Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WannaCry in-memory key recovery for Windows XP

github.com

Post reply on HN
Print view View original

71–80 of 95 posts

Re: WannaCry in-memory key recovery for Windows XP

#71

Post by closeparen »

kybernetikos wrote: post #32
soared wrote: post #17

Earlier quoted context omitted.

I mean a technical user capable of this solution is not very likely to get hit by this in the first place. The hacker probably doesn't care if x% of people defeat the encryption.. as long as x% pay the ransom.

Given the infrastructure and health victims that have been hit, I certainly hope that some serious people are looking into this. Given the relatively small sums of money we've seen flowing into the bitcoin addresses, if I were the perpetrator, I would not think I'd got a particularly good deal - exchanging 40k or so for interest from a number of heavy hitting actors just doesn't seem worth it.

If the infrastructure and health victims can be compromised by generic Windows hardware not even targeting them in particular & can't recover from backups, I'd argue they aren't heavy hitters. Though maybe they'll bring some in now.

Re: WannaCry in-memory key recovery for Windows XP

#72

Post by fgrimes »

murbard2 wrote: post #47

The attackers seem to have a poor grasp on cryptography. The entire point of RSA is that they don't have to generate the key locally. Just ship your ransomware with the attacker's public key, generate a symmetric key K locally, encrypt the data with K, encrypt K with the public key, offer to decrypt K for a ransom. There seems to be an inverse correlation between smart and evil in human beings which is reassuring, bu…

The more capable either avoid observation, or simply ensconce themselves within the existing economic power structure, hiding in plain sight while accruing accolades.

This is deemed "success."

Re: WannaCry in-memory key recovery for Windows XP

#73

Post by r721 »

marksomnian wrote: post #39
nthcolumn wrote: post #37

Earlier quoted context omitted.

And Windows XP was not targeted at all by WannaCry.

In that case, Microsoft wouldn't have released an emergency patch for XP, three years after end of support. But they did [0]. [0]: https://blogs.technet.microsoft.com/msrc/2017/05/12/customer...

XP could be targeted theoretically, the bug is there. But the particular WannaCry variant (which Kevin Beaumont‏ looked at) didn't work under XP:

https://twitter.com/GossiTheDog/status/863339558364229634

https://twitter.com/GossiTheDog/status/863100619242053632

Re: WannaCry in-memory key recovery for Windows XP

#75

Post by canoebuilder »

Senderman wrote: post #68
userbinator wrote: post #64

Earlier quoted context omitted.

I'm going to point at the elephant in the room and say that, there are probably quite a few reading this post and screaming in their mind, don't help them!! There seems to be an inverse correlation between smart and evil in human beings which is reassuring, but only mildly. Indeed, this isn't the first time ransomware with bad crypto has lead to a win for the good guys: http://blog.cassidiancybersecurity.com/post/201…

Not to interfere with any internal screaming, but I think (hope?) most would agree that a secondary elephant in the room is that suppressing knowledge so as not to help the "bad guys" tends to be the worse evil.

I don't see how that applies in this case. This is just someone saying hey bad guy, here is an idea on how to perform your dastardly act "better."

Having this public doesn't really defend against it any way. And if someone were to perform this act, it would be easy enough to figure out what was going on.

Re: WannaCry in-memory key recovery for Windows XP

#76

Post by bengalister »

murbard2 wrote: post #47

The attackers seem to have a poor grasp on cryptography. The entire point of RSA is that they don't have to generate the key locally. Just ship your ransomware with the attacker's public key, generate a symmetric key K locally, encrypt the data with K, encrypt K with the public key, offer to decrypt K for a ransom. There seems to be an inverse correlation between smart and evil in human beings which is reassuring, bu…

Cryptography expert usually recommend not to use the same key (here the ransomware's public key) for transport and storage. Maybe the symmetric key should not even be stored locally.

But the drawback is that with this approach the same symmetric key would be used to encrypt all files leaving it longer in memory. If 1 symmetric key is used per file it would mean that the ransomware would need to be queried for every file.

Using a locally generated asymmetric key encryption key AKEK to encrypt the files means that:

- The AKEK Pubkey can be kept in memory and the AKEK private key be sent immediately to the control center.

- A different symmetric key can be used to encrypt every file and the control center can be queried only once to retrieve the AKEK private key

On an unrelated note, I wonder if people thought about doing a DDOS on the onion service ... ?

Re: WannaCry in-memory key recovery for Windows XP

#77

Post by tomokasa »

canoebuilder wrote: post #75
Senderman wrote: post #68

Earlier quoted context omitted.

Not to interfere with any internal screaming, but I think (hope?) most would agree that a secondary elephant in the room is that suppressing knowledge so as not to help the "bad guys" tends to be the worse evil.

I don't see how that applies in this case. This is just someone saying hey bad guy, here is an idea on how to perform your dastardly act "better." Having this public doesn't really defend against it any way. And if someone were to perform this act, it would be easy enough to figure out what was going on.

I think it's fine to publicise better attack methods, so we can figure out how to defend against the next potential version.

We should be moving to better solutions regardless, like append-only backups.

Re: WannaCry in-memory key recovery for Windows XP

#78

Post by kaoD »

mikeash wrote: post #69
kaoD wrote: post #48

Earlier quoted context omitted.

> If you seed with nanoseconds it'll be a lot harder. Not really. Or rather, a lot of zero is zero.

Can you elaborate? I'm assuming the nanosecond-precision lock seeding the RNG is based on wall clock time or system uptime, so as long as the clock is actually that precise (and why not, when the base clock signal in the CPU is ticking a couple of times each nanosecond) you'll get that many digits.

Nanosecond resolution multiplies the brute force effort by 10^9, which is negligible.

Re: WannaCry in-memory key recovery for Windows XP

#79

Post by ezoe »

userbinator wrote: post #64
murbard2 wrote: post #47

The attackers seem to have a poor grasp on cryptography. The entire point of RSA is that they don't have to generate the key locally. Just ship your ransomware with the attacker's public key, generate a symmetric key K locally, encrypt the data with K, encrypt K with the public key, offer to decrypt K for a ransom. There seems to be an inverse correlation between smart and evil in human beings which is reassuring, bu…

I'm going to point at the elephant in the room and say that, there are probably quite a few reading this post and screaming in their mind, don't help them!! There seems to be an inverse correlation between smart and evil in human beings which is reassuring, but only mildly. Indeed, this isn't the first time ransomware with bad crypto has lead to a win for the good guys: http://blog.cassidiancybersecurity.com/post/201…

The knowledge he is writing is so basic anyone must understand.

You're saying like "We should not teach programming publicly since bad guy may misuse the knowledge."

Post reply on HN