[deleted]
The Mystery of the Encrypted Gauss Payload
11–20 of 52 posts
Re: The Mystery of the Encrypted Gauss Payload
#12The article mentions "~" as a possible starting point, but "{" is also greater than 7A, which would match all the "InstallShield Installation Information" subfolders.
Re: The Mystery of the Encrypted Gauss Payload
#13checking prog directory might mean they are looking for specific machin with specific system image
Re: The Mystery of the Encrypted Gauss Payload
#14[deleted]
Re: The Mystery of the Encrypted Gauss Payload
#15So does this mean that if you're a high profile target, you should immediately add a random folder to all of your computers in the program files directory?
No..it means if you are running a specific program which unlocks the code you are going to have a bad time (I suppose you could rename all of your program directories though... would that defeat this ?)
The full implications of this code are that the attacker already has another channel to access your machine.
It's not much consolation that you now know that you're being targeted by the Program Files entries (they're a major pain to rename). It's likely there are one or more plants inside your operation and they have physical access to the machine, which is considered game over.
Re: The Mystery of the Encrypted Gauss Payload
#16Earlier quoted context omitted.
I'd try to bruteforce X (to match the hash), not RC4 at first (though it may be easier) PBKDF2 is SHA-1 and 4096 rounds, this shouldn't be impossible Bonus points if you use FPGAs to calculate MD5s
The question is how large that search space is. If you can get a reliable list of directory names and file names then it might be small, but if you are left iterating characters in filenames (and this appears to be Unicode) then I'd imagine you'd run into the same situation. I'd be much more tempted to look at the fact that the first four bytes of the RC4 key stream appear to be recoverable and look at key recovery f…
[deleted]
Re: The Mystery of the Encrypted Gauss Payload
#17So does this mean that if you're a high profile target, you should immediately add a random folder to all of your computers in the program files directory?
No..it means if you are running a specific program which unlocks the code you are going to have a bad time (I suppose you could rename all of your program directories though... would that defeat this ?)
[deleted]
Re: The Mystery of the Encrypted Gauss Payload
#18Earlier quoted context omitted.
No..it means if you are running a specific program which unlocks the code you are going to have a bad time (I suppose you could rename all of your program directories though... would that defeat this ?)
The full implications of this code are that the attacker already has another channel to access your machine. It's not much consolation that you now know that you're being targeted by the Program Files entries (they're a major pain to rename). It's likely there are one or more plants inside your operation and they have physical access to the machine, which is considered game over.
oh, this is the modern version of a microdot
Release Gauss into the wild, have your agent in Fordu Nuclear plant be sure he has Gauss on his machine, and then just get him to name the jpgs or text files he wants sent back to the CIA as 'special.jpg' - Gauss nabs them, sends it back through the network of gauss infected machines, and hey presto - deniable, encrypted, distributed Dead Drops.
Wow. Clever. Thank you
Re: The Mystery of the Encrypted Gauss Payload
#19So whilst the malware will infect machines more or less indiscriminately, the payload itself can only be successfully decrypted (and therefore activated and executed), on machines that have a specific set of programs installed?
Re: The Mystery of the Encrypted Gauss Payload
#20Earlier quoted context omitted.
No..it means if you are running a specific program which unlocks the code you are going to have a bad time (I suppose you could rename all of your program directories though... would that defeat this ?)
The full implications of this code are that the attacker already has another channel to access your machine. It's not much consolation that you now know that you're being targeted by the Program Files entries (they're a major pain to rename). It's likely there are one or more plants inside your operation and they have physical access to the machine, which is considered game over.
Getting a certain filename onto your computer doesn't sound like a hard problem. Just send them a mail with an attachment of "398rgf90rej243rf.htm" that their email client helpfully extracts for them, or have a file with that name in their web cache when they browse the internet.