10 ms·
Hack-petya mission accomplished – Petya ransomware decryptor
- d33 11y ago> Last, but not least, it fires up a genetic solver which gets us the key in a few seconds. That's pretty impressive! On the other hand, is it a general vulnerability of Salsa that genetic solvers can break it? Sounds like a huge vulnerability.
- api 11y agoIt's probably a crap hand rolled key derivation function instead of a proper hash.
- CiPHPerCoder 11y agohttps://github.com/leo-stone/hack-petya/blob/master/main.go#L107-L108 https://github.com/leo-stone/hack-petya/blob/master/main.go#... Looks like it used a [1-9a-xA-X]{8} key. Even with a CSPRNG that's only 46 bits of entropy. You can brute force that in 2-3 hours with adequate hardware.
- matt_wulfeck 11y agoDon't these things generate a unique key for each file?
- AnimalMuppet 11y agoEven if they do, the per-file keys must be algorithmically-derived from the master key. (Otherwise, how can it unencrypt the files after you pay the ransom?)
- vetrom 11y agoUser-space malware, sure. Petya does a full-disk encryption.
- Godel_unicode 11y agoOff topic - this might be the single most uttered phrase in crypto reviews in the last year.
- deleted 11y ago[deleted]
- danbruc 11y agoI was wondering the same thing, I would naively have expected that genetic algorithms are absolutely useless for attacking cryptographic functions because the search space is full of local extrema. Maybe the used version is really a lot weaker. I would also like to know why the author chose this solution, it would probably have been one of the last things I would have considered. Maybe he observed something that pointed in that direction?
- lazyjones 11y agoI don't really understand the matrix substitution used, but the fact that the genetic algorithm works like it does seems to suggest it's about as secure as a Vigenère cipher (working on bit strings). Unless the genetic solver doesn't provide any speedup and is just ignorantly used instead of a brute force approach. It's extremely unlikely that Salsa itself is vulnerable though.
- lkowalcz 11y agoYeah, my first guess would be that the genetic solver is degenerating to basically a brute force search here (which is feasible in this weak instance). Will have to take a look to confirm...
- knicholes 11y agoFor a genetic algorithm to make beneficial mutations, one needs a fitness function. What would the fitness function be if the password either works or it doesn't?
- DannyBee 11y agoThe target fitness function is clever. Basically, it is "symmetric difference cardinality". That is, the closer the bits in the hash result for the candidate are to the target hash result, the better it considers the candidate (in particular, cardinality of symmetric difference for a bitset is the count of the number of one bits in the symmetric difference. It then sets the fitness to mean lower is better, so the smaller the number of different bits, the better it considers the candidate) This means it just tweak input key bits through mutation until the result comes out right. Now, in theory, there should be no correlation, so this should be no better than random search, but ...
- j2kun 11y agoThis violates everything I know about hash functions, so it's amazing that it works. Has anyone tried this for industry standard hash functions?
- komaromy 11y agoAn ideal hash function would have perfect avalanching; that is, changing one bit of the input would result in a 50% chance of each of the output bits being flipped. While modern cryptographic hash functions have at least really good avalanching, definitely enough to resist a genetic search, I'm not sure that it's perfect. Home-brewed crap like what Petya was using is unlikely to be very good at it at all.
- Houshalter 11y agoThe first random number generator I learned about was super simple. Middle squares. You take a number, multiply it by itself, and take the middle bits. Because of the way the binary multiplication algorithm works, the bits are pretty thoroughly scrambled and not correlated to the input. I'm not sure if there aren't clever ways to undo it, but at least it would resist such a simple method like that.
- deleted 11y ago[deleted]
- RUBwkVjwLsDKgPw 11y agoIt's a 16-bit version of Salsa20, which is far less secure. Proof: this project. I have no clue what possessed the author to do this. Stop hand-rolling crypto, people! Ransomware needs security too. :(
- an_account_name 11y agoIt's a way of sponsoring community-led crypto research.
- mangeletti 11y agoMy guess is that the authors wanted to ensure they could encrypt a full disk quickly.
