Scenario
Pamama, a US-based data broker had a massive data breach. Profiles on over a billion people, containing all the information amassed about them. It is alleged that the company siphoned records from different government agencies around the world, as well. The dump was encrypted, and regulators are downplaying the breach claiming no damage was done. A bill has been fast-tracked in Congress to exempt Pamama from any investigations, including illegally shielding them from GDPR violations. This led to accusations that Pamama has bought or blackmailed members of congress.
Crack the staff's accounts and encrypted files to demonstrate the extent of the exposure and the need for individuals to get restitution and compensation, and to find smoking gun evidence of collusion so that the corruption can be fully exposed before the legislation goes forward.
Logistics
The contest started at 11 AM Las Vegas time on Friday, August 7th, and runs for 48 hours until 11 AM LV time on Sunday. We have a table in DEF CON 34's Contest area (come say hi!), although most participation will be online.
Encrypted contest files were published for pre-download, with passphrases published at contest-start.
Additional files, hints, or challenge material may be released during the contest. Updates will be posted on this site and @CrackMeIfYouCan.
If you are new to CMIYC, review the past contest archive for examples of scoring, team writeups, and prior challenge formats.
Types of Teams
- Pro Teams: teams competing for the top overall score and expected to share techniques and methodology after the event.
- Street Teams: individuals or smaller casual teams who want to participate without competing directly against the largest cracking groups.
Scoring Points
Points are earned by cracking hashes and submitting plaintexts. There might be opportunities to earn bonus points...
Teams should submit new cracks frequently and check the stats page once it is live. Repeated submissions and invalid data may be throttled, ignored, or in extreme cases cause a team to be disqualified.
Rules
- You MAY use as many systems, cores, GPUs, and CPUs as you wish.
- You MAY use systems NOT physically located at DEF CON.
- You MAY work with team members who are not attending in person.
- You MUST ONLY use systems that you are authorized to use.
- You MUST ONLY use software that your team developed or that is publicly available.
- You MUST NOT attempt unauthorized access against KoreLogic, contest infrastructure, or another team.
- You MUST NOT interfere with another team's efforts.
- You MUST NOT trade or share plaintexts between teams.
- You MUST NOT steal passwords, tooling, techniques, or methodology from another team.
- You MUST NOT be on multiple teams or switch teams during the contest.
- You MUST ONLY submit good-faith cracks... guessing trash will get your team thrown in the garbage along with it.
- KoreLogic employees are NOT eligible to compete.
Additional Pro Team Requirements
- To be named a winner, a Pro team MUST agree to share techniques, methodology, and a description of resources used after the contest.
- Pro team rosters SHOULD BE firm before the contest begins. Contact us if there are extenuating circumstances.
- Teams SHOULD NOT combine or split during the contest. KoreLogic may disqualify parties involved in ambiguous team merges or splits.
Results
During the contest, KoreLogic will publish status and statistics. After the contest, staff will validate final submissions and announce winners.
We encourage all teams that participate to write up a post-event report, not only the winning Pro teams. Brag, complain, share.
After the event, KoreLogic intends to publish winners, password composition notes, successful-crack statistics, and writeup links where available.