The Mystery of the Encrypted Gauss Payload
securelist.com
The Mystery of the Encrypted Gauss Payload
1–10 of 52 posts
Re: The Mystery of the Encrypted Gauss Payload
#2The core of this is 'find X' such that
md5(md5(...10,000 times...(md5(X + salt)...)) = hash
Or, find a way to calculate
md5(md5(...10,000 times...(md5(X + salt')...))
Or alternatively, attempt a known plain text attack against RC4. Given that a certain amount of plain text is known (4 bytes) at the start of the RC4 payload then it's likely that the first few bytes of the keystream are known and an attack could be mounted via weakness in the RC4 key schedule.
Re: The Mystery of the Encrypted Gauss Payload
#3I just imagined the author reading that post and smirking to themselves.
Re: The Mystery of the Encrypted Gauss Payload
#4So does this mean that if you're a high profile target, you should immediately add a random folder to all of your computers in the program files directory?
Re: The Mystery of the Encrypted Gauss Payload
#5So does this mean that if you're a high profile target, you should immediately add a random folder to all of your computers in the program files directory?
No..it means if you are running a specific program which unlocks the code you are going to have a bad time (I suppose you could rename all of your program directories though... would that defeat this ?)
Re: The Mystery of the Encrypted Gauss Payload
#6The core of this is 'find X' such that md5(md5(...10,000 times...(md5(X + salt)...)) = hash where salt and hash are known. X is derived from the names of programs existing on a Windows machine with a particular format. Or, find a way to calculate md5(md5(...10,000 times...(md5(X + salt')...)) given that hash is known and salt' but X is not. Or alternatively, attempt a known plain text attack against RC4. Given that a…
Well, wasn't MD5 broken?
It should be possible to do a brute force search using a couple of days of EC2 or (insert your favorite cloud provider) here. And by bruteforce you can try text search, or just go for the raw bytes. Not sure a collision can work in this case as well.
Re: The Mystery of the Encrypted Gauss Payload
#7The core of this is 'find X' such that md5(md5(...10,000 times...(md5(X + salt)...)) = hash where salt and hash are known. X is derived from the names of programs existing on a Windows machine with a particular format. Or, find a way to calculate md5(md5(...10,000 times...(md5(X + salt')...)) given that hash is known and salt' but X is not. Or alternatively, attempt a known plain text attack against RC4. Given that a…
Well, wasn't MD5 broken? It should be possible to do a brute force search using a couple of days of EC2 or (insert your favorite cloud provider) here. And by bruteforce you can try text search, or just go for the raw bytes. Not sure a collision can work in this case as well.
To recover X + salt you'd be looking at a preimage attack of MD5. I am only aware of one preimage attack against MD5 and it's only theoretical.
The input to the RC4 key generator is an MD5 hash which means you'd be looking at doing a brute force attack against an input of 2^128 bits. Assuming you find the answer on average in 2^127 and you are looking at an enormous search space.
According to a recent article EC2 has about 500,000 machines. Now assume that I buy them all and I am able on each machine to check 1,000,000,000 values as inputs to RC4 per second then I should have the answer in 800,000 times the age of the universe. But I think my credit card will have been cancelled first.
Re: The Mystery of the Encrypted Gauss Payload
#8Earlier quoted context omitted.
Well, wasn't MD5 broken? It should be possible to do a brute force search using a couple of days of EC2 or (insert your favorite cloud provider) here. And by bruteforce you can try text search, or just go for the raw bytes. Not sure a collision can work in this case as well.
To recover X + salt you'd be looking at a preimage attack of MD5. I am only aware of one preimage attack against MD5 and it's only theoretical. The input to the RC4 key generator is an MD5 hash which means you'd be looking at doing a brute force attack against an input of 2^128 bits. Assuming you find the answer on average in 2^127 and you are looking at an enormous search space. According to a recent article EC2 has…
I'd try to bruteforce X (to match the hash), not RC4 at first (though it may be easier)
PBKDF2 is SHA-1 and 4096 rounds, this shouldn't be impossible
Bonus points if you use FPGAs to calculate MD5s
Re: The Mystery of the Encrypted Gauss Payload
#9Earlier quoted context omitted.
To recover X + salt you'd be looking at a preimage attack of MD5. I am only aware of one preimage attack against MD5 and it's only theoretical. The input to the RC4 key generator is an MD5 hash which means you'd be looking at doing a brute force attack against an input of 2^128 bits. Assuming you find the answer on average in 2^127 and you are looking at an enormous search space. According to a recent article EC2 has…
I'd try to bruteforce X (to match the hash), not RC4 at first (though it may be easier) PBKDF2 is SHA-1 and 4096 rounds, this shouldn't be impossible Bonus points if you use FPGAs to calculate MD5s
The question is how large that search space is. If you can get a reliable list of directory names and file names then it might be small, but if you are left iterating characters in filenames (and this appears to be Unicode) then I'd imagine you'd run into the same situation.
I'd be much more tempted to look at the fact that the first four bytes of the RC4 key stream appear to be recoverable and look at key recovery from that.
Re: The Mystery of the Encrypted Gauss Payload
#10It looks like it would be easier to bruteforce fixed RC4 key than 10000 iterations of MD5, especially due to known weaknesses of RC4 key schedule.
Name of target software in Program Files is interesting nevertheless. Probably it's mentioned in the encrypted code/data.