15 ms·
Kaspersky researcher cracks Flame malware password
- xal 14y ago> The hash - 27934e96d90d06818674b98bec7230fa - was resolved to the plain text password 900gage!@# by Bestuzhev. What? How did they crack this if brute force failed? That's scary as hell.
- ck2 14y agoThat has got to be one impossible rainbow table. More likely they used a table of known existing passwords and variations on the them?
- taw9 14y ago... maybe the FSB let them borrow one?
- andrewcooke 14y agothere are crackers that work with templates, so that they reduce the amount of space to search. the trick is to have good templates. for example, in this case, they probably had a template that was 3 digits, 4 lower-case letters, 3 symbols. the idea being that people are more likely to do that than 9#gag0e!0@, for example. so it's a combination of luck, computing power (they probably have a farm of gpus), and careful selection of templates (probably guided by analysis of known passwords).
- bcoates 14y agoIt's not just that template, it's an "obvious" 3 digit number, a 4 letter dictionary word, and "123" with shift held down. If you had some sort of statistical password ordering it wouldn't be that far down the list.
- andrewcooke 14y agoyou're right. and just to clarify for others the crackers can try certain digits (or doubles) before others and include common patterns (like 123) and transformations (like holding shift down).
- Zenst 14y agoYou mention "123" with the shift down and that in itself gives us a clue about it's possible origins. If the last part was shifted `123` on a UK keyboard then it would be `!"£`. So apart from USA layout keyboards, what other keyboard layouts country wise yeild a the same result from shifted 123. Still does not prove anything, but certainly is something to be mindful of. Either way I know I can sleep at night.
- dalke 14y agoOn the other hand, I know several Swedish programmers (here in Sweden) who do programming on a US keyboard. In part because it's more difficult to get the {}[], etc. keys with a Swedish keyboard. I suspect the same might be true with other nationalities.
- vrotaru 14y agoI will exclude France and Germany if the (Shift-123) is different from French/German layout, but otherwise a lot of programmers (power users) use the US layout. Esp. if we are speaking about people of certain age who maybe have started when DOS was cool.
- shawndellysse 14y agoKapersky cracked it. Symantic said brute force failed. That confused me for a second also.
- miles 14y agoNot only that: "Kaspersky analyst Dmitry Bestuzhev cracked the hash for the password Sept. 17 just hours after Symantec put out a public request for help" How is it possible to crack 900gage!@# in a few hours?
- forgotusername 14y agoAV companies like to share samples with each other, so guessing they had at least a bit of a head start. Still, brute forcing a 10 character password that uses the full ASCII printable character set looks like it'd require.. 9,500 years on a single high end GPU. No idea what the current state of cracking is, but probably they used some rules based approach (like John the Ripper used to have) to massively reduce the search space.
- emmelaich 14y agoNote that !@# is just shift-1, shift-2, shift-3. So not unlikely that it would appear in a rules based approach. The password is numbers, english word, keyboard-sequence.
- scottmcf 14y agoThanks for that explanation. Being accustomer to a UK keyboard layout this didn't occur to me (as shift 1-3 is !"£ here).
- dredmorbius 14y agoAre you saying JtR no longer has a rules-based approach, or that it's no longer used? It's still actively maintained. http://www.openwall.com/john/ http://www.openwall.com/john/
- forgotusername 14y agoI'm saying I haven't tried to crack a password in about 12 years :)
- WestCoastJustin 14y agoUnreal that he was able to crack it so fast.. a little scary really! He might have access to precomputed password hashes in a database. For example, you create a massive password list and compute all the hashes, save them in a database, why would you compute these hashes and throw away the results each time. You might just say "select plain_text from results where hash = '27934e96d90d06818674b98bec7230fa';". Just a guess though.
- revelation 14y agoIt's called a rainbow table, and it would be gigantic for 10 character strings with special characters considered.
- Pkeod 14y agoSmall size required (1-10 length, a-z, 0-9, Symbol 14 !@#$%^&*()-_+=) for a rainbow table needed for the hash would be around 438TB.
- jnuer 14y agoCan you provide explanation on how to compute that? Thanks.
- nitrogen 14y agoIt's probably just the number of permutations times the length of each hash.
- greenmountin 14y agoNaively, I get 3 exabytes. (50^10 + smaller terms) * 256 bits (SHA256 size) Number of hashes * size of hash to store. Obviously this isn't how it's actually done. The best page I found describing the process is: http://www.freerainbowtables.com/en/faq/ http://www.freerainbowtables.com/en/faq/ The forum is fascinating: http://www.freerainbowtables.com/phpBB3/uncracked-hashes-f23.html http://www.freerainbowtables.com/phpBB3/uncracked-hashes-f23...
