News for hackers. Stuff that matters.
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by blhack on Monday June 07, 2021 @09:56PM (#27429792)
I think that the people here speculating about the FBI and private keys are greatly overestimating the competency of these hackers.

While it's possible this it he FBI flexing some muscle that they have a backdoor into bitcoin's hashing algorithm, what seems much more likely (to me) is:

There is a more sophisticated hacking group which created this particular ransomware package. They sell this ransomware package to less sophisticated criminals.

(https://www.theverge.com/2021/5/10/22428996/colonial-pipelin...)

Is it so hard to imagine a scenario where the more advanced creators of this ransomware kit gave instructions to their purchasers on things like private keys, and the end user simply ignored them?

Somebody ignoring a warning when installing a software, and that allowing the FBI to subpeona access to the server where it was running, and grab this private key, seems FAR more likely to me than the FBI having a backdoor into BTC, or this all being a cover spy novel plot, or anything like that.

Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by wyager on Monday June 07, 2021 @10:14PM (#27429893)
If the FBI has broke any of Secp256k1, SHA256, or RIPE160, (they have not) they’re not going to blow that on a $3M haul.
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by fkfowl3 on Tuesday June 08, 2021 @05:39AM (#27432268)
They just mention they had access to the private key of the account so that makes sense how they got access. If FBI has broken SHA256, then Bitcoin is a done deal. I hope they share how they got access to the private key.
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by donkarma on Tuesday June 08, 2021 @08:34AM (#27434284)
It'd be a big blow but not the end of the Bitcoin
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by flatiron on Tuesday June 08, 2021 @08:52AM (#27434472)
what do you mean? if they broke sha256 in any meaningful way then people can skip (or significantly game) the whole mining thing...
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by thebean11 on Tuesday June 08, 2021 @11:56AM (#27436838)
The mining algorithm can just be changed with a hard fork.

The only think that would irrevocably kill Bitcoin is breaking private keys (ie discovering others private keys, or signing transactions without private keys). A fork could not solve it as there'd be no way to prove which coins you actually owned before the fork.

Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by cyanydeez on Tuesday June 08, 2021 @09:22PM (#27443167)
many people speculate that quantum computing would crack private keys in no time.

theres no speculation that this exists, but bitcoin wouldnt last in a commercial world of quantum algos

Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by dhsysusbsjsi on Wednesday June 09, 2021 @09:42AM (#27447724)
Wrong. IF there exists a general purpose formula (which isn't known yet) for all quantum problems, so secp256k1 is broken, then it would only reduce the complexity sqrt(N), from 2^256 down to 2^128. Which is unsolvable. (source: Stanford cryptography I course on coursera).

AND even if the elliptic curve cryptography of bitcoin is broken, say you can solve it in a year/month/week/day, the fact is most BTC unspent transaction outputs (UTXO's) are scripted "pay to public key hash".

The entity proving ownership of the UTXO needs to show a public key (that is so far unknown ... if they haven't reused this address before), AND this public key needs to hash into the address, AND the signature signed by the private key verified.

So if somebody announced they had solved secp256k1 and could break it in 1 week, your funds are safe. (1) They probably don't know your public key. Relax. And (2) You just wait for the BTC soft fork to support new crypto, then do a transfer to yourself. You transmit your transaction to the mempool (exposing your public key for the first time), and it will be mined in 10-30 minutes. Not enough time for the hackers to monitor the mempool and come up with a valid signature. Then your new UTXO is a different spend script for how to spend it next time using some new unbreakable crypto.

Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by thebean11 on Wednesday June 09, 2021 @09:57AM (#27447870)
As long as there was some pre warning that such a quantum computer+algorithm was going to become available, Bitcoin would be able to fork, and users would be able to move their funds to quantum proofed (or at least hardened) wallets.
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by quirino on Tuesday June 08, 2021 @08:57AM (#27434522)
It surely depends on which aspect of SHA they would have broken, but the whole point of Bitcoin is the hash being completely unpredictable and requiring brute force. That's the Work in Proof of Work.
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by wyager on Tuesday June 08, 2021 @09:04AM (#27434602)
Bitcoin has contingencies in place to swap out any of its crypto algorithms.
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by onetimemanytime on Tuesday June 08, 2021 @12:24AM (#27430631)
They might be saving for bigger things, however this is a lot more than $3million. It's about holding the US economy hostage, as these will increase in frequency.
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by galaxyLogic on Tuesday June 08, 2021 @02:17AM (#27431200)
Indeed, stopping large-scale oil pipelines means US economy is held hostage, to a degree. Not all of it but some of it. Question is will it increase or not. This FBI action gives us some hope that criminals can be stopped.
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by 7dare on Tuesday June 08, 2021 @06:58AM (#27433394)
Can be stopped? Doesn't sound like this is what happened here, the company paying the ransom is what stopped the hostage. The FBI simply recovered the ransom (and some more), but probably can't cover for the economic damage from the hold-up.
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by stingraycharles on Tuesday June 08, 2021 @02:11AM (#27431170)
How is this holding the US economy hostage?
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by kick_in_the_doo on Tuesday June 08, 2021 @02:31AM (#27431265)
Randomware attacks on energy (oil and potentially electric grid) and hospitals. And that's only what we've seen so far.
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by cdaven on Tuesday June 08, 2021 @02:37AM (#27431299)
"Randomware" sounds much more fun. Like Bertie Botts Every Flavor Beans, but for software. :-)
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by arcticbull on Tuesday June 08, 2021 @03:39AM (#27431637)
You may know it as "undefined behavior" ;)
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by kick_in_the_doo on Tuesday June 08, 2021 @12:49PM (#27437628)
XD
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by erentz on Monday June 07, 2021 @10:17PM (#27429910)
I mean we know the hack wasn’t sophisticated at all. It seems to me the hackers are opportunists, scanning for vulnerabilities and weak VPNs. People are confusing grunt work with sophistication. They would’ve used ransomware against any target that they breached that they thought could pay. Too young or too stupid to think through the consequences.

