4 ms·

The Enemy Within

53 points by kareemm 16y ago

autarch 16y ago
"If the right order were given, and all these computers worked together in one concerted effort, a botnet with that much computing power could crack many codes, break into and plunder just about any protected database in the world" Uh, no, it couldn't. A big botnet does not magically give you access to well-protected computers or networks. See http://en.wikipedia.org/wiki/Brute_force_attack http://en.wikipedia.org/wiki/Brute_force_attack for some perspective. I don't care how big Conficker is, it's not going to break AES-256 any time soon (or really any large key based on an algorithm without a weakness). Similarly, Conficker isn't going to be able to get into protected internal networks with a good firewall simply by virtue of having lots of machines.
- 16s 16y ago
  Right, but with a well-written distributed brute force application, it could probably get through a lot of password cracking. No need to break AES-256.
- joe_the_user 16y ago
  Naturally, it wouldn't necessarily be able to enter any given secure network, database or machine. But it quite possibly could enter quite a lot of them ... if the conficker masters are indeed as cryptographically sophisticated as the article describes. Just imagine the attack on Google supplemented by a botnet. Modern attackers already have many vectors with which to attack private networks. Having a botnet can only give an attacker more opportunities. So I think it's entirely correct to say the virus is worrisome at the least.
  - Gormo 16y ago
    Are the Conficker masters really as cryptographically sophisticated as the article describes? They implemented an encryption algorithm that had been submitted as a SHA-3 candidate, complete with its flaws, then updated it to patch the flaw only after the author of the algorithm corrected his own work. Similarly, they exploited a flaw in Windows only after Microsoft released a security update describing the bug. The Conficker creators are certainly paying attention and taking advantage of the right opportunities, but they're not quite the super-genius polymaths that the article is making them out to be.
- PidGin128 16y ago
  It may not be able to actively worm its way through a good firewall, but who's to say an infected USB stick, user downloading cursors or smilies, or other vulnerability would drop it in past it? The issue then, is whether the botnet admin would recognize the luck\value of a select machine with inside access, or if it would go unnoticed.
- Daniel_Newby 16y ago
  A botnet can dig through improperly-sanitized binary data in RAM/swap to find cipher keys. 500 CPU-years per day can do a lot of computation.
- fleitz 16y ago
  Think of the rainbow table you could build with 6.5 million machines. If you wanted to crack all lowercase alpha passwords to 8 chars you'd only need 65K entries per machine.
CapitalistCartr 16y ago
If I seriously wanted to crack something difficult, I wouldn't recruit more computers; I'd recruit more great people. A concerted effort by a small group of talented people, joined by the Internet is more effective than brute force will be, especially if the first plan is to brute force current encryption.
- 16s 16y ago
  Millions of cores would be useful to a handful of "bright" people. It would not hinder them at least.
- pavel_lishin 16y ago
  Recruiting great people might be difficult if your pitch starts out with "Well, we're going to break into secure networks, steal millions - maybe billions - of dollars, flee the countries of our origin."
bbwharris 16y ago
That was a very engaging read.
- dasil003 16y ago
  Yeah nice layman's description of the technical stuff without too many drastic oversimplifications or misrepresentations.
brown9-2 16y ago
Previous HN discussion of the same article: http://news.ycombinator.com/item?id=1350320 http://news.ycombinator.com/item?id=1350320
- roundsquare 16y ago
  Thanks for this. I went through @tptacek's comment, but I don't see any of the quotes in the article. Am I missing something?
  - brown9-2 16y ago
    They're all there, check the print version: http://www.theatlantic.com/magazine/print/2010/06/the-enemy-within/8098/ http://www.theatlantic.com/magazine/print/2010/06/the-enemy-...
danbmil99 16y ago
Anyone know a good, friendly, easy-to-deploy conficker killer? I think I have it on an old windows machine, and all the AV products are so fucking STOOPID that they do shit like refuse to install in safe mode.
rmathew 16y ago
See also: http://mtc.sri.com/Conficker/ http://mtc.sri.com/Conficker/ http://mtc.sri.com/Conficker/addendumC/ http://mtc.sri.com/Conficker/addendumC/
CaptainZapp 16y ago
Just a nitpick: "Ficker" is not "motherfucker" in german, it would loosely translate to "fucker", but probably wouldn't be used as a word. There's no sensible translation for "motherfucker" in German. Literally it would translate to "Mutterficker", but would never be used as a word. Else then that small nitpick: Interesting read.

