[HN Gopher] Researchers cracked an 11-year-old password to a $3M...
___________________________________________________________________
Researchers cracked an 11-year-old password to a $3M crypto wallet
Author : ColinWright
Score : 108 points
Date : 2024-05-28 18:32 UTC (4 hours ago)
(HTM) web link (www.wired.com)
(TXT) w3m dump (www.wired.com)
| Ajay-p wrote:
| https://archive.is/BZal2
| malshe wrote:
| > Michael says he was lucky that he lost the password years ago
| because, otherwise, he would have sold off the bitcoin when it
| was worth $40,000 a coin and missed out on a greater fortune.
|
| This is so true for stocks too
| INTPenis wrote:
| Yes but stocks are usually tied to a business producing some
| sort of service that people want, and therefore have value.
| Crypto is tied to, _checks notes_ nothing.
| jen729w wrote:
| I'm no shill for crypto, but you can't with a straight face
| claim that all non-crypto financial instruments are 'tied to
| ... some sort of service that people want'.
|
| There's a whole world of shady crap going on in the
| 'legitimate' financial space.
| INTPenis wrote:
| Oh absolutely. Money is the root of all evil.
|
| But crypto bros are often delusional about what intrinsical
| value exists in the normal market, compared to crypto coins
| where they invent the value. Therefore manipulation of
| value compared to real world markets becomes a lot more
| abstract.
| ColinWright wrote:
| The original saying is:
|
| "For the love of money is the root of all evil: ..." -- 1
| Timothy, 6:10
|
| It's not the money that is evil, it is the things we do
| because of the desire we have for it.
| kube-system wrote:
| I hate on crypto any chance I get, but crypto has damn near a
| monopoly in facilitating black and/or grey market electronic
| transactions.
|
| It is very in demand, for instance, in helping dictators
| evade sanctions, or helping criminals extort or trade
| illegally.
| coffeeri wrote:
| The original video by Joe Grand: https://youtu.be/o5IySpAkThg
| Stagnant wrote:
| Highly recommended, didn't think I'd watch the whole thing but
| the production quality was great and it explains everything
| much better than the wired article.
| dylan604 wrote:
| After your reco after the GP's reco, I would have to agree.
| This is well done. However, coming from a coding/dev
| background, it was easy to follow and it all makes sense.
|
| However, it goes to show why hacking will never be made
| interesting in movies without a bunch of fake nonsense like
| hacking the Gibson's 3D virtual environment.
| kevindamm wrote:
| The best and worst examples were in the same movie, IMO:
| Nedry's finger-wagging admonishment and all hell breaking
| loose, then later, "it's a Unix system, I know this!" and
| some exotic file manager visualization.
| therein wrote:
| So the version of password manager he was using was vulnerable
| because it was generating low entropy passwords.
|
| They also found the seed was from time and knew when he had
| created it.
|
| He got lucky there a little.
| dylan604 wrote:
| > He got lucky there a little.
|
| Who is he in that sentence? Do you mean the owner of the wallet
| who is absouletly very lucky, or the hackers that did a lot of
| investigating and reverse engineering to learn that the
| datetime was the seed. Was that luck or l337skillz?
| jrflowers wrote:
| I'm going to guess it's the same "he" from the sentence that
| came immediately before the one you quoted
| brailsafe wrote:
| Seems like they all were lucky that he luckily used a
| vulnerable password manager and knew the approximate
| parameters and time it was created. If he didn't get lucky,
| they might not have been paid.
| alexwasserman wrote:
| Time for a new investment strategy that involves buying whatever
| (index funds?) then losing your password to force a hold till the
| encryption algo has been cracked or compute power makes it easy
| to brute-force.
|
| Call it the Moore's Law Fund.
| buildbot wrote:
| An interesting but not entirely practical offshoot of this idea
| is a fund that buys (collects legally?) wallets with lots of
| crypto & lost passwords and tries to crack them over time.
| sandworm101 wrote:
| Or just buy random used digital storage devices in bulk and
| scan them for potential wallets, or other marketable data.
| Half the "broken" USB drives out there still have plenty of
| retrievable data on them. It would be like the "Storage Wars"
| show, but digital.
|
| (Fyi, one very marketed video tape was discovered when the
| contents of a certain celeb's storage locker was put up for
| auction. Imagine the possibilities if one collected all the
| storage devices thrown away in a particular LA neighborhood.
| Or DC.)
| kube-system wrote:
| I don't think it's necessarily legal (at least in some
| jurisdictions) to collect bitcoin that way, even if you've
| legally obtained the storage device.
| paulpauper wrote:
| This is already done. The feds and hackers have huge troves
| of wallets and files that they are trying to crack, either by
| finding holes in the encryption method used or brute force.
| sneak wrote:
| This is already how bitcoin mining works. Compute is used to
| calculate partial hash collisions via brute force. The number
| of bits required in the collision adjusts dynamically based on
| the duration of the last 2016 blocks. If you're the first to
| find a valid collision for the next block, you get 3.125 BTC.
