23 ms·
Bitcrypt broken
- pedro84 13y agoRansomware crypto fail: The number has 128 digits, which could indicate a (big) mistake from the malware author, who wanted to generate a 128 bytes key. Finally, we simply deal with RSA-464 encryption, which can easily be broken on a standard PC in a matter of hours.
- ChuckMcM 13y agoAnother reason why you shouldn't do your own crypto, leave it to the experts. :-)
- marcosdumay 13y agoLooks like the virus writer did live it to the experts. But then, he entered the wrong number at a function call.
- ChuckMcM 13y agoIs that like "Hey I got the 'Professional' model of this camera because I want my pictures to be professional." :-)
- jewel 13y agoThis is one reason why I tell people to have both offsite backups (in case of fire, theft, etc.) and offline backups. There are a lot of us that are just one SSH worm away from having all of our files destroyed. I've been thinking about ways to create an offline-equivalent backup, so that it can be automated. One way would be to have a computer that is only connected via serial cable, which only accepts new files to be backed up. (No ability to delete via the serial cable.)
- nodata 13y agoYou could use rsync.net. If you get rooted, and your files get deleted, you can ask for them to revert to a snapshot.
- gatehouse 13y agoYou create a backup system that has credentials into your target system, but the target has no credentials for the backup. The backup system can maintain the point-in-time history. Of course if you backup system gets hit then the whole thing falls apart, but you can isolate this one system and it doesn't need to accept any incoming connections.
- einhverfr 13y ago> Of course if you backup system gets hit then the whole thing falls apart, but you can isolate this one system and it doesn't need to accept any incoming connections. Unless you need to remote administer it.... But I suppose that's what virtualization helps with.
- dspillett 13y agoOr a step further: don't let either the live and backup sites connect to each other directly, instead use an intermediary site that both connect to (which can not connect back to them).
- mjn 13y agoA pretty low-tech system I saw in use in the '90s, without having to go all the way to serial cables, was just FTP with delete/overwrite disabled, to a machine with no other network services running. You dump a snapshot and FTP it to the backup host over your local ethernet. The FTP server accepts new files, but doesn't allow deletions or modifications of previously uploaded files (lots of FTP servers have this option, in order to be able to create a public "anonymous upload" folder without people overwriting each others' uploads). If you ever need to retrieve the backups, you physically log in on the backup machine and do something from there. This does rely on the FTP implementation being solid (vsftpd seems like a reasonable choice).
- gwern 13y ago> So, things were clear: the cybercriminal wants 0.4 Bitcoin, which made about 260 Euros at the time of infection, but only 89 Euros at the time of writing (Once again this shows how unreliable the Bitcoin money is, but that is something else). Fail.
- kzrdude 13y agoIt sounds like the article author used the MtGox price, which is irrelevant at the moment.
- muyuu 13y agoAuthor is clueless about the Bitcoin market. Not important for the article though.
- ZoFreX 13y agoCould you expand your comment a little beyond "Fail." to explain to those of us who aren't totally clued up on BitCoin what is wrong with that statement?
- wyager 13y agoThe author is using the MtGox price. MtGox is one of the smaller exchanges, and due to their incompetence, their trading system was hacked and Bitcoin withdrawals are disabled. As a result, the price of Bitcoin on Mt. Gox is about 1/5th what it is on all other exchanges. The author is using the mtgox price.
- retroafroman 13y agoThe cash value of Bitcoin declined since last fall, meaning the hacker is making less 'real' money now, if they try to trade the Bitcoin for cash. By hardcoding the asking amount of 0.4 Bitcoin, they are susceptible to the many ups and downs of the Bitcoin/$ ratio.
- gwern 13y agoThat's pretty bad, yes, but I was more irked by the author using a blatantly wrong and meaningless price.
- CharlesMerriam2 13y agoEvery article on security ends with: * Update your anti-virus software * Apply all software updates * Pick a hard password Rarely do these matter: ransomware, Target, etc., are exploits unrelated to these defenses. Why do we push them so hard? Does anyone feel safer and more righteous from advocating this security theatre?
- itchitawa 13y agoIndeed. Or even "don't click on suspicious emails or visit suspicious websites" which are actually always harmless. How about simply "don't run a program you don't trust" and we wouldn't need virus scanners at all.
- TrainedMonkey 13y agoThat would exclude me from using dominant majority of the software I use daily.
- itchitawa 13y agoOr at least cause you to consider the risk of loss compared to the value of using the software while not panicking when you receive a spam email with a suspicious looking xls file attached.
- lurkinggrue 13y agoDon't run unsolicited software.
- bloaf 13y agoMost people are pretty bad at deciding which programs are trustworthy.
- garrettgrimsley 13y agoAre drive-by-downloads no longer a legitimate threat?
- nwh 13y agoMalware aside, it's annoying that people still think Bitcoin payments come "from" an address. It's not something you can rely on or expect in Bitcoin, and certainly shouldn't be used to identify payments by a client. A unique address per payment requested is the proper, expected method.
- BlackDeath3 13y ago>Malware aside, it's annoying that people still think Bitcoin payments come "from" an address. Do you mind clarifying?
- nwh 13y agoSure. You essentially can't rely on a particular wallet sending from an address they know about, or even from an address they can control. The classic example is of a service using a shared wallet like Coinbase does. Coinbase maintains control of the keys of every piece of Bitcoin their clients own, and they have an external database that contains a record of how much Bitcoin they are holding on behalf of their clients. This allows them to keep the vast majority of the funds offline where they are invulnerable to attack. This system means that the "from" address is likely never correlated to the sender, and they have no control of where they send "from". Relying on a client to provide this information usually ends in disaster, as does sending refunds to an address you were sent "from". Even for the reference client Bitcoin-QT addresses are disposable and almost never linked. Change from one transaction is sent to an entirely new address which done invisibly from the users perspective. There's more information about that on the wiki, change addresses in themselves are quite confusing. https://en.bitcoin.it/wiki/Change https://en.bitcoin.it/wiki/Change
- iancarroll 13y agoI don't really think the malware author cares.