Thread below indicates what happened is they were incredibly naive and eventually used a US exchange wallet. Just script kiddies really.

https://twitter.com/intangiblecoins/status/14020730011899125...

Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by dragonelite on Tuesday June 08, 2021 @07:29AM (#27433685)
Most likely, that is why i'm convinced US will put regulation in place for "green miners" and "clean exchanges" so US based renewable miners are only allowed to sell and bring new clean bitcoins into circulation.
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by tapland on Tuesday June 08, 2021 @05:38AM (#27432265)
They use affiliate systems and provide ransomware (that someone else has probably delivered) to the people actually doing the breaches.

It wasn't darkside planting the ransomware afaik, but it was someone wanting to get paid through their affiliate program.

Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by BrissyCoder on Tuesday June 08, 2021 @12:47AM (#27430728)
> I think that the people here speculating about the FBI and private keys are greatly overestimating the competency of these hackers.

It's like if some dumbass was beating the crap out of people to steal their money and everyone in the boxing community was suprised that he's not a world class boxer.

Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by coolspot on Tuesday June 08, 2021 @01:39AM (#27430989)
It is also possible that criminals made themself look stupid and sacrificed a small part (~70 of 310 BTC) of monthly income to throw FBI a bone, so they can fuck off gracefully.
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by avhwl on Tuesday June 08, 2021 @06:01AM (#27432471)
A "backdoor in bitcoin's hashing algorithm" would not help them recover a private key. "bitcoin's hashing algorithm" is, for PoW, SHA256. The only relevant break for PoW would be a break in preimage resistance; this would allow the attacker to mine blocks faster, which does not allow them to calculate private keys. They could use that to mine an alternate history where the ransomware attack did not occur, but that would of course be immediately obvious.

Preimage attacks tend to be much more rare than collision attacks. MD5 for example still has no publicly known practical preimage attacks.

Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by mrkramer on Tuesday June 08, 2021 @04:13AM (#27431819)
They seized private key and if it was encrypted/hashed they cracked it. It could've Bitcoin brain wallet and they cracked the actual ASCII password of the wallet.
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by avhwl on Tuesday June 08, 2021 @06:04AM (#27432531)
If the private key was hashed, and they only had the hash, then they could not crack it. Hashing is not the same as encryption.
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by mrkramer on Tuesday June 08, 2021 @06:49AM (#27433270)
Hashing is for ensuring data integrity and encryption is for protection of data and information I know it but I meant hashing bitcoin private key with some hashing algorithm in order to conceal it.
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by mrkramer on Tuesday June 08, 2021 @07:08AM (#27433497)
Second reply: I saw that you work in applied cryptography and blockchain technology @ Cryptography Services (NCC Group) so you might be familiar with somewhat Grey Hat russian forum InsidePro; back in the day I saw people there requesting Bitcoin private key recovery for their lost private keys or if they encrypted and/or hashed wallet private keys and couldn't recover plaintext anymore and I can say that amateur crackers could recover private keys pretty efficiently and I can only wonder what professional law enforcement agency can do.

If FBI could crack smartphone encryption/protection from multi trillion dollar company I'm speaking about Apple and that terrorist's Iphone then they do pretty much anything.

Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by nybble41 on Tuesday June 08, 2021 @02:21PM (#27438872)
> amateur crackers could recover private keys pretty efficiently

That's only if the key was derived from a weak password, which allows it to be brute-forced with standard password scanning techniques. If you're even slightly concerned with security you let a computer generate a fully random key using the proper amount of entropy—preferable on an air-gapped system or an HSM (hardware wallet). No one is going to be "recovering" private keys which were generated and handled securely without a very large budget and physical access to the storage medium.

Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by dboreham on Tuesday June 08, 2021 @08:31AM (#27434255)
Can they travel faster than light?
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by mrkramer on Tuesday June 08, 2021 @12:04PM (#27436958)
I never heard of any criminal that's fast as light so they do not need to be faster than light in order to catch him.
Re:DOJ seizes $2.3M in cryptocurrency paid to the ransomware... by mrkramer on Tuesday June 08, 2021 @12:06PM (#27437000)
It could've been*