show and tell for hackers in DC.

Round 51: Giant War Llamas

14 Dec 2017

Travis Hoppe - Password topologies @metasemantic

If your password is landmark, you might modify your password to meet requirements, like landmark1234. Everybody does this, especially when forced to change passwords frequently. It’s bad to do this because predictable password topologies expose you to dictionary attacks.

Can we do better? In password dumps, we can see real user info on what passwords people are actually using. There was a 42GB password dump (1.4 billion passwords) recently that aggregated all of the password dumps along with usernames, and by analysing the data, we could see how people are modifying their passwords over time.

Can we see how these passwords change over time?

The most common modifications are a postfix of “1”

Prefixes are very rare but 0 is the most common.

If you have a unique password and modify it across sites, you can now leak and connect accounts through your passwords.

It takes a long time to do I/O operations on 42 GB, so it’s important to cut it down at each step of the way.

Source code at:

Matt Fowle - Donation Acceptance Web Specification @rektide

Donation Acceptance Endpoint Specification: There’s all of these different solutions to how people might give us money to donate; but is there a web-standards way to announce to the world that a website is open to receiving donations?

To make this happen, the web browser needs to be aware of this specification. There also needs to be a way to make a payment. Trying to use existing web options to leverage these.

Enter, the /.well-known/ URI.

Live demo at:


Eric Haengel - AM Band Software-defined radio @EricHaengel

Built an AM radio!

Most people think of a car radio, but I’m thinking of the type of radio that’s in your cell phone that communicates between the towers.

Audio recording systems takes analog sound data and produce digital sound data Software defined radio does the same, but with radio signals. AM radio frequency is really low, which means it’s possible to record it directly.

(Highest frequency in AM band is around 1.5 MHz, meaning you need at least 3 million samples per second). Ended up doing 6M samples per second, which ends up being 6MB per second

Amplifiers/Filters > Analog to Digital Convertor > Computer > Sampling Clock

Nathan Epstein - Cellular Automata Explorer / Heatmap - @Aeium

Cellular automation is like a puzzle: With three cells and 2 bits, there are only 8 possible experiences (and one decision that can be made).

A rule can then be defined that describes completely what the agent will do 4-cell automations are similar; and you can think of each of them like computer programs. They make beautiful patterns (like Conway’s game of life).

Ying Wang - Building my personal portfolio

Bought a domain with Google domains and moved it to Route 53 for use with Amazon Web Services. Uses an Amazon S3 bucket (static site); uses Cloudfront to serve it up; amazon certificate. Number of subdomains you can have is pretty much unlimited, which is great for prototyping personal projects and not paying additional cost

Current website:



Monthly AWS bill: $0.85!

Stephen O’Connor - Wifi-enabled Christmas tree

Was working on a hardware hack with a Raspberry Pi, mobile access point, etc. But then Debian 9 broke everything – so now I have 3 hours and need a project! Westinghouse TK301 - Radio Activated outlets. ESP8266 to Control board - enables wifi control on outlets, provides 3.3V at 12mA max. Integration with Home Assistant via HTTP/REST interface and Alexa Incorrect assumption about the how the pads works and lots of soldering The chip is running a web server, and you can click on/off to turn on/off the lights. ESP has Arduino-style libraries; most Arduino libraries will sync right over to it.

Shannon Turner - A Clear Night @svthmc

See all of the stars of the night sky without light pollution in virtual reality. VR app to see the stars in the city, live on both Google play and App store. The sky is “downloaded” each month so it’s as close to real life as possible. Tradeoffs were made so a semi-static image would be used, couldn’t compute in real time but a completely static image would be boring. Actually 6 images stitched together to span the sky.

Data is coming from Links to download from the App Store and Google Play: