3 ms·

Only 2 attempts left? Just clone the drive and run hashcat against it, I don't see the problem here.

plantain 4y ago
it's on an IronKey.
netsharc 4y ago
The drive's firmware could be preventing that from happening: https://www.trentonsystems.com/blog/self-encrypting-drives https://www.trentonsystems.com/blog/self-encrypting-drives Although I don't think they have the auto-destruct feature. But with 200M+ at stake, I'd put out a bounty for someone to reverse engineer the firmware. Edit: sibling commenter says it's IronKey, reading about it, reverse engineering won't be that trivial...
- filmgirlcw 4y ago
  It wouldn’t be. You’d think for a $50m or even $100m bounty, you could get people who hoard 0-days like Cellebrite to do it. I don’t know. If it were me, I would easily give up half of it to get the money back.
loyski 4y ago
You think they didn't thought about it?
edrxty 4y ago
Reading between the lines I think he has some sort of weird ass hardware coin wallet/high security encrypted flash drive that has some anti tamper smarts. I think the journalist used the word encrypted wrong here: >Thomas has just two attempts left to guess the password before it's encrypted and lost forever. I suspect they meant the drive would wipe itself after another attempt. You could attempt to pull the controller chip and decap to extract the secondary key which would allow you unlimited attempts
jki275 4y ago
This one would be extremely difficult. https://www.cl.cam.ac.uk/~sps32/IronKey_teardown.pdf https://www.cl.cam.ac.uk/~sps32/IronKey_teardown.pdf
postalrat 4y ago
There are good reason's why hardware tokens are more secure than password managers. First they are often damn near impossible to clone.
- flangola7 4y ago
  Offer someone 10% of the $200 million to find a zero day for it. That creepy Israeli company makes cracks for secure enclaves for lower prices than that, and for much newer security hardware. If nothing else find a university with an election microscope and give some CS students a project of reading the key bits directly. Enclaves keep out petty thieves, not determined attackers with unlimited physical access. Chapter 1 of cybersecurity is no hardware can protect against that. It just isn't believable that you can have a storage drive sitting in front of you which contains both encrypted data and the decryption key (or at least the password-encrypted decryption key) and yet not be able to access the data.
postalrat 4y ago
Well it won't be forever. Eventually we will figure out the math to generate a private key for any bitcoin address.
- earthling8118 4y ago
  At which point the coins will no longer have a value that is relevant
  - ashwagary 4y ago
    More likely a bip (bitcoin improvement proposal) will be introduced that makes the math useless by changing key structure.
  - maerF0x0 4y ago
    Or there will be a period of obscurity in which both the math is known (to some/few) and they will secretly profit off that knowledge.

it's on an IronKey.

The drive's firmware could be preventing that from happening: https://www.trentonsystems.com/blog/self-encrypting-drives https://www.trentonsystems.com/blog/self-encrypting-drives Although I don't think they have the auto-destruct feature. But with 200M+ at stake, I'd put out a bounty for someone to reverse engineer the firmware. Edit: sibling commenter says it's IronKey, reading about it, reverse engineering won't be that trivial...

filmgirlcw 4y ago
It wouldn’t be. You’d think for a $50m or even $100m bounty, you could get people who hoard 0-days like Cellebrite to do it. I don’t know. If it were me, I would easily give up half of it to get the money back.

loyski 4y ago

You think they didn't thought about it?

edrxty 4y ago

Reading between the lines I think he has some sort of weird ass hardware coin wallet/high security encrypted flash drive that has some anti tamper smarts. I think the journalist used the word encrypted wrong here: >Thomas has just two attempts left to guess the password before it's encrypted and lost forever. I suspect they meant the drive would wipe itself after another attempt. You could attempt to pull the controller chip and decap to extract the secondary key which would allow you unlimited attempts

jki275 4y ago

This one would be extremely difficult. https://www.cl.cam.ac.uk/~sps32/IronKey_teardown.pdf https://www.cl.cam.ac.uk/~sps32/IronKey_teardown.pdf

postalrat 4y ago

There are good reason's why hardware tokens are more secure than password managers. First they are often damn near impossible to clone.

flangola7 4y ago
Offer someone 10% of the $200 million to find a zero day for it. That creepy Israeli company makes cracks for secure enclaves for lower prices than that, and for much newer security hardware. If nothing else find a university with an election microscope and give some CS students a project of reading the key bits directly. Enclaves keep out petty thieves, not determined attackers with unlimited physical access. Chapter 1 of cybersecurity is no hardware can protect against that. It just isn't believable that you can have a storage drive sitting in front of you which contains both encrypted data and the decryption key (or at least the password-encrypted decryption key) and yet not be able to access the data.

postalrat 4y ago

Well it won't be forever. Eventually we will figure out the math to generate a private key for any bitcoin address.

earthling8118 4y ago
At which point the coins will no longer have a value that is relevant
- ashwagary 4y ago
  More likely a bip (bitcoin improvement proposal) will be introduced that makes the math useless by changing key structure.
- maerF0x0 4y ago
  Or there will be a period of obscurity in which both the math is known (to some/few) and they will secretly profit off that knowledge.