- arviewer 11y agoMaybe it's just a test to see how quickly this was broken.
- PeCaN 11y agoOn the other hand, it's not a critical security application. If someone breaks it, you just don't get a little money. If the exploit becomes widespread, you can update the malware. The author probably wanted to be able to somewhat quickly encrypt/decrypt a full disk on potentially slow hardware.
- CamperBob2 11y agoEven a poorly-implemented homebrew encryption function would have been better than using a broken implementation of a common, trivially-recognizable function. It was easy for them to run this code through an SMT solver because it was easy to obtain the original source code. It would have been smarter to bundle the ransomware with a 32-bit DOS extender so the known-good Salsa implementation could be used unchanged.
- deleted 11y ago[deleted]
- AdmiralAsshat 11y agoWhat's the shelf-life of one of these ransomware fix utilities? I'd be inclined to assume that if they operate by exploiting a flaw in the ransomware, the ransomware author can simply "fix" the bug and the utility no longer works.
- taylorbuley 11y agoAs a security reporter I perceived a large technical gap between the developer of warez and most users, who tend to pay a one time or ongoing license for use of some tool. While a developer of illicit tools may adjust in a future release, typically the user does not have capabilities to patch their own tooling.
- bediger4000 11y agoInteresting assertion. What have you seen to make you think this? Also, does it apply to the PHP/Perl world of malware, the kind that gets installed on cracked, old and weak WordPress sites? There's 20 variations of "Web Shell by oRb" floating around, for example, and many, many versions of Perl IRC bots, for example.
- tux3 11y agoHere the crypto used by the ransomware seems to be thoroughly and systematically broken, so while it's certainly possible that a stronger variant will appear, I have my doubts on the author's capacity to do much "better" any time soon. I'm far from being a cryptographer, but at a glance it looks so weak I have to wonder if it's deliberate.
- kobayashi 11y ago>at a glance it looks so weak I have to wonder if it's deliberate. Any suppositions as to why it would be deliberate?
- djsumdog 11y agoMaybe the person who posted the exploit/solution was the person who created the ransomware? That way they get BTC from people who pay and donations from people who wait? /krazyconspiracy :-P
- Cpoll 11y agoI'm guessing the ransomware uses Salsa10 because it's fast? According to https://www.cryptopp.com/benchmarks.html https://www.cryptopp.com/benchmarks.html, Salta20 is 4x faster than AES - and if I understand it, Salsa10 is half the iterations.
- TillE 11y agoSalsa20 / ChaCha20 are quite nice when you want to do byte-for-byte file encryption. It's a good choice in a lot of situations. The unusually reduced number of rounds is more difficult to explain, since I expect hard drive I/O would be the bottleneck in almost any situation. Maybe it's just a little more "stealthy" to not have elevated CPU usage while the ransomware is incubating.
- pbsd 11y agoIt's not Salsa10; it's just that the author is counting double-rounds, which makes it looks like it's half the iterations. This has as many rounds as Salsa20, but whoever converted this to 16-bit words didn't know what they were doing---the security degradation is enormous.
- nightcracker 11y agoEven ChaCha8 (similar to Salsa8) so far is infeasible. The problem is that the randomware used a modified Salsa algorithm that uses 16-bit words instead of 32-bit words. This demolishes the algorithm, and is not a standard modification.
- deleted 11y ago[deleted]
- totoroisalive 11y agoHN typical question: Why Go?
- joshumax 11y agoI have the strangest urge to build a tiny user space around the malware kernel that gets booted by the infected MBR... opens IDA
- Godel_unicode 11y agoCareful, I don't know about you but anytime I have a thought that ends with "let me just open IDA real quick" nobody sees me for 2-3 weeks minimum.
- philovivero 11y agoI don't know what IDA is, but you get an upvote, because I have had this exact experience so many times... so many times. If I could have a dollar for everytime I put my head to a random problem and came out 3 months later... I'd have more than fifty dollars.
