that the focus this year seems to have been on pass phrases more so than passwords. I should have known that based on the hints provided toward the end of the contest. Here are some examples: