The Mystery of the Encrypted Gauss Payload

http://www.securelist.com/en/blog/208193781/The_Mystery_of_the_Encrypted_Gauss_Payload

by jgrahamc • 14 years ago

157 44 14 years ago

jgrahamc3• 14 years ago

The core of this is 'find X' such that

  md5(md5(...10,000 times...(md5(X + salt)...)) = hash

where salt and hash are known. X is derived from the names of programs existing on a Windows machine with a particular format.

Or, find a way to calculate

  md5(md5(...10,000 times...(md5(X + salt')...))

given that hash is known and salt' but X is not.

Or alternatively, attempt a known plain text attack against RC4. Given that a certain amount of plain text is known (4 bytes) at the start of the RC4 payload then it's likely that the first few bytes of the keystream are known and an attack could be mounted via weakness in the RC4 key schedule.

raverbashing3• 14 years ago

Well, wasn't MD5 broken?

It should be possible to do a brute force search using a couple of days of EC2 or (insert your favorite cloud provider) here. And by bruteforce you can try text search, or just go for the raw bytes. Not sure a collision can work in this case as well.

jgrahamc3• 14 years ago

To recover X + salt you'd be looking at a preimage attack of MD5. I am only aware of one preimage attack against MD5 and it's only theoretical.

The input to the RC4 key generator is an MD5 hash which means you'd be looking at doing a brute force attack against an input of 2^128 bits. Assuming you find the answer on average in 2^127 and you are looking at an enormous search space.

According to a recent article EC2 has about 500,000 machines. Now assume that I buy them all and I am able on each machine to check 1,000,000,000 values as inputs to RC4 per second then I should have the answer in 800,000 times the age of the universe. But I think my credit card will have been cancelled first.

praptak• 14 years ago

Even with a reverse-md5^10000 oracle, you'd only get some bits that hash to the same hash as the mysterious pair of strings. Unfortunately the decryption key is derived from the pair of strings themselves, not from their hash. Reverting md5 is not enough to retrieve the decryption key.

orenmazor• 14 years ago

I just imagined the author reading that post and smirking to themselves.

tjic2• 14 years ago

My thought exactly - how weird it must be to be inside looking out.

Public key crypto was discovered on the inside long before it was rediscovered on the outside, and I figure that the insiders must have been amused by Diffie, Hellman, R, S, and A.

--------

http://en.wikipedia.org/wiki/Public-key_cryptography#History

In 1997, it was publicly disclosed that asymmetric key algorithms were developed by James H. Ellis, Clifford Cocks, and Malcolm Williamson at the Government Communications Headquarters (GCHQ) in the UK in 1973.[4] These researchers independently developed Diffie–Hellman key exchange, and a special case of RSA. The GCHQ cryptographers referred to the technique as "non-secret encryption". This work was named an IEEE Milestone in 2010.[5]

fryguy• 14 years ago

So does this mean that if you're a high profile target, you should immediately add a random folder to all of your computers in the program files directory?

ragmondo• 14 years ago

No..it means if you are running a specific program which unlocks the code you are going to have a bad time (I suppose you could rename all of your program directories though... would that defeat this ?)

sounds• 14 years ago

The full implications of this code are that the attacker already has another channel to access your machine.

It's not much consolation that you now know that you're being targeted by the Program Files entries (they're a major pain to rename). It's likely there are one or more plants inside your operation and they have physical access to the machine, which is considered game over.

dkokelley2• 14 years ago

From a commenter:

"2. Append the pair with the second hard-coded 16-byte salt and bytes 0x15, 0x00 " and assuming point 2 of my message above:

This gives a finger print of all actual used programs. This finger print should be specific in the range of 1 to 10^(-7).

If so specific, it limits the scope to preconfigured systems, which are NOT run under user control.

Might it be, that those targets are embedded systems like ATM, Mobile base stations and again SCADA-systems?

Supposedly an administrator could send an update that inserts random files in program files to foil the system identification method, but given that the attacker has such detailed information about the target systems, this seems like a temporary measure at best.

Edit: It looks like the code is only looking for a specific filename. In that case, the only way to thwart this is to rename that file (and fix any issues that this would cause).

mkup• 14 years ago

It looks like it would be easier to bruteforce fixed RC4 key than 10000 iterations of MD5, especially due to known weaknesses of RC4 key schedule.

Name of target software in Program Files is interesting nevertheless. Probably it's mentioned in the encrypted code/data.

ceautery• 14 years ago

The article mentions "~" as a possible starting point, but "{" is also greater than 7A, which would match all the "InstallShield Installation Information" subfolders.

eli3• 14 years ago

Great point... are those uniquely named based on the application installed? That might be a nice, oblique way of checking if a particular program is installed.

lt• 14 years ago

Yes, these are GUIDs in the following format:

{931373E2-3DA4-4631-930C-F59510630DA3}

It seems to me that's a good theory of what it might be looking for, as GUIDs should make good triggers. I wonder if this reduces the search space enough to make brute force feasible now.

sunyc• 14 years ago

checking prog directory might mean they are looking for specific machin with specific system image

mjs• 14 years ago

So whilst the malware will infect machines more or less indiscriminately, the payload itself can only be successfully decrypted (and therefore activated and executed), on machines that have a specific set of programs installed?

dkokelley2• 14 years ago

I think it's actually just one specific program, who's name starts with a special character or high UNICODE character.

kayge• 14 years ago

"the attackers are looking for a very specific program with the name written in an extended character set, such as Arabic or Hebrew, or one that starts with a special symbol such as “~”."

I suppose µTorrent is too obvious... Anyway, these kinds of mysteries help re-ignite my interest in Cryptography. I'd love to hear feedback from a fellow HNer about the course from Udacity (perhaps via email since it will probably be considered off-topic here).

Achshar• 14 years ago

I thought about uTorrent too, but Mu has a hex of 0x03BC. Plus it is a popular software and in windows, it's folder in program files uses 'u' instead of Mu.

http://www.fileformat.info/info/unicode/char/3bc/index.htm

meatsock• 14 years ago

a good point raised in the comments is that the "arabic or hebrew" part really meant to say a "non-letter us-ascii value including curley brackets, tilde, and pipe". not sure why anyone would want to jump the gun on narrowing down geography in this way.

tjic2• 14 years ago

> not sure why anyone would want to jump the gun on narrowing down geography in this way.

Because it's a tool designed to take out Iranian uranium refining tools.

lifeisstillgood3• 14 years ago

I think it is fair to say it is a general purpose tool, that was configured at least once, to take out Uranium refining tools.

So, I would be surprised to find this was not also using, say the parts of Unicode with Chinese characters as well.

trebor• 14 years ago

I'd like to see Kaspersky bust one of the Russian government-made viruses. I see them protecting customers from everyone else...

DividesByZero• 14 years ago

Do you have any examples of such a virus? So far only the US and Israel have been implicated in the creation of 'weaponised' malware.

fleitz• 14 years ago

Any chance that the Paladia Narrow font is designed to infect printers?

The Mystery of the Encrypted Gauss Payload

Related Stories