- umanwizard 11y agoIDA is the industry-standard binary disassembly tool. Expensive, so used over (dramatically) cheaper competitors like Hopper mainly by people whose company pays for a license :D
- coldtea 11y agoOr people who have ...disassembled the locked down original?
- Caprinicus 11y agoThis is why Pandora's Key was a fruitless business endeavor
- hatsunearu 11y agoI got to play with some hackmes in a hackathon and my teammates got frustrated by the crippled IDA demo version that they just downloaded a pirate version. Amusingly the readme for the pirate version said "I cracked it with IDA Pro" or something along those lines.
- aerovistae 11y agoMust be pretty nice to have a son-in-law who can, oh, you know, just come over for Easter and reverse-engineer the cryptographically complex malware holding your system hostage.
- yesiamyourdad 11y agoLess at stake on this one, but I had a friend in college whose father was a business owner. He was stuck with some database software that all his customer records were locked in; he wanted to migrate but had no way out other than copying them all over by hand. Up until one weekend when his daughter brought home her boyfriend, who dad had regarded as a dirty hippie up until then. Turns out dirty hippie was a pretty good hacker and in the course of a few hours, he wrote a program to export dad's database into a usable format. Moral: your significant other may not be impressed by your hacking skills, but you might win the family over for life in a few hours.
- annnnd 11y agoI am guessing the daughter was less impressed by the event? I mean, she went out of her way to find someone her parents disliked, and it turns out he is just what his father was looking for... :)
- it_luddite 11y agoI realize it was a tongue in cheek comment (at least interpreted that way), but that was a serendipitous opportunity for the young lady's boyfriend. I know I've had several such opportunities with my now in laws. Regardless of the differences of opinions, nothing wins over people more than just helping when help is needed.
- NOSHSHNACKERS 11y agoI have some soap that was named Dirty Hippie - it is patchouli but nothing like the real stuff I think the real stuff is super expensive - that dirty hippie smell is nag champa
- lqdc13 11y agoAnyone has a link to the malware sample?
- caffeinewriter 11y agoLooks like someone got their hands on a sample to throw in theZoo. Also, live malware sample warning! BE VERY CAREFUL WITH THESE. hxxps://github(dot)com/ytisf/theZoo/tree/master/malwares/Binaries/Ransomware.Petya
- mschuster91 11y agoJeez, thank God that malware authors are too stupid to include gnupg within their code. I'm afraid of the moment when they get more clever. Or if they include filesystem drivers that silently encrypt every file... if done right, you can even compromise backups transparently for weeks until arming, so that backups are essentially useless too.
- eugenekolo2 11y agoBoth are already done. [1] http://www.symantec.com/connect/blogs/russian-ransomware-author-takes-easy-route http://www.symantec.com/connect/blogs/russian-ransomware-aut... [2] http://www.theregister.co.uk/2015/11/09/cryptowall_40/ http://www.theregister.co.uk/2015/11/09/cryptowall_40/
- leni536 11y ago> so that backups are useless too It can hardly be considered a backup if it's easily compromised from your every day computer. In a good backup configuration your computer only have read and "append only" privilages for the backup so past snapshots are safe. Having said that not many people have this kind of config (including me).
- SmellyGeekBoy 11y agoNot sure why you're being downvoted, you make a very valid point.
- leni536 11y agoI guess it's because this kind of backup doesn't mitigate an ongoing compromise of your machine (much like what the GP talked about). I don't think any backup can protect for that. However a good backup limits the damage to the timeframe of the machine being compromised (if your machine is compromised for 1 day you might only lose that day's new data).
- eugenekolo2 11y ago"Don't roll your own crypto" strikes again.
- cfarre 11y agoGreat!
- mijoharas 11y agoAre there any security researchers that can comment on this? I'm very confused about the efficacy of a genetic algorithm on a hashing function. Having read some of the comments, I'm only more confused (how can the symmetric difference be a useful fitness function?).
- trufflepiggames 11y agoAlso with that bastard of game developer. He is making a difference just by producing an addictive game play! http://www.bridezilla-game.com/ http://www.bridezilla-game.com/