Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A tale of Phobos – How we almost cracked a ransomware using CUDA

cert.pl

Post reply on HN
Print view View original

21–30 of 65 posts

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#21

Post by mavhc »

bombcar wrote: post #9
degenerate wrote: post #5

Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos. I've been holding onto the encrypted copies for a while in hopes that some people were working on a crack, and I'm excited to read this update. Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? I found out too late t…

I do an off-line, off-site backup once a year that never gets overwritten. ZFS snapshots can help here, too, for online stuff, especially if you have monitoring about changeset size.

zfs server where you can only ssh into it with 1 user, and that user cannot zfs destroy, only zfs receive

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#22

Post by jewel »

degenerate wrote: post #5

Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos. I've been holding onto the encrypted copies for a while in hopes that some people were working on a crack, and I'm excited to read this update. Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? I found out too late t…

Sorry that happened to you. Using a de-duplicating backup solution (such as rdiff-backup or restic), will let you keep daily increments indefinitely with very little overhead.

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#23

Post by fps_doug »

degenerate wrote: post #5

Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos. I've been holding onto the encrypted copies for a while in hopes that some people were working on a crack, and I'm excited to read this update. Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? I found out too late t…

Don't do simple rolling backups, use something with deduplication like borg backup or ZFS/btrfs if you want to do it at the FS level. The backup size should not increase by much more than the actual size of any new files, so if suddenly, you need twice as much backup space because all your files seem to have changed, you should get suspicious.

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#24

Post by Helmut10001 »

908B64B197 wrote: post #8
degenerate wrote: post #5

Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos. I've been holding onto the encrypted copies for a while in hopes that some people were working on a crack, and I'm excited to read this update. Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? I found out too late t…

> what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? Compute checksums. Also, if storing diffs check out how many files the back-up think changed. All of your photo library getting re-uploaded should be a red flag.

I do this using an `rsync --dry-run` with `--stats` enabled, you can get the number of changed/deleted files from the stats and then decide whether you want to proceed without `--dry-run`. This is for off-site backups. For on-site, I prefer ZFS Snapshots.

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#25

Post by msm_ »

Tepix wrote: post #7

So, if you're a victim and you don't want to pay ransom - hire an expert to find out the missing data (timestamp, is it the vulnerable version?, ...), then - rent a GPU server and keep the fingers crossed. I've looked for cheap GPU servers yesterday, the cheapest i found was Ultrarender at 200€ per week for a Dual RTX 3080Ti remote workstation. Which is probably overkill, a single RTX 3080Ti can do it in 33 hours or…

Yes, that's the "almost" part of the blog post (and what makes it interesting, IMO). Not really something a regular person can do. Since CERT is not profit-driven, that kind of help was offered for governmental institutions for free (but it's hard, because government and companies need to recover ASAP and this kind of research and computation takes time).

If you want success stories, the same organisation has also published decryptors for other ransomware families (Mapo, Crypromix, Flotera) and they were just broken in a straightforward way. Usually the vulnerability is not explained for successful decryptors, to make bad guys life a bit harder.

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#27

Post by TacticalCoder »

heywhatupboys wrote: post #17
degenerate wrote: post #5

Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos. I've been holding onto the encrypted copies for a while in hopes that some people were working on a crack, and I'm excited to read this update. Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? I found out too late t…

don't backup file names. Backup checksums.

I agree. And for some stuff you get cryptographic checksums for free.

Backup of Git repositiories:

    ... #  git fsck --full
    error: unable to unpack contents of .git/objects/a2/cf1a9631658799733f43c3b3f0a799696a4b21
    error: a2cf1a9631658799733f43c3b3f0a799696a4b21: object corrupt or missing: .git/objects/a2/cf1a9631658799733f43c3b3f0a799696a4b21
Oops... No matter if it's a malware, the lack of ECC which by bad luck induced a bit flip that wasn't detected (on an otherwise okay Git repo) or a disk failing, it's trivial to detect if the repo is corrupted.

Same for my ripped archive of Audio CDs. The rippers save lots of information and the rips are bitperfect, cross checked with other people's rips' checksums. And the checksums are all there.

For family pictures, I add a checksum to the pictures myself.

Backups aren't really backups until they've been verified :)

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#28

Post by msm_ »

degenerate wrote: post #5

Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos. I've been holding onto the encrypted copies for a while in hopes that some people were working on a crack, and I'm excited to read this update. Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? I found out too late t…

> Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos.

I can't assist you with recovery, and without a lot of logs and forensics data (or a significant performance improvement), the described method is likely unfeasible. But I'll try to find a matching sample and let you know if it's vulnerable.

> Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files?

Lots of good responses, I like incremental backups without ovewriting anything (supported OOTB by all copy-on-write filesystems, like ZFS or BTRFS). Not sure how to configure this on Windows.

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#29

Post by jxramos »

TacticalCoder wrote: post #27
heywhatupboys wrote: post #17

Earlier quoted context omitted.

don't backup file names. Backup checksums.

I agree. And for some stuff you get cryptographic checksums for free. Backup of Git repositiories: ... # git fsck --full error: unable to unpack contents of .git/objects/a2/cf1a9631658799733f43c3b3f0a799696a4b21 error: a2cf1a9631658799733f43c3b3f0a799696a4b21: object corrupt or missing: .git/objects/a2/cf1a9631658799733f43c3b3f0a799696a4b21 Oops... No matter if it's a malware, the lack of ECC which by bad luck induce…

what do you mean adding checksum to the picture, do you add the checksum as a filename suffix eg IMG0001_.jpg, something like that? Or do you tuck it into the exif data and have a tool that computes the checksum of the file minus the checksum part.

Re: A tale of Phobos – How we almost cracked a ransomware using CUDA

#30

Post by jxramos »

heywhatupboys wrote: post #17
degenerate wrote: post #5

Nearly all my personal photos were encrypted by the helprecover@foxmail.com ("HELP") variant of Phobos. I've been holding onto the encrypted copies for a while in hopes that some people were working on a crack, and I'm excited to read this update. Sidecar question: when automating your backups, what's a good way to make sure your rolling backups aren't simply backing up malware-encrypted files? I found out too late t…

don't backup file names. Backup checksums.

I've been playing around with beyond compare snapshot. I've done whole drive snapshots. I'm pretty close to running a diff to see how things have evolved on my drives and see where all the file system activity has shifted around. The files sizes are pretty small, in the MB range, maybe 6 or 10MB I forget.

https://www.scootersoftware.com/v4help/index.html?snapshots....

Post reply on HN