Articles Cryptocurrencies Bitcoin BTC CRAZY MINING ORG 2 years ago

How to free bitcoins from an old encrypted ZIP file

Protecting your cryptocurrency from malicious attack or theft means choosing from a myriad of encryption keys. Last October, Michael Stey received an unexpected message on LinkedIn from a man who had locked his cryptocurrency wallet containing more than $300,000. He asked Stey for help in gaining access to his cryptocurrency’s private keys.

It was not so surprising that “The Dude,” as Stay calls him, found a former security specialist at Google. Nineteen years ago, Stae published a paper detailing the technology to break into encrypted ZIP files. The dude bought about $10,000 worth of bitcoins in January 2016, long before the cryptocurrency boom. He encrypted the private keys in a ZIP file and forgot the password. And now he was hoping that Stay could help him crack it.

At the recent Defcon conference, Stay described his epic attempts to do so.

Encryption of ZIP files

zip – a popular file format used to compress large files without loss – as a small cover with braid can accommodate your sleeping bag. It is known that many options for the implementation of ZIP format have safety problems – to the fact that last summer even one American senator turned to the National Institute of Standards and Technologies in order to study this issue. “If we successfully find this password, I will thank you,” wrote a dude with an emoticon at the end. After conducting an initial analysis, Stay appreciated that the hacking of the file would cost $ 100,000. The dude accepted the offer-after all, the profit should turn out to be large.

“I haven’t had this much fun in a long time. Every morning I was excited to go to work and wrestle with this problem,” says Stay, now the CTO of blockchain technology firm Pyrofex. “ZIP encryption was developed decades ago by a nonprofessional cryptographer – so the fact that it has lasted this long is pretty remarkable.” However, while some ZIP files can be cracked with off-the-shelf utilities, Dude’s luck has not smiled.

This is, in particular, why they asked so much for the work. Newer generations of ZIP programs use the reputable and reliable AES crypto standard, and older versions, one of which Dude used, Zip 2.0 Legacy, which can often be cracked. The degree of difficulty, however, depends on its implementation. “It’s one thing to say the standard is broken, but actually cracking it is a completely different matter,” says cryptographer Matthew Green of Johns Hopkins University.

Only a small number of clues could help Stey with his approach. Dude still had a laptop which he used to create the encrypted ZIP – which confirmed his ownership of those bitcoins, and also gave Stey information about exactly which ZIP program and what version was used for encryption. He also knew the creation time of the file that the Info-ZIP software was using for its cryptographic scheme. Stay was able to reduce the huge number of possible passwords and encryption keys to a few quintillion.

Unsuccessful attack

To conduct an attack of this scale, it was necessary to rent cloud capacity for graphics processing. Stay approached Nash Foster, director of Pyrofex, to write code for the cryptanalysis and run it on the Nvidia Tesla general-purpose GPU. As he delved deeper into the project, Stay was able to refine the attack and reduce the time it took for the program to achieve results.

“We originally expected to develop the program for a couple of months, and then it would run for a few more months,” Foster told Wired magazine. – In the end, Mike was able to do the cryptanalysis more efficiently, and we spent more time developing the attack, and it only took a week for the program to work. This saved Dude a lot of money on infrastructure rentals. A decade ago, this would have been impossible to do without assembling special equipment, and the cost of the project probably would have exceeded the value of his bitcoins.”

However, the question of whether this grinding of numbers on the GPU would work was still an open question. After months of laboring over this problem, Stan was finally ready to try it. The dude didn’t give Stey and Foster the whole file – he probably didn’t trust them, thinking that they could steal his cryptocurrency by hacking the keys. Because of the peculiarities of the ZIP encryption implementation, he could only provide Stay and Foster with the encrypted headers – information records relating to the contents of the file – without passing on the main content. By February, four months after the first LinkedIn message, they had prepared the program and launched the attack.

She worked ten days and failed. Stay later wrote that he was “grief-stricken.

“We had encountered various bugs before, but on all the tests I ran on my laptop, everything worked fine,” he says. – If it was a bug, it had to be some really tricky one, and I was worried that it would take us a long time to find it. It didn’t help that in February the value of bitcoins began to drop, and with it the value of the file. The dude was really worried.

Successful hacking of the archive

Stay went through the whole program, worrying if there was any wrong assumption or hidden errors in it. But then he came up with a new idea about what random initial value [seed] could be used to start the random number generator used in their program. The dude also looked at the test data and noticed an error that occurred if the GPU didn’t process the correct password on the first pass. Stay and Foster fixed the error. After making these two fixes to the program, they were ready to start over.

“Bang! And a bunch of bitcoins popped out of the file,” Foster says. “We breathed a sigh of relief,” adds Stay.

The infrastructure lease ended up costing $6,000 to $7,000 instead of the $100,000 originally anticipated, Foster says. The dude paid four times less than he expected.

“It turned out to be a great deal for him,” Foster says. – These kinds of projects are rare. If he had a slightly different situation, if he had used a more recent version of ZIP, it would have been impossible to do. But in this particular case, we could have done something.”

Stay says that after the technical description of the project was published in April, he was approached by several people with requests to recover their bitcoin wallet passwords. Unfortunately, this is a common problem. Even Wired’s editorial staff has encountered it. But the ZIP attack has nothing to do with cryptocurrency wallets – they may sometimes have hackable flaws, but they are created with reliable modern encryption.

Still, the fact that ZIP is widespread suggests that the Stae and Foster study has far-reaching implications.

“In terms of fiddling with cryptography, this is a very cool project,” Green says. – It’s one of the ancient attacks on an obsolete scheme, and no one would have thought it was still relevant. But surprisingly, all that junk is still ubiquitous, so it’s a hot topic. And the fact that there was a lot of money waiting for them at the end, that’s cool.

Read more articles about cryptocurrencies and mining at CRAZY-MINING.ORG
Do you like to read similar articles about cryptocurrencies and mining, do you want to support me as an author or ask questions? Be the first to know the news, subscribe to my telegram channel CRYPTO WIKIES