Bitcrypt broken

http://blog.cassidiancybersecurity.com/post/2014/02/Bitcrypt-broken

by pedro84 • 12 years ago

221 87 12 years ago

blog.cassidiancybersecurity.com

pedro84• 12 years ago

Ransomware crypto fail:

  The number has 128 digits, which could indicate a (big)
  mistake from the malware author, who wanted to generate
  a 128 bytes key.
  Finally, we simply deal with RSA-464 encryption, which
  can easily be broken on a standard PC in a matter of hours.

ChuckMcM2• 12 years ago

Another reason why you shouldn't do your own crypto, leave it to the experts. :-)

marcosdumay2• 12 years ago

Looks like the virus writer did live it to the experts. But then, he entered the wrong number at a function call.

jewel2• 12 years ago

This is one reason why I tell people to have both offsite backups (in case of fire, theft, etc.) and offline backups. There are a lot of us that are just one SSH worm away from having all of our files destroyed.

I've been thinking about ways to create an offline-equivalent backup, so that it can be automated. One way would be to have a computer that is only connected via serial cable, which only accepts new files to be backed up. (No ability to delete via the serial cable.)

nodata• 12 years ago

You could use rsync.net. If you get rooted, and your files get deleted, you can ask for them to revert to a snapshot.

gatehouse• 12 years ago

You create a backup system that has credentials into your target system, but the target has no credentials for the backup. The backup system can maintain the point-in-time history.

Of course if you backup system gets hit then the whole thing falls apart, but you can isolate this one system and it doesn't need to accept any incoming connections.

einhverfr3• 12 years ago

Of course if you backup system gets hit then the whole thing falls apart, but you can isolate this one system and it doesn't need to accept any incoming connections.

Unless you need to remote administer it.... But I suppose that's what virtualization helps with.

dspillett2• 12 years ago

Or a step further: don't let either the live and backup sites connect to each other directly, instead use an intermediary site that both connect to (which can not connect back to them).

mjn• 12 years ago

A pretty low-tech system I saw in use in the '90s, without having to go all the way to serial cables, was just FTP with delete/overwrite disabled, to a machine with no other network services running. You dump a snapshot and FTP it to the backup host over your local ethernet. The FTP server accepts new files, but doesn't allow deletions or modifications of previously uploaded files (lots of FTP servers have this option, in order to be able to create a public "anonymous upload" folder without people overwriting each others' uploads). If you ever need to retrieve the backups, you physically log in on the backup machine and do something from there.

This does rely on the FTP implementation being solid (vsftpd seems like a reasonable choice).

eli• 12 years ago

Sounds like a typical tarsnap set up. You can have a key that only appends backups, but can't delete them.

jewel2• 12 years ago

That is a good idea. I have considered having a network service like that, but I'm a little too paranoid. I want something that will survive heretofore unseen events, like a 0-day remote root exploit in the Linux kernel networking stack.

If such a remote root exploit exists, and the person that discovers it decides to write something like the Code Red worm from 2001, and also decides to have the worm erase all block devices, I'd currently lose every file I have and all of my backups, even though they are geographically dispersed. It's possible that even services like S3 and Dropbox would be wiped in such an event.

Once again, I realize I'm unusually paranoid in this regard, but I really don't want to lose my stuff.

ZoFreX2• 12 years ago

offline backups

If it's online, it isn't a backup, it's redundancy.

marcosdumay2• 12 years ago

If it keeps history, it's not just redundancy.

And if it can not in any way overwrite history, it's as good as an offline backup. But now we are talking about custom kernels and maybe hardware.

aguki• 12 years ago

Why not just rsync to a sticky bit enabled directory?

einhverfr3• 12 years ago

I've been thinking about ways to create an offline-equivalent backup, so that it can be automated.

One of the approaches we take with Efficito is to ensure our offsite backups are pulled by the backup server, not pushed there by the backed up server (exception is made for archiving Pg wal segments). A backed-up server has no access to its own offsite, online backups for db base backups, file backups, and the like and only write-once-read-only access to its own WAL segment archives.

