Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we recovered $300k of Bitcoin

reperiendi.wordpress.com

Post reply on HN
Print view View original

81–90 of 209 posts

Re: How we recovered $300k of Bitcoin

#81

Post by metaweta »

aazaa wrote: post #24

> Recovering the key was usually instantaneous, but to help people feel like they’d gotten their money’s worth, we’d put on a little animated show like a Hollywood hacking scene with lots of random characters that gradually revealed the right password. and later ... > I’m currently looking for work in a staff or senior staff engineering or data scientist role. If you’ve got interesting technical analysis or optimizat…

That little animation was put there by the guy who hired me. We got rid of it in the Password Recovery ToolKit that combined all the modules I'd written into a single tool. In that one, we had a big list of any encrypted files we found and their passwords. With enough modules, it was entertaining enough to watch the list grow. And it was very satisfying when the user reused a password on something trivial to crack that let us open a Word 97 file.

Re: How we recovered $300k of Bitcoin

#82

Post by metaweta »

WheelsAtLarge wrote: post #41

I always assumed that the encryption used on zip files was relatively trivial and could be broken given the right software and hardware. Well, it looks like it's a lot harder than I thought. You still need the right software and hardware but you also need the right person to do it. Most of what I read was above my understanding but it was good reading anyhow. Good job on the recovery and good job writing about it.

Thanks!

Re: How we recovered $300k of Bitcoin

#83

Post by hippich »

aazaa wrote: post #24

> Recovering the key was usually instantaneous, but to help people feel like they’d gotten their money’s worth, we’d put on a little animated show like a Hollywood hacking scene with lots of random characters that gradually revealed the right password. and later ... > I’m currently looking for work in a staff or senior staff engineering or data scientist role. If you’ve got interesting technical analysis or optimizat…

Slightly offtopic, but I always laughed at these types of animations in hacker movies. Until one day I made a tool to extract strings (mostly passwords or hashes, purely for academic purposes!) through SQL injections in SQL Server when the error message did not return anything useful. I scanned each character bit by bit and depending on the value, I would either return control immediately or delay the response by a couple of hundred ms. That allowed me to reconstruct the string bit by bit, and as new information was acquired for each character - it would change on the screen. It looked exactly like some of these hacker movie scenes... =)

Re: How we recovered $300k of Bitcoin

#85

Post by FabHK »

dirtydroog wrote: post #21
sireat wrote: post #5

The author is a very talented applied cryptographer with a very impressive resume (he is looking for new projects). The following CV line stands out however: Google: Software Engineer, Ads Review. June 2014– March 2016. Angular / Java developer on the internal tool used by contractors to review Google ads for policy violations. How did that saying about "brightest minds working on ads" go? I am not blaming the author…

Actually, being involved in ad tech can get you involved in some really cool tech. It's an incredibly fast-paced industry, lots of parallels to HFT. And yes, everyone in the industry knows that ads don't work, you have all the ad blockers, etc.

> lots of parallels to HFT.

Including the fact that it might make its practitioners rich, while creating nothing of social value.

Re: How we recovered $300k of Bitcoin

#86

Post by tomlagier »

milesvp wrote: post #50
xakahnx wrote: post #11

Earlier quoted context omitted.

It brings interesting trade-offs for program design. You can write the code one way which may be 10x faster but harder to reason about, or another way which is more straightforward but takes an extra 5 days go execute. How confident are you in your code or debugging ability? How many iterations will you need? I'm assuming this was written in CUDA based on the block/thread ID mix-up.

Funny this. Back when I had more time on my hands I liked to do project euler problems. I'd start with the dumbest brute force method to find the answer, and let that run. Then I'd see if I could figure out the math and implement it correctly before the brute force finished. I'd say I had about an 95% success rate at beating the dumb brute force (course it really depends on the problem search space). What was interes…

This is part of the reason why the software industry's decision to use algorithm problems as time-bounded interview questions is so frustrating.

Right away, you have to make a choice between doing it the reliable way (brute force) and taking a gamble on being able to out-smart the problem and doing it the math-y way. This adds a ton of pressure, no matter which path you choose.

If you choose to start with brute-force, you're stressed that you look stupid because you don't know the trick. If you spend precious minutes looking for the trick, you're stressed because there's no guarantee you'll crack it in the given time.

I've just gone through a gambit of software interviews and this is the biggest thing that determines whether I'll enjoy solving a problem or not. If they start with "find an efficient solution" or "the data set is in the millions" or something along those lines, I know I'm doomed if I don't recognize the form of the problem. If they encourage me to get to a working solution first, and _then_ figure out the trick, I'll typically do well regardless of whether the question is familiar or not.

Re: How we recovered $300k of Bitcoin

#90

Post by sudosysgen »

FabHK wrote: post #85
dirtydroog wrote: post #21

Earlier quoted context omitted.

Actually, being involved in ad tech can get you involved in some really cool tech. It's an incredibly fast-paced industry, lots of parallels to HFT. And yes, everyone in the industry knows that ads don't work, you have all the ad blockers, etc.

> lots of parallels to HFT. Including the fact that it might make its practitioners rich, while creating nothing of social value.

In the case of ads, arguably negative social value.
Post reply on HN