9 ms·

A tale of Phobos – How we almost cracked a ransomware using CUDA

230 points by msm_ 4y ago

rfoo 4y ago
Overall, cool work! Especially the search space reduction part. I haven't dive into the code, but only 818000/60=13633 attempts per second for 64 SHA-256 rounds plus one AES-256 decryption on a 2080 doesn't sound right. Learn some GPU and tuning the code can likely increase the throughput a lot. Mind you, that's only 25x naive Python implementation on (supposedly) 1 core. Also, hashcat does >1M hash/s for even higher number of SHA256 iterations, and hundreds of million attempts per second on single block AES-256. Edit: An optimized version of this is very likely deployable on consumer-grade hardware. May still not very useful due to the forensics requirement, though.
- msm_ 4y ago
  Thanks! I wonder if the Python number is correct, I remember Python being prohibitively slow in comparison. But assuming it is: There are 256 sha256 iterations on average, so the number is a bit better - but there's probably still a lot to improve (it's much more optimised than the naive version, but it was written by reverse-engineers, not GPGPU specialists). The PoC was also opensourced [0], it would be great if someone experienced could spot any obvious problems. One major issue was that the key scheduling is basically do { key = sha256(key) while (key[0] != '\0') So on average there are 256 SHA256s per key, but worst case it takes thousands of iterations. Coding this in a GPU-friendly way was non-trivial, and there are still some GPU cycles wasted. > Edit: An optimized version of this is very likely deployable on consumer-grade hardware. May still not very useful due to the forensics requirement, though. I think speeding the code three or four orders of magnitude more would go a long way towards pracical usage. I think the biggest issue was getting TID and precise enough time range. Brute-forcing a suspected TID values and widening the time search range would help a lot. Disclaimer: I worked on that research, but I'm not an employe anymore. [0]: https://github.com/CERT-Polska/phobos-cuda-decryptor-poc https://github.com/CERT-Polska/phobos-cuda-decryptor-poc
  - dr_zoidberg 4y ago
    One other thing. The article states pythons performance at keys-per-second, then all the other numbers are given in keys-per-minute. That means that pythons number looks really small in comparison, but if we take it (500 kps) and multiply it by 60, we get 30k keys-per-minute, or about 50% faster than the first CUDA baseline. Now I'm quite fond of python, but largely I read this as the CUDA implementation having quite some room for improvement. Having almost no CUDA experience of my own, that is just a hunch, which I'm glad rfoo supports with (surely) a lot more experience than me.
  - iforgotpassword 4y ago
    I can't offer "four orders of magnitude", but "four" ;-) PIDs on windows are always a multiple of four. (I didn't see that mentioned in the blog post, but didn't check the code so maybe that's already in there.) Edit: nvm I guess that's why it says 2^30 not 2^32...
6_6_6 4y ago
phobos is not a moon !!! phobos is the god and personification of fear and panic in Greek mythology. this is crucial in understanding ransomware ;)
- ambicapter 4y ago
  I imagine it's the root of the term "phobia" in this way.
  - stavros 4y ago
    It is, yeah.
    - tonymillion 4y ago
      This little thread was actually more interesting/informative than the linked article
- pksebben 4y ago
  also a moon.[1]. Perhaps most importantly, also a knight of Mars, beater of ass [2] 1 https://solarsystem.nasa.gov/moons/mars-moons/phobos/in-depth.amp https://solarsystem.nasa.gov/moons/mars-moons/phobos/in-dept... 2 https://youtu.be/BP0-znoJ6fs https://youtu.be/BP0-znoJ6fs
degenerate 4y ago
Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos. I've been holding onto the encrypted copies for a while in hopes that some people were working on a crack, and I'm excited to read this update. Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? I found out too late that all my backups were encrypted. I only had 1 week retention to save space. Is longer retention and manual checks the only sane strategy? Or has some backup software built in sanity detection for crypto attacks by now?
- 908B64B197 4y ago
  > what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? Compute checksums. Also, if storing diffs check out how many files the back-up think changed. All of your photo library getting re-uploaded should be a red flag.
  - Helmut10001 4y ago
    I do this using an `rsync --dry-run` with `--stats` enabled, you can get the number of changed/deleted files from the stats and then decide whether you want to proceed without `--dry-run`. This is for off-site backups. For on-site, I prefer ZFS Snapshots.
