Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A tale of Phobos – How we almost cracked a ransomware using CUDA

cert.pl

Post reply on HN
Print view View original

11–20 of 65 posts

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#11

Post by biesnecker »

degenerate wrote: post #5

Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos. I've been holding onto the encrypted copies for a while in hopes that some people were working on a crack, and I'm excited to read this update. Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? I found out too late t…

I store two weeks of daily snapshots, and then 12 months of monthly snapshots. It gives me a year of pretty good coverage for only about 2x the cost of just two weeks of backups.

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#12

Post by comboy »

I know I'm in minority and that this view is not empathetic one, but I really like that ransomware is around.

More secure data storage at companies where otherwise it would be just silently stolen and sold. More backups. Even some incentive to research security of encryption methods.

We won't get more secure systems without some proper incentives.

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#13

Post by dr_zoidberg »

msm_ wrote: post #3
rfoo wrote: post #2

Overall, cool work! Especially the search space reduction part. I haven't dive into the code, but only 818000/60=13633 attempts per second for 64 SHA-256 rounds plus one AES-256 decryption on a 2080 doesn't sound right. Learn some GPU and tuning the code can likely increase the throughput a lot. Mind you, that's only 25x naive Python implementation on (supposedly) 1 core. Also, hashcat does >1M hash/s for even higher…

Thanks! I wonder if the Python number is correct, I remember Python being prohibitively slow in comparison. But assuming it is: There are 256 sha256 iterations on average, so the number is a bit better - but there's probably still a lot to improve (it's much more optimised than the naive version, but it was written by reverse-engineers, not GPGPU specialists). The PoC was also opensourced [0], it would be great if so…

One other thing. The article states pythons performance at keys-per-second, then all the other numbers are given in keys-per-minute. That means that pythons number looks really small in comparison, but if we take it (500 kps) and multiply it by 60, we get 30k keys-per-minute, or about 50% faster than the first CUDA baseline.

Now I'm quite fond of python, but largely I read this as the CUDA implementation having quite some room for improvement. Having almost no CUDA experience of my own, that is just a hunch, which I'm glad rfoo supports with (surely) a lot more experience than me.

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#14

Post by xwdv »

comboy wrote: post #12

I know I'm in minority and that this view is not empathetic one, but I really like that ransomware is around. More secure data storage at companies where otherwise it would be just silently stolen and sold. More backups. Even some incentive to research security of encryption methods. We won't get more secure systems without some proper incentives.

I love that ransomware is around because it forces companies to take security seriously or pay the price. You could even say ransomers are the good guys in this regard, contributing to a safer world.

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#15

Post by MaxMatti »

Tepix wrote: post #7

So, if you're a victim and you don't want to pay ransom - hire an expert to find out the missing data (timestamp, is it the vulnerable version?, ...), then - rent a GPU server and keep the fingers crossed. I've looked for cheap GPU servers yesterday, the cheapest i found was Ultrarender at 200€ per week for a Dual RTX 3080Ti remote workstation. Which is probably overkill, a single RTX 3080Ti can do it in 33 hours or…

Not sure if you could run that on vast.ai but they do offer more granular pricing, so that might be the better option.

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#16

Post by ridgered4 »

degenerate wrote: post #5

Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos. I've been holding onto the encrypted copies for a while in hopes that some people were working on a crack, and I'm excited to read this update. Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? I found out too late t…

One technique would be to place unchanging bait files that you pre-check before allowing the backup to proceed.

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#17

Post by heywhatupboys »

degenerate wrote: post #5

Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos. I've been holding onto the encrypted copies for a while in hopes that some people were working on a crack, and I'm excited to read this update. Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? I found out too late t…

don't backup file names. Backup checksums.

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#18

Post by werdnapk »

degenerate wrote: post #5

Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos. I've been holding onto the encrypted copies for a while in hopes that some people were working on a crack, and I'm excited to read this update. Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? I found out too late t…

My backups got attacked by ransomware, but I only caught it about 6-8 months after it occurred. Thankfully, my backup drive is copied to another backup which never deletes files, only copies them, so the renamed files that were encrypted were eventually copied over to my second drive, but the originals remained. The attacker wasn't aware of the second drive.

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#19

Post by dec0dedab0de »

degenerate wrote: post #5

Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos. I've been holding onto the encrypted copies for a while in hopes that some people were working on a crack, and I'm excited to read this update. Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? I found out too late t…

For something like photos you could just store every revision.

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#20

Post by pksebben »

6_6_6 wrote: post #4

phobos is not a moon !!! phobos is the god and personification of fear and panic in Greek mythology. this is crucial in understanding ransomware ;)

also a moon.[1].

Perhaps most importantly, also a knight of Mars, beater of ass [2]

1 https://solarsystem.nasa.gov/moons/mars-moons/phobos/in-dept...

2 https://youtu.be/BP0-znoJ6fs

Post reply on HN