Faster Pwning Assured

Architecture and Background

David Hulton: Faster PwninG Assured: New adventures with FPGAs I've been giving talks on how FPGAs are cool for the past couple of years at Defcon, so what's different this year? Well, I'll be releasing a couple of new tools.

Vulnerability Analysis

BTCrack is a Bluetooth PIN cracker that will allow you to crack 8-digit Bluetooth PINs on an FPGA or 5-digit PINs on your computer in real-time (Longer PINs require a little more time) using a capture of the pairing process. The other tool, WinZipCrack will let you crack WinZip AES encrypted files by specifying a list of words that you want to try.

Exploitation and Demonstrations

The FPGA implementation runs an order of magnitude faster than a PC and the tool supports all of the different modes of WinZip encryption. I'll also be releasing a tool that will allow you to convert WinZIP AES encrypted files into normal unencrypted PKZIP files with the correct passphrase (in case any of you have ever tried opening a WinZip AES encrypted file in unix, ugh!).

Remediation and Defensive Strategies

I'll also be doing a lightning quick demo of the other tools available on the OpenCiphers Project website and will be releasing Virtex-5 LX50 support for the whole toolset with up to 3x performance over the previous cores on the Virtex-4 LX25 as well as full Windows support." David Hulton has been hacking with wireless and embedded devices for the past 5 years and actively involved in the security industry for 10. After helping start and run various security meetings and ToorCon back in the late 90's, he switched focus and became credited with designing open source tools such as bsd-airtools, doing extensive security research with Wireless, Smart Cards, GSM, and most recently with revolutionary high-speed crypto cracking applications for FPGAs.