- throwaway78941 4y ago
  Don't save just up to 1 week old snapshots. Also save a 2 week old, 3 week old and 1 month old one.
- bombcar 4y ago
  I do an off-line, off-site backup once a year that never gets overwritten. ZFS snapshots can help here, too, for online stuff, especially if you have monitoring about changeset size.
  - mavhc 4y ago
    zfs server where you can only ssh into it with 1 user, and that user cannot zfs destroy, only zfs receive
Tepix 4y ago
So, if you're a victim and you don't want to pay ransom - hire an expert to find out the missing data (timestamp, is it the vulnerable version?, ...), then - rent a GPU server and keep the fingers crossed. I've looked for cheap GPU servers yesterday, the cheapest i found was Ultrarender at 200€ per week for a Dual RTX 3080Ti remote workstation. Which is probably overkill, a single RTX 3080Ti can do it in 33 hours or so (assuming the "12 Nvidia GPUs" they mentioned in the article are of similar speed).
- MaxMatti 4y ago
  Not sure if you could run that on vast.ai but they do offer more granular pricing, so that might be the better option.
- msm_ 4y ago
  Yes, that's the "almost" part of the blog post (and what makes it interesting, IMO). Not really something a regular person can do. Since CERT is not profit-driven, that kind of help was offered for governmental institutions for free (but it's hard, because government and companies need to recover ASAP and this kind of research and computation takes time). If you want success stories, the same organisation has also published decryptors for other ransomware families (Mapo, Crypromix, Flotera) and they were just broken in a straightforward way. Usually the vulnerability is not explained for successful decryptors, to make bad guys life a bit harder.
- semitones 4y ago
  coreweave.com has pretty cheap GPUs
comboy 4y ago
I know I'm in minority and that this view is not empathetic one, but I really like that ransomware is around. More secure data storage at companies where otherwise it would be just silently stolen and sold. More backups. Even some incentive to research security of encryption methods. We won't get more secure systems without some proper incentives.
- xwdv 4y ago
  I love that ransomware is around because it forces companies to take security seriously or pay the price. You could even say ransomers are the good guys in this regard, contributing to a safer world.
  - bobleeswagger 4y ago
    Robber barons have always shaped the world in mysterious ways that history does not fully grasp.
- zht 4y ago
  This is like saying it’s a good thing that burglars exist so it forces us to invest in stronger locks/doors
  - vorpalhex 4y ago
    An unhardened system allows the first attacker the maximum benefit. A hardened system reduces incentive for the first and every follow on attacker. Good things can come from bad things. That doesn't make the bad things not bad.
  - comboy 4y ago
    If you really want burglars and locks analogy it would be invisible burglars, that steal secrets and things you don't notice from your home. Then some not invisible burglars appear and you realize you need better locks. Invisible burglars are more dangerous. You may prefer world without burglars at all, but that is not an option. It's just wishful thinking.
  - 4y ago
Nursa90 4y ago
[flagged]
zitterbewegung 4y ago
I think this would be a stupid idea but you can buy an Antminer for $2458 and it does 104 TH/S for SHA256. I think doing a bit of hacking to make it crack the ransomware might be feasible?
- ganoushoreilly 4y ago
  There have been tons of projects that tried to repurpose bitcoin hardware. Even if it's not the latest that's a lot of computational power! So far though none of the project I follow have yielded any real results. Here's a interesting read that gives a bit of info on the differences and why it doesn't really work. https://rya.nc/asic-cracking.html https://rya.nc/asic-cracking.html
  - PUSH_AX 4y ago
    Interesting, I wonder if you could (hypothetically) develop some hardware that does the bits the CPU needs to do and essentially have a cracker ASIC? And if it would yield improvements that require a reaction.
    - ganoushoreilly 4y ago
      I'm sure you could build an asic for assistance, but I tend to see more FPGA style tools for these kinds of things given changes / variables that you wouldn't want hardcoded. There have definitely been a few tools built, the article I linked had reference to DES hardware crackers. Anyone that comes up with a way to repurpose all those bitcoin miners into something productive will be pretty cool in my book.
  - ryan-c 4y ago
    I'm glad people are still finding that post useful.
    - ganoushoreilly 4y ago
      Thanks for writing it! Most of your posts were interesting reads.