It's not quite an offline backup (and for our purposes there are real limitations with fully offline backups), but it is about as close as you can get.

dspillett2• 12 years ago

a lot of us that are just one SSH worm away from having all of our files destroyed.

This has happened quite a lot in some high profile cases over recent years, where [Company Name Here] was hacked and as well as taking down their live service the attackers got from there to the backups and killed them too.

I've been thinking about ways to create an offline-equivalent backup, so that it can be automated.

The trick I use to improve the safety of my online+offsite backups is to stop any one service being able to connect and authenticate with all the others, disconnecting the online backups from their source as much as possible.

My "live" stores connect to an intermediary and push updates, and my online backup stores connect to the intermediary and pull updates (with restores and automated tests being the same thing in reverse). The live stores and the backups can not connect+authenticate to each other directly, and the intermediary can't connect+authenticate to either the live store or the backups. This way if a malicious entity (be it a human or an automated exploit) gains access to a privileged account on any of the three locations it does not automatically gain access to all the others, but the process of taking and testing backups can still be automated.

Of course this isn't perfect: it is a little more hassle to setup, needs an extra resource (the intermediate location) which could potentially be a point of failure (though your automated backup tests will hopefully detect problems there before they become serious) and it depends on good credentials management (I sill need to be able to connect to all three for remote admin and if you use the same credentials for them all, and/or store said credentials in the same insecure place, the extra protection is lost) but I find it works well in practise. Also as I'm using the same OS+libs+tools in all three places I'm still susceptable to attacks using "zero day" exploits on some part of that stack, so for that reason (amongst others) this does not remove the need for truly offline backups.

ama729• 12 years ago

I've been thinking about ways to create an offline-equivalent backup, so that it can be automated. One way would be to have a computer that is only connected via serial cable, which only accepts new files to be backed up. (No ability to delete via the serial cable.)

A lower tech alternative is to use a Linear Tape-Open drive/cartridge. Not only are they archival safe (20 years+), but either you can use a new one every time or I think there is an option somewhere to only write once.

https://en.wikipedia.org/wiki/Linear_Tape-Open

Edit: Indeed, available since LTO3 https://en.wikipedia.org/wiki/Write_Once_Read_Many

kijin2• 12 years ago

If the size of your data is less than 4GB, a box of DVD+R's is also a cheap, secure and convenient way to make read-only backups. Just burn a new disc at the end of each workday, or whatever other interval your schedule and budget allows.

Of course this isn't really automated, but if you have one of those disc changers that people often use with audio CDs, you might be able to turn that into an automated system with a bit of scripting and hardware hacking.

cperciva• 12 years ago

I've been thinking about ways to create an offline-equivalent backup, so that it can be automated.

You can do this with Tarsnap. The tarsnap-keymgmt utility allows you to create key file which can only create new archives, not delete or overwrite existing ones.

gwern2• 12 years ago

So, things were clear: the cybercriminal wants 0.4 Bitcoin, which made about 260 Euros at the time of infection, but only 89 Euros at the time of writing (Once again this shows how unreliable the Bitcoin money is, but that is something else).

Fail.

kzrdude• 12 years ago

It sounds like the article author used the MtGox price, which is irrelevant at the moment.

muyuu4• 12 years ago

Author is clueless about the Bitcoin market.

Not important for the article though.

ZoFreX2• 12 years ago

Could you expand your comment a little beyond "Fail." to explain to those of us who aren't totally clued up on BitCoin what is wrong with that statement?

wyager2• 12 years ago

The author is using the MtGox price. MtGox is one of the smaller exchanges, and due to their incompetence, their trading system was hacked and Bitcoin withdrawals are disabled. As a result, the price of Bitcoin on Mt. Gox is about 1/5th what it is on all other exchanges. The author is using the mtgox price.

retroafroman• 12 years ago

The cash value of Bitcoin declined since last fall, meaning the hacker is making less 'real' money now, if they try to trade the Bitcoin for cash. By hardcoding the asking amount of 0.4 Bitcoin, they are susceptible to the many ups and downs of the Bitcoin/$ ratio.

shock-value• 12 years ago

The day-to-day value of Bitcoin, and therefore its utility as a proper currency, certainly isn't reliable.

