3 ms·

It's a weird news. For sure there must be plenty of people who for say 10M$ would find the vulnerability or reverse engineer the whole thing.

pclmulqdq 4y ago
Some of these encrypted hard drive devices are weirdly secure. However, I can't see any harm in offering a bug bounty of 1/4th of the stash, putting up the model and serial number of the drive, and seeing who can crack it the fastest.
- filmgirlcw 4y ago
  I think you’d probably need a team that could clone the drive first and then you could do your attempts. From what I understand, that’s difficult here because of the encrypted flash drive he used (tho obviously not impossible). I’m sure someone like Cellebrite or the other agencies that have done iPhone hacking could do something like this — or at least figure out how to clone the drive to do multiple attempts at getting into it - but I don’t know how many places would do it on someone’s word that the crypto is there. Like, yeah, for 25%, I bet you could find people who could get it done. But I don’t know how many of those people who would undertake that work on a promise. What if it’s like Al Capone’s vault [1] and turns up empty? [1]: https://en.m.wikipedia.org/wiki/The_Mystery_of_Al_Capone%27s_Vaults https://en.m.wikipedia.org/wiki/The_Mystery_of_Al_Capone%27s...
  - jmount 4y ago
    I think the comment above is: "show me cracking a similar drive with nothing on it" as a capabilities test.
- maerF0x0 4y ago
  if they could crack it for 1/4, why would they give him any of it? "Sorry, we couldn't crack it, bye"
  - pclmulqdq 4y ago
    They demonstrate that they can crack it on a replica drive of the same model, then do the work in front of him to extract the private key. And if the bitcoins somehow move after they "fail" (remember, the blockchain is public), he knows who to sue.
johtso 4y ago
Joe Grand is one of those people: https://www.youtube.com/watch?v=dT9y-KQbqi4 https://www.youtube.com/watch?v=dT9y-KQbqi4 Also here's a presentation on finding vulnerabilities in Ironkey flashdrive: https://www.youtube.com/watch?v=R8iAqA0pklw https://www.youtube.com/watch?v=R8iAqA0pklw
- filmgirlcw 4y ago
  Yeah, it’s weird the guy hasn’t reached out to someone like Joe. Instead he just keeps sharing the story with the press, but like, you need to be going to white and black hat hackers and security professionals. I understand why it isn’t in Kingston’s interest to try to help him out, but if I had that much money trapped on something, I think I would do everything I could to actually free it, including paying people to look for vulnerabilities in the drive and reverse engineer. Getting those people to take me at my word might be tough, but I would do everything I could to release $200m in a wallet.
wolongong942 4y ago
IIRC this device was actually secure due to being developed/audited for use by the NSA as well as plebs, so it's not as simple as cloning something then doing unlimited attempts.

pclmulqdq 4y ago

Some of these encrypted hard drive devices are weirdly secure. However, I can't see any harm in offering a bug bounty of 1/4th of the stash, putting up the model and serial number of the drive, and seeing who can crack it the fastest.

filmgirlcw 4y ago
I think you’d probably need a team that could clone the drive first and then you could do your attempts. From what I understand, that’s difficult here because of the encrypted flash drive he used (tho obviously not impossible). I’m sure someone like Cellebrite or the other agencies that have done iPhone hacking could do something like this — or at least figure out how to clone the drive to do multiple attempts at getting into it - but I don’t know how many places would do it on someone’s word that the crypto is there. Like, yeah, for 25%, I bet you could find people who could get it done. But I don’t know how many of those people who would undertake that work on a promise. What if it’s like Al Capone’s vault [1] and turns up empty? [1]: https://en.m.wikipedia.org/wiki/The_Mystery_of_Al_Capone%27s_Vaults https://en.m.wikipedia.org/wiki/The_Mystery_of_Al_Capone%27s...
- jmount 4y ago
  I think the comment above is: "show me cracking a similar drive with nothing on it" as a capabilities test.
maerF0x0 4y ago
if they could crack it for 1/4, why would they give him any of it? "Sorry, we couldn't crack it, bye"
- pclmulqdq 4y ago
  They demonstrate that they can crack it on a replica drive of the same model, then do the work in front of him to extract the private key. And if the bitcoins somehow move after they "fail" (remember, the blockchain is public), he knows who to sue.

johtso 4y ago

Joe Grand is one of those people: https://www.youtube.com/watch?v=dT9y-KQbqi4 https://www.youtube.com/watch?v=dT9y-KQbqi4 Also here's a presentation on finding vulnerabilities in Ironkey flashdrive: https://www.youtube.com/watch?v=R8iAqA0pklw https://www.youtube.com/watch?v=R8iAqA0pklw

filmgirlcw 4y ago
Yeah, it’s weird the guy hasn’t reached out to someone like Joe. Instead he just keeps sharing the story with the press, but like, you need to be going to white and black hat hackers and security professionals. I understand why it isn’t in Kingston’s interest to try to help him out, but if I had that much money trapped on something, I think I would do everything I could to actually free it, including paying people to look for vulnerabilities in the drive and reverse engineer. Getting those people to take me at my word might be tough, but I would do everything I could to release $200m in a wallet.

wolongong942 4y ago

IIRC this device was actually secure due to being developed/audited for use by the NSA as well as plebs, so it's not as simple as cloning something then doing unlimited attempts.