53 points by kareemm 16y ago

"If the right order were given, and all these computers worked together in one concerted effort, a botnet with that much computing power could crack many codes, break into and plunder just about any protected database in the world" Uh, no, it couldn't. A big botnet does not magically give you access to well-protected computers or networks. See http://en.wikipedia.org/wiki/Brute_force_attack http://en.wikipedia.org/wiki/Brute_force_attack for some perspective. I don't care how big Conficker is, it's not going to break AES-256 any time soon (or really any large key based on an algorithm without a weakness). Similarly, Conficker isn't going to be able to get into protected internal networks with a good firewall simply by virtue of having lots of machines.

16s 16y ago
Right, but with a well-written distributed brute force application, it could probably get through a lot of password cracking. No need to break AES-256.
joe_the_user 16y ago
Naturally, it wouldn't necessarily be able to enter any given secure network, database or machine. But it quite possibly could enter quite a lot of them ... if the conficker masters are indeed as cryptographically sophisticated as the article describes. Just imagine the attack on Google supplemented by a botnet. Modern attackers already have many vectors with which to attack private networks. Having a botnet can only give an attacker more opportunities. So I think it's entirely correct to say the virus is worrisome at the least.
- Gormo 16y ago
  Are the Conficker masters really as cryptographically sophisticated as the article describes? They implemented an encryption algorithm that had been submitted as a SHA-3 candidate, complete with its flaws, then updated it to patch the flaw only after the author of the algorithm corrected his own work. Similarly, they exploited a flaw in Windows only after Microsoft released a security update describing the bug. The Conficker creators are certainly paying attention and taking advantage of the right opportunities, but they're not quite the super-genius polymaths that the article is making them out to be.
PidGin128 16y ago
It may not be able to actively worm its way through a good firewall, but who's to say an infected USB stick, user downloading cursors or smilies, or other vulnerability would drop it in past it? The issue then, is whether the botnet admin would recognize the luck\value of a select machine with inside access, or if it would go unnoticed.
Daniel_Newby 16y ago
A botnet can dig through improperly-sanitized binary data in RAM/swap to find cipher keys. 500 CPU-years per day can do a lot of computation.
fleitz 16y ago
Think of the rainbow table you could build with 6.5 million machines. If you wanted to crack all lowercase alpha passwords to 8 chars you'd only need 65K entries per machine.

CapitalistCartr 16y ago

If I seriously wanted to crack something difficult, I wouldn't recruit more computers; I'd recruit more great people. A concerted effort by a small group of talented people, joined by the Internet is more effective than brute force will be, especially if the first plan is to brute force current encryption.

16s 16y ago
Millions of cores would be useful to a handful of "bright" people. It would not hinder them at least.
pavel_lishin 16y ago
Recruiting great people might be difficult if your pitch starts out with "Well, we're going to break into secure networks, steal millions - maybe billions - of dollars, flee the countries of our origin."

bbwharris 16y ago

That was a very engaging read.

dasil003 16y ago
Yeah nice layman's description of the technical stuff without too many drastic oversimplifications or misrepresentations.

brown9-2 16y ago

Previous HN discussion of the same article: http://news.ycombinator.com/item?id=1350320 http://news.ycombinator.com/item?id=1350320

roundsquare 16y ago
Thanks for this. I went through @tptacek's comment, but I don't see any of the quotes in the article. Am I missing something?
- brown9-2 16y ago
  They're all there, check the print version: http://www.theatlantic.com/magazine/print/2010/06/the-enemy-within/8098/ http://www.theatlantic.com/magazine/print/2010/06/the-enemy-...

danbmil99 16y ago

Anyone know a good, friendly, easy-to-deploy conficker killer? I think I have it on an old windows machine, and all the AV products are so fucking STOOPID that they do shit like refuse to install in safe mode.

rmathew 16y ago

See also: http://mtc.sri.com/Conficker/ http://mtc.sri.com/Conficker/ http://mtc.sri.com/Conficker/addendumC/ http://mtc.sri.com/Conficker/addendumC/

CaptainZapp 16y ago

Just a nitpick: "Ficker" is not "motherfucker" in german, it would loosely translate to "fucker", but probably wouldn't be used as a word. There's no sensible translation for "motherfucker" in German. Literally it would translate to "Mutterficker", but would never be used as a word. Else then that small nitpick: Interesting read.