In brief
The conference opening and the MK Bruteforce release notes in one talk: what has been added since spring (Samsung Smart Switch, Telegram for macOS, Threema), scrypt sped up "tenfold in places", a dictionary library with support for files of 20–100 GB, UI changes at users' request, plans — KeePass, Kims, Windows Hello. Not a single measurement shown: "tenfold" and "a bit faster" are stated without a methodology. Then the moderator presents the first anniversary gift — an information portal with articles, a video archive and a training challenge. No questions from the audience followed.
Key points
- A greeting, "there are a lot of us today"; the clicker is not working — "technical hiccups".
- The partners are named by the moderator: Account Best, ELETEK, Ester Solutions, Amplicom, ACE Lab, SearchInform. There is no teaser about them — "the guys will tell you everything far better than me"; the partners have their own booths.
- A question to the hall — was anyone at the first MFD; such people are there: "the ones with us all ten years".
- MK Bruteforce is a product built on hashcat; the update to hashcat 7.0 was already announced at the spring conference.
- Newly supported: Samsung Smart Switch Backup, Telegram for macOS (the passcode of the desktop version), Threema. Users are asked to bring requests for missing hashes — "we'll definitely try to add them".
- A frequent user question — where to get the hash: everything is loaded straight into the UI. Samsung Smart Switch needs two files and necessarily from the same backup, otherwise "something may glitch and it'll recover some wrong password"; for Telegram for macOS and Threema — paste the hash or upload the file to be recognized.
- The scrypt algorithms have been sped up: Android physical image (FBE and FDE), Apple Notes, Huawei HiSuite backup, Threema, Telegram for macOS. "In some places the speed increased tenfold, in others it's not so rosy"; about FDE it is said outright that it will not crack fast.
- Why the graphics card shows up twice: both the CUDA driver and the OpenCL driver are installed. In the next release — one card and a driver switch; OpenCL is recommended, "it's usually a bit faster", but she advises testing on your own hardware.
- At users' request: the cards are shown separately with a temperature breakdown, and a notification has appeared that the attack is paused at a critical temperature — "we're trying not to burn out your devices".
- The dictionary library: the preinstalled ones are protected from deletion, your own can be added and edited. The main thing is support for large dictionaries: "20-gig, 40- or 100-gig". A caveat: the library syncs with the files seamlessly, so dictionaries have to be kept where they will not be deleted by accident.
- Plans: KeePass and Kims — "out soon"; Windows Hello — "in research now", expected "within the next six months, that is, a release from now, give or take".
- There is a free version of MK Bruteforce via a QR code: it has not been updated in a while, it will be updated together with the next release of Mobile Criminalist, and it supports fewer hashes than the one built into MK.
- The first anniversary gift (presented by the moderator) — a portal for the 10th MFD: a short registration without spam, articles by forensic and infosec specialists, an invitation to write articles yourself or together with MKO.
- The video archive is there too: "You won't find our videos on Rutube anymore" — MKO clients need to authorize on the portal, after which materials, manuals and videos are available.
- The training challenge — "of most interest, probably, to universities": a preamble, a ready test image, the solution is sent in as an answer, "our colleagues check it". Before the conference began, 50 people had registered on the portal; you cannot register again with the same email — for them there is a "Log in" button.
Tools, artifacts, technologies
- MK Bruteforce — an MKO Systems product built on hashcat (7.0 since spring), runs on CPU and GPU.
- New recovery targets: Samsung Smart Switch Backup (two files from one backup), Telegram for macOS, Threema.
- Accelerated scrypt targets: Android physical image (FBE, FDE), Apple Notes, Huawei HiSuite backup, Threema, Telegram for macOS.
- Drivers: CUDA and OpenCL (OpenCL recommended); in the UI — separate cards, temperatures, a pause on overheating.
- Dictionary library — preinstalled ones and your own, files up to 100 GB, seamless syncing with the disk.
- In development: KeePass, Kims, Windows Hello (research).
- MK Bruteforce FREE — a cut-down free version; Mobile Criminalist — the main product.
- The 10th-anniversary MFD portal — articles, a video archive (instead of Rutube), a training challenge with a test image.
Legal and organizational context
There is no legal content: no articles of law, no agencies, no procedural requirements — the talk is a product talk. Organizationally, one thing matters: the video archive has moved from Rutube to the portal and is available only to clients after authorization, that is, the public channel has been closed in favor of authorized access.
Questions from the audience
There were no questions. The speaker twice invited them, looked for raised hands and suggested that the questions would reach her on the sidelines: "they'll grill me in the hall".
The speaker's position
These are release notes read out loud, not research, and the tone matches — friendly, deliberately informal ("tasty new stuff", "we try not to code them in"). The strong side is that limitations are stated outright: FDE will not crack fast, the free version is cut down and has not been updated in a while, large dictionaries require care with files, Windows Hello is only being researched. The weak side is that the improvements are described in words, without a single measured number, and all the feedback comes down to "come to our booth".
Quotes
- "Our measurements showed that in some places the speed increased tenfold, in others it's not so rosy, of course. FDE won't crack fast".
- "…we're just trying not to burn out your devices".
- "So now you can safely load a 20-gig dictionary, a 40- or 100-gig dictionary… now it's actually possible".
- "And if it has any bugs, we try not to code them in".
- "You won't find our videos on Rutube anymore…".
Partners: the talk versus the program
Six companies were named from the stage: Account Best, ELETEK, Ester Solutions, Amplicom, ACE Lab, SearchInform. The program has a different lineup: general partner RNIEC, partners ELETEK, ACE Lab, SEUS (SEUSLAB), SearchInform, Kaspersky Lab. The talk is missing the general partner, SEUS and Kaspersky, while Account Best, Ester Solutions and Amplicom have been added. Why the lists diverge and what partner status gives is not explained; media partners are not mentioned.