230 points by msm_ 4y ago

rfoo 4y ago

Overall, cool work! Especially the search space reduction part. I haven't dive into the code, but only 818000/60=13633 attempts per second for 64 SHA-256 rounds plus one AES-256 decryption on a 2080 doesn't sound right. Learn some GPU and tuning the code can likely increase the throughput a lot. Mind you, that's only 25x naive Python implementation on (supposedly) 1 core. Also, hashcat does >1M hash/s for even higher number of SHA256 iterations, and hundreds of million attempts per second on single block AES-256. Edit: An optimized version of this is very likely deployable on consumer-grade hardware. May still not very useful due to the forensics requirement, though.

msm_ 4y ago
Thanks! I wonder if the Python number is correct, I remember Python being prohibitively slow in comparison. But assuming it is: There are 256 sha256 iterations on average, so the number is a bit better - but there's probably still a lot to improve (it's much more optimised than the naive version, but it was written by reverse-engineers, not GPGPU specialists). The PoC was also opensourced [0], it would be great if someone experienced could spot any obvious problems. One major issue was that the key scheduling is basically do { key = sha256(key) while (key[0] != '\0') So on average there are 256 SHA256s per key, but worst case it takes thousands of iterations. Coding this in a GPU-friendly way was non-trivial, and there are still some GPU cycles wasted. > Edit: An optimized version of this is very likely deployable on consumer-grade hardware. May still not very useful due to the forensics requirement, though. I think speeding the code three or four orders of magnitude more would go a long way towards pracical usage. I think the biggest issue was getting TID and precise enough time range. Brute-forcing a suspected TID values and widening the time search range would help a lot. Disclaimer: I worked on that research, but I'm not an employe anymore. [0]: https://github.com/CERT-Polska/phobos-cuda-decryptor-poc https://github.com/CERT-Polska/phobos-cuda-decryptor-poc
- dr_zoidberg 4y ago
  One other thing. The article states pythons performance at keys-per-second, then all the other numbers are given in keys-per-minute. That means that pythons number looks really small in comparison, but if we take it (500 kps) and multiply it by 60, we get 30k keys-per-minute, or about 50% faster than the first CUDA baseline. Now I'm quite fond of python, but largely I read this as the CUDA implementation having quite some room for improvement. Having almost no CUDA experience of my own, that is just a hunch, which I'm glad rfoo supports with (surely) a lot more experience than me.
- iforgotpassword 4y ago
  I can't offer "four orders of magnitude", but "four" ;-) PIDs on windows are always a multiple of four. (I didn't see that mentioned in the blog post, but didn't check the code so maybe that's already in there.) Edit: nvm I guess that's why it says 2^30 not 2^32...

6_6_6 4y ago

phobos is not a moon !!! phobos is the god and personification of fear and panic in Greek mythology. this is crucial in understanding ransomware ;)

ambicapter 4y ago
I imagine it's the root of the term "phobia" in this way.
- stavros 4y ago
  It is, yeah.
  - tonymillion 4y ago
    This little thread was actually more interesting/informative than the linked article
pksebben 4y ago
also a moon.[1]. Perhaps most importantly, also a knight of Mars, beater of ass [2] 1 https://solarsystem.nasa.gov/moons/mars-moons/phobos/in-depth.amp https://solarsystem.nasa.gov/moons/mars-moons/phobos/in-dept... 2 https://youtu.be/BP0-znoJ6fs https://youtu.be/BP0-znoJ6fs

degenerate 4y ago

Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos. I've been holding onto the encrypted copies for a while in hopes that some people were working on a crack, and I'm excited to read this update. Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? I found out too late that all my backups were encrypted. I only had 1 week retention to save space. Is longer retention and manual checks the only sane strategy? Or has some backup software built in sanity detection for crypto attacks by now?

