Last year at this time I disclosed an issue with the IDG/MacWorld Expo registration that allowed people Free Platinum Passes (valued at $1,695). I communicated this issue with IDG the week of MacWorld and they removed all the codes, fixed the site, and said thanks. Questions were asked on how to write better code and I gave them a few tips (don't trust user input, don't give your secret codes to everyone, encryption is not one-way, etc). Did they listen?
Who wants to stand in line to see the Steve Jobs keynote at MacWorld? I mean have you SEEN the lines there? Really? I want to know WHATS IN THE AIR(tm)!!!
Honestly it's academic to me. I didn't even go to the keynote. :P
Getting Your Golden (Well, Blue) Ticket:
This year the cost of Platinum Passes has gone up to $1,895. That's a lot of money but you get a lot of cool things:
- A free lunch every day
- Free ticket to the MacWorld Blast
- Seminars (MacWorld is more than just the keynote and Expo)
- Priority Access Line to the Keynote
Obtaining the codes -- Same as last year:
Step 1. Navigate to the main registration page
Step 2. Submit your initial data and view the source of the main registration page, search for "Priority Code"
Step 4. Search for "check_password()" and you'll find the list of valid codes in MD5
Step 5. Format the data for your cracker of choice and start cracking!
Cracking the codes:
I like John The Ripper for all my hash cracking needs. It's flexible, easy to use and affordable! There are two main methods used to crack passwords in John, using a wordlist or incrementing through a given keyspace. I always begin with a wordlist run just to kick out the quickies. The hash for "NONE" breaks but we already know that doesn't do anything for us.
Incremental mode is our next step but we know lower case letters aren't used so a quick look at the configuration file shows an external mode "Filter_LanMan" that throws everything to upper case. A quick run through doesn't net any cracked hashes unfortunately. There are still over 1,000 hashes to crack so we have to be a bit more intelligent in our cracking (or throw more machines, wait longer, get a PS3, etc).
A Brief Cracking Sidebar:
Incremental cracking can take a long time to perform. The size of your keyspace (k) and the maximum word length (l) determine the total number of permutations that have to be encrypted to check every instance (P). P=k^l. Take the benchmark cracks-per-second your machine takes (Cs), do the math (P/Cs) and you have the number of seconds it takes to run an Incremental.
For example lets make k = 69, l = 8 and Cs = 30 million:
((69^8)/30M) / 60 = 285,443.54 minutes (3.68 months!)Changing l for different lengths and the time changes accordingly:
((69^7)/30M) / 60 = 4,136.86 minutes for 7 charsand so on. . . The time is cumulative and those are just my numbers. Some have found ways to increase the speed to 1 billion cracks-per-second. Until that code is released or we write our own, we have to work with clusters of machines to reach that. My little cluster of 9 nodes can do just about 60 million MD5's a second so a full 8 character run would take nearly 2 months to complete.
((69^6)/30M) / 60 = 59.95 minutes for 6 chars
Now that you know the math and the big mountain ahead of us, how can we get on the gondola that takes you over half of it without much effort? The answer is simple, vendor codes and keyword masking!
Vendors receive a group of codes each to pass along to their customers, potential customers, friends, family, etc. These typically provide free Expo access but maybe they'll help trim down this mountain to something manageable. These free codes get passed around like candy so finding one takes a few Google searches. 08-G-PC189, 08-G-PC178, 08-G-PC260,
Time To Build An External Filter:
Now that we have a mask (08-x-y(n)) time to modify the john.conf accordingly:
With that, we run and wait...
# john -i=MW -e=MW mw2k8.codes --format=raw-MD5.. but not too long because the first code looks REALLY interesting: 08-S-STAFF. Lets try it!
Loaded 1341 password hashes with no different salts (Raw MD5 [raw-md5 SSE2])
Download the High Quality version.
Voila. For the second year in a row, a free Platinum Pass in less than a day.
On January 7th we noticed the MD5 hashes changed in the source code. While the special code was still listed it no longer gave a 100% discount when entered. Some codes still provide a small percentage discount and a few do provide a free expo pass. We still have 14 codes left to crack so no telling if those are any good. :)
Thanks to Josh Bernstein and Garrett Gee for reminding me MacWorld was coming up and independently confirming these findings.
Maybe next year the problem will be fixed? Anyone in a betting mood? :)