4 ms·

10.000 cloud GPUs running for a month is a lot of money. What was on that hard drive?

by wodenokoto 4y ago

unixhero 4y ago
Governments are formidable adversaries to have. They have amongst other virtually unlimited funds and resources.
- tgv 4y ago
  An average police department, however, has very limited funds. Unless the guy is much more interesting that we know, nobody would spend that much money on cracking his address book.
- joseph_grobbles 4y ago
  [dead]
thaumasiotes 4y ago
My guess would be contact information. He is apparently an anarchist imprisoned for setting fire to cars.
t0mas88 4y ago
Even with the smallest instance types that's around 8 million in compute cost. Doesn't sound like something you would spend on a small crime?
- WastingMyTime89 4y ago
  Multiple possible scenarios: - He actually gave his password himself as part of a deal with the police which includes this as a cover up. - The police got his password through another mean they don’t want to disclose and are using this as a cover up. - They really want a list of his contacts and what they were discussing because they are scared than one of them could be tempted to do more than burn a few cars. - France has a more computationally effective way to decrypt these drives which has yet to be released.
  - jacquesm 4y ago
    I would bet on '1'. That's the one that requires the least imagination.
  - Gasp0de 4y ago
    Bitlocker also saves encryption backup keys in the Microsoft cloud where they can probably subpoenad? Then they might have found the password saved on the windows PC somewhere.
    - deleted 4y ago
      [deleted]
  - marginalia_nu 4y ago
    If I wanted to get at an encrypted hard drive, I'd just tamper with the keyboard and record the password as it was being typed. Hardware keyloggers can be made very tiny with resources and determination.
    - le-mark 4y ago
      Does anyone have information or experience with this?
      - marginalia_nu 4y ago
        The USB HID protocol isn't encrypted. You can literally just add a pass through that logs (or transmits) the data. You'd have to check your USB connectors for a small extra dongle every time you boot up with just what is consumer-available[1]. There's also this type of stuff that can be wired into a keyboard[2], obviously harder to detect but a bit more involved to install as well. With a national R&D budget you can without a doubt do much better than both of these. [1] https://www.keelog.com/airdrive-keylogger/ https://www.keelog.com/airdrive-keylogger/ [2] https://www.keydemon.com/en/keydemon/28-1576-hardware-keylogger-module.html#/29-model-usb/54-memory-4mb https://www.keydemon.com/en/keydemon/28-1576-hardware-keylog...
- dist-epoch 4y ago
  Encrypting something well is so easy. If your encryption scheme fails at 8 million in compute cost something is horribly wrong.
mr_mitm 4y ago
The number comes from this mastodon post, which is cited in the original article: https://kolektiva.social/@cedar/110214532879538171 https://kolektiva.social/@cedar/110214532879538171 > This enemy site talks about using up to 10,000 computers with GPU acceleration to attack a LUKS password: > https://blog.elcomsoft.com/2020/08/breaking-luks-encryption/ https://blog.elcomsoft.com/2020/08/breaking-luks-encryption/ There, it says: > Up to 10,000 computers and on-demand cloud instances can be used to attack a single password with Elcomsoft Distributed Password Recovery. So this is the theoretical maximum of some service. We should not be under the impression that the hard drive of the activist in question has been attacked with 10,000 GPUs.

10.000 cloud GPUs running for a month is a lot of money. What was on that hard drive?

unixhero 4y ago

Governments are formidable adversaries to have. They have amongst other virtually unlimited funds and resources.

tgv 4y ago
An average police department, however, has very limited funds. Unless the guy is much more interesting that we know, nobody would spend that much money on cracking his address book.
joseph_grobbles 4y ago
[dead]

thaumasiotes 4y ago

My guess would be contact information. He is apparently an anarchist imprisoned for setting fire to cars.

t0mas88 4y ago

Even with the smallest instance types that's around 8 million in compute cost. Doesn't sound like something you would spend on a small crime?

WastingMyTime89 4y ago
Multiple possible scenarios: - He actually gave his password himself as part of a deal with the police which includes this as a cover up. - The police got his password through another mean they don’t want to disclose and are using this as a cover up. - They really want a list of his contacts and what they were discussing because they are scared than one of them could be tempted to do more than burn a few cars. - France has a more computationally effective way to decrypt these drives which has yet to be released.
- jacquesm 4y ago
  I would bet on '1'. That's the one that requires the least imagination.
- Gasp0de 4y ago
  Bitlocker also saves encryption backup keys in the Microsoft cloud where they can probably subpoenad? Then they might have found the password saved on the windows PC somewhere.
  - deleted 4y ago
    [deleted]
- marginalia_nu 4y ago
  If I wanted to get at an encrypted hard drive, I'd just tamper with the keyboard and record the password as it was being typed. Hardware keyloggers can be made very tiny with resources and determination.
  - le-mark 4y ago
    Does anyone have information or experience with this?
    - marginalia_nu 4y ago
      The USB HID protocol isn't encrypted. You can literally just add a pass through that logs (or transmits) the data. You'd have to check your USB connectors for a small extra dongle every time you boot up with just what is consumer-available[1]. There's also this type of stuff that can be wired into a keyboard[2], obviously harder to detect but a bit more involved to install as well. With a national R&D budget you can without a doubt do much better than both of these. [1] https://www.keelog.com/airdrive-keylogger/ https://www.keelog.com/airdrive-keylogger/ [2] https://www.keydemon.com/en/keydemon/28-1576-hardware-keylogger-module.html#/29-model-usb/54-memory-4mb https://www.keydemon.com/en/keydemon/28-1576-hardware-keylog...
dist-epoch 4y ago
Encrypting something well is so easy. If your encryption scheme fails at 8 million in compute cost something is horribly wrong.

mr_mitm 4y ago

The number comes from this mastodon post, which is cited in the original article: https://kolektiva.social/@cedar/110214532879538171 https://kolektiva.social/@cedar/110214532879538171 > This enemy site talks about using up to 10,000 computers with GPU acceleration to attack a LUKS password: > https://blog.elcomsoft.com/2020/08/breaking-luks-encryption/ https://blog.elcomsoft.com/2020/08/breaking-luks-encryption/ There, it says: > Up to 10,000 computers and on-demand cloud instances can be used to attack a single password with Elcomsoft Distributed Password Recovery. So this is the theoretical maximum of some service. We should not be under the impression that the hard drive of the activist in question has been attacked with 10,000 GPUs.