[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120724203457.GX17232@marklar.spinoli.org>
Date: Tue, 24 Jul 2012 16:34:57 -0400
From: Hank Leininger <hlein@...elogic.com>
To: Rich Rumble <richrumble@...il.com>
Cc: john-users@...ts.openwall.com, defcon-2012-contest@...elogic.com
Subject: Re: Re: Crack Me If You Can 2012
On Tue, Jul 24, 2012 at 04:11:51PM -0400, Rich Rumble wrote:
> On Sun, Jul 22, 2012 at 6:18 PM, Hank Leininger <hlein@...elogic.com> wrote:
> > by turning in the plaintexts for those hashes--this year we want the
> > plaintext that cracked open the challenge file, which will be worth a
> > big chunk of points. There's nothing inside the challenge files but
> > instructions on making that submission.
>
> If any of the challenges are older Microsoft Office products, and
> there are different ways to "crack" them open, how do we prove/show
> our work? For instance a Outlook PST file uses a crc32 password check,
> so:
> advertees -> D6E4663B
> a1sellers -> D6E4663B
> each is just as likely a password, and each works equally well to open
> a pst, there are (dozens of)other collisions as well.
> Also Word/Excel/PowerPoint and older PDF documents password to open
> uses an RC4 40-bit key space by default, and there exist many
> different rainbowtables/ophcrack tables that find collisions and
[snip]
Hm... excellent question...
We have tried to avoid that situation (/me runs over to the challenge
file list to make sure).
If you think you've run into that situation during the contest (you
submitted something you can prove works, but we didn't give you credit),
please contact us privately at defcon-2012-contest@...elogic.com and
we'll make sure you get credit for points/wins. Worst case, if we have
already awarded a "win" for the first "expected" answer, and a team
proves they submitted a different but also valid key earlier, we'll
award two "wins" for that one.
> But as long as the challenges are all rot-13, I'm all set :)
We took a page from 3DES and did them all as 3rot-13!
> To summarize: What if I open the challenge, but don't know the
> password, how do I show my work and get points?
Worst case: email us at defcon-2012-contest@...elogic.com and we'll look
into it as soon as we can (it's not like we plan to sleep during the
contest).
Thanks,
--
Hank Leininger <hlein@...elogic.com>
D24D 2C2A F3AC B9AE CD03 B506 2D57 32E1 686B 6DB3
Download attachment "signature.asc" of type "application/pgp-signature" (448 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