For me personally, the time when people can (and do) reliably list prices in BTC (which do not float with BTC/USD exchange rate) is the time when I take Bitcoin's use as a currency seriously.

CharlesMerriam2• 12 years ago

Every article on security ends with:

* Update your anti-virus software * Apply all software updates * Pick a hard password

Rarely do these matter: ransomware, Target, etc., are exploits unrelated to these defenses. Why do we push them so hard? Does anyone feel safer and more righteous from advocating this security theatre?

itchitawa2• 12 years ago

Indeed. Or even "don't click on suspicious emails or visit suspicious websites" which are actually always harmless. How about simply "don't run a program you don't trust" and we wouldn't need virus scanners at all.

TrainedMonkey• 12 years ago

That would exclude me from using dominant majority of the software I use daily.

bloaf• 12 years ago

Most people are pretty bad at deciding which programs are trustworthy.

garrettgrimsley2• 12 years ago

Are drive-by-downloads no longer a legitimate threat?

muyuu4• 12 years ago

And if you are a cybercriminal, learn the difference between 128 base-10 digits and 128 bytes.

spoiler2• 12 years ago

Not to nitpick, but a string of 128 digits is technically still 128 bytes long, assuming ASCII/Latin digits!

I guess, the parent of this comment meant that the "address space" of 1e128 is much smaller than that of >702e300.

I just wanted to clarify, because it made me pause and wtf for a second.

vinkelhake• 12 years ago

Anti-virus programs detect many kinds of trojans and malware. Why could ransomware not be detected by anti-virus?

Those points are there because they make sense. While having an up-to-date system and anti-virus software isn't a silvet bullet, it's certainly better than nothing.

graylights2• 12 years ago

Static signatures are increasingly pointless as malware is rebuilt often.

Heuristics don't work against ransomware because they act like a well behaved program. Search for files, open file, overwrite file. All could be done as non-privileged user.

Ransomware is truly scary but the proper advice is: 1. Don't run untrusted software 2. Proper backups (e.g. not just a mirror) 3. Proper permissions on network drives that are mapped. Ransomware is devastating to small offices.

stusmall• 12 years ago

Just because it is not 100% accurate doesn't mean it is security theory. Security is about taking many measures to help mitigate threat. There is never a pragmatic, completely effective safe guard.

That being said, keep everything up to date and don't reuse passwords or use guessable ones :)

zAy0LfpBZLC8mAC• 12 years ago

That is somewhat of an unfortunate myth. Computer security is not a matter of withstanding force (where "adding an additional wall" might help) but one of correct logic. One of the best ways to achieve the latter is to get rid of unnecessary logic altogether. AV software does the opposite: It adds tons of more logic that gets into contact with untrusted data, and thus adds exploitation risk to the system (aka "attack surface"). Also, there is a very specific reason why AV really is more an annoyance filter than a security measure: It's a blacklist.

For some practical examples for why AV is risky, see also:

https://lock.cmpxchg8b.com/sophail.pdf https://lock.cmpxchg8b.com/sophailv2.pdf

al2o3cr• 12 years ago

Depends: does "apply all software updates" include installing something besides Windows? /snark :)

nwh2• 12 years ago

Malware aside, it's annoying that people still think Bitcoin payments come "from" an address. It's not something you can rely on or expect in Bitcoin, and certainly shouldn't be used to identify payments by a client. A unique address per payment requested is the proper, expected method.

iancarroll• 12 years ago

I don't really think the malware author cares.

BlackDeath3• 12 years ago

Malware aside, it's annoying that people still think Bitcoin payments come "from" an address.

Do you mind clarifying?

nwh2• 12 years ago

Sure. You essentially can't rely on a particular wallet sending from an address they know about, or even from an address they can control.

The classic example is of a service using a shared wallet like Coinbase does. Coinbase maintains control of the keys of every piece of Bitcoin their clients own, and they have an external database that contains a record of how much Bitcoin they are holding on behalf of their clients. This allows them to keep the vast majority of the funds offline where they are invulnerable to attack. This system means that the "from" address is likely never correlated to the sender, and they have no control of where they send "from". Relying on a client to provide this information usually ends in disaster, as does sending refunds to an address you were sent "from".