- fryguy 13y agoFor all intents and purposes, they do though. Using as an input that was originally an output sent to an address is practically the same thing as coming from the address itself. It only really breaks down for more complicated transactions.
- goldenkey 13y agoCould it be the author made it crackable because he wanted to be able to help anyone recover their files if there was some mishap? Just a thought.
- deleted 13y ago[deleted]
- Tegran 13y agoMalware author probably uses a multitude of wallets, but the one shown in that screenshot has received a few actual payments: https://blockchain.info/address/1HKCHx1RFhNHuF3NxLviHdrjNFzJbCTvrC https://blockchain.info/address/1HKCHx1RFhNHuF3NxLviHdrjNFzJ...
- wbillingsley 13y agoIt always seems a little odd to me that bitcoin is associated with criminal enterprise. Surely with the transaction record public, it's rather easier for the police to "follow the money" than with cash etc?
- aroch 13y agoYou can "follow the money" electronically, but unlike bank transfers there's no physical connection. Going from imaginary point 1 to imaginary point 2 doesn't really tell you anything.
- dllthomas 13y agoBut some transactions are ultimately linked to the physical world, and that gives a window through which more can be pinned down over time. Operating from just the blockchain doesn't tell you very much, but combined with other things it's a lot more informative than cash movements. You're never leaking less than you think.
- ifross 13y agoBitcoin mixers can make it almost impossible for people to follow bitcoin transactions, providing that the number of coins in the mixer far exceeds the amount you are trying to mix.
- dllthomas 13y agoAgain, you're never leaking less information than you think. I also expect that using bitcoin mixers will be prosecutable under AML laws in the medium term, if they aren't already.
- dreamfactory2 13y agoIsn't this the kind of thing the NSA should be spending their time and our money on?
- wyager 13y ago>So, things were clear: the cybercriminal wants 0.4 Bitcoin, which made about 260 Euros at the time of infection, but only 89 Euros at the time of writing (Once again this shows how unreliable the Bitcoin money is, but that is something else). Sigh. The author is using the MtGox price. Mtgox is one of the smaller Bitcoin exchanges these days. Due to their legendary incompetence, they got hacked a while back and disabled Bitcoin withdrawals. As a result, their "Bitcoin" trading price fluctuated from 1/2 to 1/6th that of other exchanges. The current market value of Bitcoin on all other exchanges is actually 400+ euros right now.
- Guvante 13y agoTo be fair to the author, not six months ago MTGox was the place to look for the price of Bitcoins.
- mml 13y agonb: crashplan will encrypt & back up your stuff locally & remotely (in multiple locations) and keep a version history, which pretty much nips this sort of crap in the bud. (not affiliated with those guys, just a happy user)
- dewiz 13y agoIs it just me, or a random new aes pwd for each file makes perfect sense? Otherwise once you brute force one file you could decrypt all the other ones.
- Strom 13y agoBrute forcing properly implemented AES isn't possible.
- dewiz 13y agoI don't understand what you're saying. Brute force is always possible. Succeding is only a matter of time. Suppose you find the password for one of those files, then you would be able to decrypt all your ransom data. When it comes to recovering your data, you might be ready to have a brute force running for long long long time 😊
- spiffytech 13y agoTechnically, if the universe went on forever, yes, you could brute force AES. However, with a well-chosen key (i.e., 256 random bits, and not merely a weaker password that was expanded into a 256-bit key), the odds are pretty decent that all life in the universe will end before you guess the key. A listener to Security Now wrote in to episode 340 with this for perspective: I took 256-bit encryption and assumed that the only way to crack it was, as we currently believe, a brute-force attack against the 256-bit key. ... So let's say the tricksy government has a secret algorithm that somehow allows them to weaken the strength to one trillionth of the original. That's a good number, one trillionth. And let's say they had a computer that can try 100 trillion guesses per second. And let's say this computer was one cubic millimeter in size, and let's say they build a cracking complex the size of the entire Earth made out of these one cubic millimeter crypto cracking computers. If I did my math right, it would still take 34 trillion years to crack. I've double-checked the math, that's how long it takes to exhaust the 256-bit keyspace, even in an unreasonably-generous scenario. You could halve that time to get the average time it takes to find any given 256-bit key, since you won't, on average, have to search the entire key space. We trust AES 256 because, as long as the algorithm is sound, it is actually impossible to brute-force in any useful time frame, for even insane definitions of "useful". Even in some scenarios where the algorithm isn't sound, as above, it's still impossible. The author of BitCrypt didn't use AES 256, however. They used AES 192, which is drastically weaker. According to the same calculations, it would take 0.00067 days to brute-force an AES 192 key. With a planet-sized cracking machine, impossibly fast computers, and a substantially weakened algorithm. However, it gets better - the author of BitKeeper didn't actually choose a 256-bit key, they chose a 16-character password that was expanded into a key, and that's what we can crack to decrypt an individual BitCrypt file. In our hypothetical (yet unrealistic) scenario, this can be done in under a second. So: brute-forcing well-implemented AES (good key, good key length) is impossible, no matter how you slice it. Brute forcing AES with a questionable key length is still impossible with anything remotely resembling the technology we'll see in our lifetimes. Brute-forcing a file encrypted by low-quality malware is absolutely possible, as the article shows :)
- rackoons44 13y agoThat's why you have online and offline backups.
- whogothacked 13y agoan Amazing tech system ...