10 ms·
$4 billion has got to buy an awful lot of compute time, but still, how did they decrypt the file?
by colinmhayes 5y ago
$4 billion has got to buy an awful lot of compute time, but still, how did they decrypt the file?
- danjac 5y agoPrivate key was uploaded to cloud storage that Feds had access to with a search warrant.
- raverbashing 5y agoA fancy (or even basic) dictionary attack has a very high chance of working.
- lupire 5y ago$4B should buy a very, very fancy dictionary.
- 14 5y agoRandom example but my passwords look something like chOf$Tyl83fhn@54R. I keep them written down because they are hard to remember. My threat model is no one. Seems so amateur to use a simple password that could be brute forced. Especially with so much on the line.
- gruez 5y ago>Seems so amateur to use a simple password that could be brute forced. Especially with so much on the line. There's selection bias going on because only dumb criminals get caught, so you only hear about the dumb opsec practices of those criminals. Conversely, you'll never hear about the opsec practices of that professional crew with perfect opsec that hacked an exchange/difi contract and disappeared into thin air.
- not2b 5y agoUntil the least bright member of the crew makes a mistake, gets caught, and turns in the rest. Being perfect is difficult to maintain forever, though it's possible in principle. It might require the thief to live like a grad student even though he has billions of dollars/euros worth of stolen wealth; being flashy attracts attention and if nothing else, the tax authorities.
- openknot 5y agoIf a person is that financially rich but still has to live like a grad student, it seems like the only point of that wealth is to rebel against the legal system. Even if one isn't caught, there's still a loss of freedom to avoid getting caught. I haven't studied criminology, but I alternatively suppose someone who does that just doesn't think that far ahead. This likely also explains why the vast majority of people with these capabilities choose to live a life in accordance to their country's laws.
- not2b 5y agoThere's money laundering; have a front business and gradually mix in a bit of the illegal money and pretend it came from the business. That's how mobsters do it.
- openknot 5y agoThat's right; your comment brings to mind this scene where the character Saul Goodman explains money laundering in Breaking Bad (this clip is supposedly shown as part of university lectures): https://www.youtube.com/watch?v=RhsUHDJ0BFM https://www.youtube.com/watch?v=RhsUHDJ0BFM
- Gasp0de 5y agohttps://www.useapassphrase.com/ https://www.useapassphrase.com/
- squarefoot 5y ago"Lorem ipsum dolor sit amet" "Approximate Crack Time: 61,103,576,810,655,170 centuries" Yeah, sure:)
- shakna 5y agoWell, that one isn't in Have I Been Pwned's password database, so it may in fact be somewhat secure.
- shadowgovt 5y ago> I keep them written down because they are hard to remember. With the Feds involved, that would be sufficient to crack the data.
- beambot 5y agoYou wrote them down - where do you store them? Seems like bad opsec if you are at risk of search and seizure...
- paulpauper 5y agoIt doesn't unless you chose something stupid like "correct horse battery staple" or "word + word + number". 7 words chosen from 1000 word dictionary password encrypted AES 256 cannot be cracked with existing technology, 8 words impossible with future tech.
- shadowgovt 5y agoYeah, but at the end of the day these keys have to be used by human beings so the passwords were likely something practically sized and easy to use. Especially since in general the likeliest failure mode would be the user forgetting the password to their millions of dollars worth of Bitcoin keys, followed by someone attacking the password.
- everybodyknows 5y agoIs there any "standard" 1000-word dictionary?
- mrkramer 5y agoThere is for example this https://www.kaggle.com/wjburns/common-password-list-rockyoutxt https://www.kaggle.com/wjburns/common-password-list-rockyout... But you can refer to https://hashcat.net/hashcat/ https://hashcat.net/hashcat/
- ncmncm 5y agoYou wouldn't want to use that one.
- plankers 5y agobitcoin developers have taken a crack at it: https://github.com/bitcoin/bips/blob/master/bip-0039/bip-0039-wordlists.md https://github.com/bitcoin/bips/blob/master/bip-0039/bip-003...
- rainbowzootsuit 5y agoNot 1000, but the EFF diceware long word list has my vote. https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt
- trhway 5y ago>how did they decrypt the file? keyloggers for example.
- avrionov 5y agoHere is the most likely approach: https://xkcd.com/538/ https://xkcd.com/538/
- fisherjeff 5y agoOne route would probably be to start with a warrant to search their house in hopes of finding some passwords written down somewhere
- pbhjpbhj 5y agoUnder what premise are they getting the warrant? This absolutely sounds like parallel construction.
- fisherjeff 5y agoI assume they’d get it on roughly the same basis as the warrant they got for the cloud storage. I’m also curious what here looks like parallel construction to you - I thought the statement of facts was surprisingly mundane, but perhaps I missed some red flags?
- tevon 5y agoIs it me or should he have literally just gotten a hardware wallet, transferred everything to that account, then burned the old key? Of course that txn would show up on-chain, but if you don't have possession of the private key for the first account, and no digital device has ever "seen" the hardware account then he would've been fine. This is assuming the key piece of evidence was his private key, and he wouldn't have been prosecuted without it. Additionally, putting your key in cloud storage sounds like the dumbest thing ever... Just memorize your seed phrase and write it down. Its 4bn for christ sake.
- pshc 5y agoYeah, a hardware wallet is good, although for a billion dollars, 100 hardware wallets would be better. Could even go so far as to split a private key into seven horcruxes using Shamir's Secret Sharing and bury them in locations around the world. Memorizing a seed phrase leaves you vulnerable to a $5 wrench attack, I wouldn't recommend it.
- mekster 5y agoFor the attacker, the problem isn't about protecting the crypto but to launder. If gov got to you, it probably doesn't matter how well you got it protected.
- GekkePrutser 5y ago> Memorizing a seed phrase leaves you vulnerable to a $5 wrench attack, I wouldn't recommend it. Of course the problem is the attacker may not know what method you used and resort to the $5 wrench attack anyway :) Not stealing $3.6B might be an even safer bet.
- jerrre 5y agostill: physical threat + seed phrase cracked > physical threat
- hnburnsy 5y agoThe famous Bitcoin family reportedly spread their hardware wallets across the globe. https://www.cnbc.com/2021/08/11/bitcoin-family-hides-bitcoin-ethereum-and-litecoin-in-secret-vaults.html?&doc=107011542 https://www.cnbc.com/2021/08/11/bitcoin-family-hides-bitcoin...