Even for the reference client Bitcoin-QT addresses are disposable and almost never linked. Change from one transaction is sent to an entirely new address which done invisibly from the users perspective. There's more information about that on the wiki, change addresses in themselves are quite confusing.

https://en.bitcoin.it/wiki/Change

fryguy2• 12 years ago

For all intents and purposes, they do though. Using as an input that was originally an output sent to an address is practically the same thing as coming from the address itself. It only really breaks down for more complicated transactions.

Buge• 12 years ago

The problem is that most clients are in control of a ton of addresses. Transactions often will come from a combination of several of the addresses. And the user has no control over which addresses are used. So a user cannot enter what address(es) a transaction will come from before the transaction is sent.

Bitcrypt works around this problem by having the victim enter the address after the transaction is sent. But this also has a problem. The victim can simply go to this page http://blockchain.info/address/1HKCHx1RFhNHuF3NxLviHdrjNFzJb... and watch for when a different victim sends a new transaction to that address. Then the first victim can claim that payment as their own.

jimktrains2• 12 years ago

They don't come from an address, they come from a previous transaction.

goldenkey• 12 years ago

Could it be the author made it crackable because he wanted to be able to help anyone recover their files if there was some mishap? Just a thought.

eric_h• 12 years ago

It seems unlikely to me that the author wanted to help anyone.

spoiler2• 12 years ago

Nice try, author. We know you're trying to save your skin now.

Just kidding! :P

Tegran• 12 years ago

Malware author probably uses a multitude of wallets, but the one shown in that screenshot has received a few actual payments:

https://blockchain.info/address/1HKCHx1RFhNHuF3NxLviHdrjNFzJ...

wbillingsley• 12 years ago

It always seems a little odd to me that bitcoin is associated with criminal enterprise. Surely with the transaction record public, it's rather easier for the police to "follow the money" than with cash etc?

aroch• 12 years ago

You can "follow the money" electronically, but unlike bank transfers there's no physical connection. Going from imaginary point 1 to imaginary point 2 doesn't really tell you anything.

dreamfactory2• 12 years ago

Isn't this the kind of thing the NSA should be spending their time and our money on?

Groxx• 12 years ago

Is it a risk to national security?

einhverfr3• 12 years ago

Once they are hit, they will think so....

meowface4• 12 years ago

No, it's not. It is for the FBI. And the FBI has in fact been actively investigating ransomware and fake AV campaigns for years.

wyager2• 12 years ago

So, things were clear: the cybercriminal wants 0.4 Bitcoin, which made about 260 Euros at the time of infection, but only 89 Euros at the time of writing (Once again this shows how unreliable the Bitcoin money is, but that is something else).

Sigh. The author is using the MtGox price. Mtgox is one of the smaller Bitcoin exchanges these days. Due to their legendary incompetence, they got hacked a while back and disabled Bitcoin withdrawals. As a result, their "Bitcoin" trading price fluctuated from 1/2 to 1/6th that of other exchanges. The current market value of Bitcoin on all other exchanges is actually 400+ euros right now.

Guvante• 12 years ago

To be fair to the author, not six months ago MTGox was the place to look for the price of Bitcoins.

mml• 12 years ago

nb: crashplan will encrypt & back up your stuff locally & remotely (in multiple locations) and keep a version history, which pretty much nips this sort of crap in the bud.

(not affiliated with those guys, just a happy user)

dewiz2• 12 years ago

Is it just me, or a random new aes pwd for each file makes perfect sense? Otherwise once you brute force one file you could decrypt all the other ones.

Strom• 12 years ago

Brute forcing properly implemented AES isn't possible.

dewiz2• 12 years ago

I don't understand what you're saying. Brute force is always possible. Succeding is only a matter of time. Suppose you find the password for one of those files, then you would be able to decrypt all your ransom data. When it comes to recovering your data, you might be ready to have a brute force running for long long long time 😊

rackoons44• 12 years ago

That's why you have online and offline backups.

whogothacked• 12 years ago

an Amazing tech system ...

Bitcrypt broken

Related Stories