Hacker News Reader

Looks about right to me.

I wonder why they didn't use something like bcrypt/scrypt with lots of rounds.

It doesn't really matter which hash function they use here... Your common MAC-48 address is a [Manufacturer ID (3 bytes), Device ID (3 bytes)], this further reduces the enumeration requirements...

You may be right. But it may not be a straight sha256. It could be a multi-round hash based on sha2. In the same way shadow hashes are default called sha512, but in reality it's a 5000 round version, so your price could be $250000 instead. (Or less/more)

You could cut down the search space a lot by only enumerating the MAC addresses of known vendors (https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd...).

That cuts the search space down to 23000 vendors * 0xFFFFFF = 385875945000. With a hashrate of 60000MHs, you could SHA256 hash that entire space in 6.5 seconds. If you have an NVidia GTX 1080, you can do it in ~2 minutes 16 seconds.