908B64B197 4y ago
> what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? Compute checksums. Also, if storing diffs check out how many files the back-up think changed. All of your photo library getting re-uploaded should be a red flag.
- Helmut10001 4y ago
  I do this using an `rsync --dry-run` with `--stats` enabled, you can get the number of changed/deleted files from the stats and then decide whether you want to proceed without `--dry-run`. This is for off-site backups. For on-site, I prefer ZFS Snapshots.
throwaway78941 4y ago
Don't save just up to 1 week old snapshots. Also save a 2 week old, 3 week old and 1 month old one.
bombcar 4y ago
I do an off-line, off-site backup once a year that never gets overwritten. ZFS snapshots can help here, too, for online stuff, especially if you have monitoring about changeset size.
- mavhc 4y ago
  zfs server where you can only ssh into it with 1 user, and that user cannot zfs destroy, only zfs receive

Tepix 4y ago

So, if you're a victim and you don't want to pay ransom - hire an expert to find out the missing data (timestamp, is it the vulnerable version?, ...), then - rent a GPU server and keep the fingers crossed. I've looked for cheap GPU servers yesterday, the cheapest i found was Ultrarender at 200€ per week for a Dual RTX 3080Ti remote workstation. Which is probably overkill, a single RTX 3080Ti can do it in 33 hours or so (assuming the "12 Nvidia GPUs" they mentioned in the article are of similar speed).

MaxMatti 4y ago
Not sure if you could run that on vast.ai but they do offer more granular pricing, so that might be the better option.
msm_ 4y ago
Yes, that's the "almost" part of the blog post (and what makes it interesting, IMO). Not really something a regular person can do. Since CERT is not profit-driven, that kind of help was offered for governmental institutions for free (but it's hard, because government and companies need to recover ASAP and this kind of research and computation takes time). If you want success stories, the same organisation has also published decryptors for other ransomware families (Mapo, Crypromix, Flotera) and they were just broken in a straightforward way. Usually the vulnerability is not explained for successful decryptors, to make bad guys life a bit harder.
semitones 4y ago
coreweave.com has pretty cheap GPUs

comboy 4y ago

I know I'm in minority and that this view is not empathetic one, but I really like that ransomware is around. More secure data storage at companies where otherwise it would be just silently stolen and sold. More backups. Even some incentive to research security of encryption methods. We won't get more secure systems without some proper incentives.

xwdv 4y ago
I love that ransomware is around because it forces companies to take security seriously or pay the price. You could even say ransomers are the good guys in this regard, contributing to a safer world.
- bobleeswagger 4y ago
  Robber barons have always shaped the world in mysterious ways that history does not fully grasp.
zht 4y ago
This is like saying it’s a good thing that burglars exist so it forces us to invest in stronger locks/doors
- vorpalhex 4y ago
  An unhardened system allows the first attacker the maximum benefit. A hardened system reduces incentive for the first and every follow on attacker. Good things can come from bad things. That doesn't make the bad things not bad.
- comboy 4y ago
  If you really want burglars and locks analogy it would be invisible burglars, that steal secrets and things you don't notice from your home. Then some not invisible burglars appear and you realize you need better locks. Invisible burglars are more dangerous. You may prefer world without burglars at all, but that is not an option. It's just wishful thinking.
- 4y ago

Nursa90 4y ago

[flagged]

zitterbewegung 4y ago

I think this would be a stupid idea but you can buy an Antminer for $2458 and it does 104 TH/S for SHA256. I think doing a bit of hacking to make it crack the ransomware might be feasible?

ganoushoreilly 4y ago
There have been tons of projects that tried to repurpose bitcoin hardware. Even if it's not the latest that's a lot of computational power! So far though none of the project I follow have yielded any real results. Here's a interesting read that gives a bit of info on the differences and why it doesn't really work. https://rya.nc/asic-cracking.html https://rya.nc/asic-cracking.html
- PUSH_AX 4y ago
  Interesting, I wonder if you could (hypothetically) develop some hardware that does the bits the CPU needs to do and essentially have a cracker ASIC? And if it would yield improvements that require a reaction.
  - ganoushoreilly 4y ago
    I'm sure you could build an asic for assistance, but I tend to see more FPGA style tools for these kinds of things given changes / variables that you wouldn't want hardcoded. There have definitely been a few tools built, the article I linked had reference to DES hardware crackers. Anyone that comes up with a way to repurpose all those bitcoin miners into something productive will be pretty cool in my book.
- ryan-c 4y ago
  I'm glad people are still finding that post useful.
  - ganoushoreilly 4y ago
    Thanks for writing it! Most of your posts were interesting reads.