- jayfuerstenberg 14y agoThe article neglects to mention what is perhaps the most important element of this story: the hashing algorithm used. Cracking a hashed algorithm computed in SHA-512 or even BCrypt is a different story from MD5.
- WestCoastJustin 14y agoPDF report by symantec of how the C&C was configured and how it works: http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_flamer_newsforyou.pdf http://www.symantec.com/content/en/us/enterprise/media/secur... Full Analysis of Flame's Command & Control servers by Kaspersky Lab Expert http://www.securelist.com/en/blog/750/Full_Analysis_of_Flame_s_Command_Control_servers http://www.securelist.com/en/blog/750/Full_Analysis_of_Flame...
- vinhboy 14y agoI find it really interesting that this is all done in a simple LAMP stack. And they made a bunch of mistakes in their code.
- Steko 14y agoSo I guess this was a previously cracked MD5 hash, 6th result below: http://www.google.com/search?q=900gage!%40%23&hl=en&safe=active&client=firefox-a&hs=O5U&rls=org.mozilla%3Aen-US%3Aofficial&sa=X&ei=-lZaUPnMJ8mi2QWgsIDgBw&ved=0CAkQpwUoBg&source=lnt&tbs=cdr%3A1%2Ccd_min%3A%2Ccd_max%3A9%2F16%2F2012&tbm= http://www.google.com/search?q=900gage!%40%23&hl=en&... {restricted date to before a few days ago}
- bcoates 14y agoGoogle's web search by date works by parsing dates on pages, not by loading actual historical search data, so it's possible to backdate information with it.
- emmelaich 14y agoI guess you're referring to OnlineHashCrack.com. Google search result says that that appeared on 21 Nov 2010. See it here from google's cache: http://goo.gl/Yctw3 http://goo.gl/Yctw3
- madsravn 14y agoBreaking a password and then forcing access to the server - isn't that illegal regardless of who does it?
- gknoy 14y agoI imagine that someone would have to come forward to complain that it was unauthorized access. I doubt anyone wants to claim to be running a botnet.
- insertnickname 14y agoThis reminds me of the story about the guy who called the police because he had his weed stolen from him I read in a local paper recently.
- luu 14y agoDo people still think this was created by the NSA? It seems extraordinarily unlikely that they would use such a weak password, one that you would expect to fall to a rules based engine. The only way I could even imagine that happening is as a bit of misdirection, and there must surely be misdirection you can do that doesn't compromise your security.
- WestCoastJustin 14y agoIt was reported in the nytimes that this is indeed a cyberweapons [1]. [1] http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacks-against-iran.html http://www.nytimes.com/2012/06/01/world/middleeast/obama-ord...
- danielweber 14y agoThat article doesn't seem to say that. It's suspected but the US has denied it. Who the heck lives at 900 Gage Road, though?
- 001sky 14y agoTitle: Obama Order Sped Up Wave of Cyberattacks Against Iran [1] _____________ [1] There's no doubt that the US has developed cyberweapons, cyberweapons have been used under Obama, or that flame is one of such a class of weapons. The attribution of flame is sort of a moot point re: "It was reported in the nytimes that this is indeed a cyberweapons". Viz: "Mr. Obama decided that the cyberattacks should proceed..." "The United States government...acknowledged developing cyberweapons"...and now "another cyberweapon called Flame that was recently discovered to have attacked" etc. per NYT.
- deleted 14y ago[deleted]
- drivebyacct2 14y agoAm I right in reading the Symantec C&C report and seeing that the servers were on Linux machines? Were the hiding the activity from themselves in case they were compromised? I assumed that they were infecting machines and using them as servers. Was there a linux vulnerability too?
- superuser2 14y agoHow did Kaspersky get the hash?
- YZF 14y agoThey got access to the server through some other undisclosed means, the hash was there.
- YZF 14y agoHow much anonymity does this scheme buy you? If the server is discovered presumably traffic can be traced back to its operators, no?
- ianhawes 14y agoPresumably, the operators accessing it are using other compromised servers as proxies to connect to the C&C servers. Their initial connection from HQ is probably to an overseas VPN that has been setup by an IC shell company (shell being a front, not computer shell).
- wahsd 14y agoWith enough investigation all of that could be tracked and disclosed. It is not impossible to track the origins of either methods of obfuscation if one is determined. Not that it's relevant because it was essentially already admitted that it was a US operation, possibly/probably in collaboration with Israelis; but that was basically obvious to all but the naive from the get-go.
- TomAnthony 14y agoDid I miss something? The C&C servers are still online and running?