| alexwasserman wrote:
| Less fun with a 10 minute lockup till the next block
| ljlolel wrote:
| Best if you just try to lose half the password so you have an
| advantage on cracking it.
| hartator wrote:
| > They really annoyed me, because who knows what I did 10 years
| ago,
|
| He doesn't seem to be very thankful.
| floam wrote:
| I think it's an artifact of translation or ESL. Imagine he said
| "pestered". I don't think he necessarily meant the effect it
| had on his mood.
| declan_roberts wrote:
| It's not clear how datetime was used and why that became a
| weakness? Doesn't it improve the password security by taking some
| bytes from /dev/random and salting it with <timestamp>?
| Stagnant wrote:
| The roboform password manager used datetime value as the seed
| of the pseudorandom generator, meaning that it would always
| generate the same password if the system clock time was the
| same. They managed to crack the wallet by reverse engineering
| the password manager and feeding its pseudonumber generator all
| datetime values between certain dates that were thought to be
| near the time when the original wallet owner had generated the
| password.
| fragmede wrote:
| yes so knowing the datetime that was used to salt reduces the
| search space.
| JohnKemeny wrote:
| Salt is not the same as seed.
| arp242 wrote:
| So Roboform has almost certainly thousands (of not millions) of
| users with weak passwords, and not only didn't they tell anyone,
| all they give is a shrug when asked about it.
|
| What a bunch of bozos.
| paulpauper wrote:
| Because the vast majority of ppl who use it will not be storing
| millions of dollars of crypto with it. Crypto changes the game
| totally.
| yreg wrote:
| No it doesn't. What kind of an excuse is that?
|
| When a password manager maker finds a vulnerability they
| should absolutely tell their users to regenerate their
| passwords!
| paulpauper wrote:
| didn't the vendor fix it?
| yreg wrote:
| They are supposed to disclose the vulnerability after
| fixing it, so their users know they need to take action.
| That's what the original commenter rightly complained
| about.
| wepple wrote:
| Crypto doesn't change the game. Products that generate
| passwords should do so securely.
|
| You may be using it to protect extremely sensitive
| information that could have people killed - that's more
| important than a few million dollars in imaginary money
| arp242 wrote:
| People have bank passwords, social media accounts (which can
| be used in all sorts of nefarious ways), etc. Some may be 2FA
| protected, some may not be. Some may be protected by bad
| faux-2FA.
|
| Just because there aren't million at stake doesn't mean you
| can't bring someone to ruin.
| PUSH_AX wrote:
| I mean how weak are they really? These guys knew the algo and
| still struggled and pestered the user over and over for the
| other parameters. They also had what I would describe as an
| extreme motivation to crack this.
| arp242 wrote:
| Hard to say without details; but now that the weakness is
| known it may become a lot easier. It's one thing if you
| _think_ it _may_ work if you have the correct parameters but
| aren 't sure, and quite another if you _know_ it _will_ work.
|
| Password managers are kind of a "defence in depth" thing;
| practical speaking, a passwords.txt opened with notepad is
| probably fine for many people. No one is in your computer
| checking your files. You have a password manager for when
| that _does_ happen, just in case. And usually this tends to
| be a targetted attack, which can range from some country 's
| secret service to a jealous spouse to a trolling sibling. If
| that extra protection is ineffective ... yeah, that's not
| great.
|
| This really is "better safe than sorry" type territory.
| Password managers (including Roboform) already do this by
| notifying users a password _may_ be insecure after a leak. A
| lot of the time that 's not really needed if your password is
| sufficiently secure, but "better safe than sorry". This is
| not all that different.
| kick_in_the_dor wrote:
| "Michael... now has 30 BTC, now worth $3 million, and is waiting
| for the value to rise to $100,000 per coin."
|
| What the ? You presumably go from _not a millionaire_ to having
| $3,000,000, and you decide to risk it to triple it? That 's some
| next level greed right there.
| pjkundert wrote:
| How do you know he isn't hedged?
|
| NOT keeping it in Bitcoin is some next-level stupidity, by the
| simple analysis of trends over the time he's held it.
|
| And the inflation produced by the creation of broad money over
| the last 3 years hasn't even come home to roost, yet.
|
| I'd say he's being ruthlessly analytical, not greedy.
| metabagel wrote:
| Past performance does not guarantee future results.
| kube-system wrote:
| True, but if he were looking for _guaranteed_ returns he
| picked the wrong investment. I presume this person is has
| some level of risk tolerance far exceeding zero.
| BLKNSLVR wrote:
| FYI he's not gambling the bitcoin, he's holding onto it, and
| given it's history, which is the sub-story, it seems to be the
| smart thing to do, not the risky/ dumb thing to do, especially
| in the current stage of the cycle.
| ggm wrote:
| What was their fee?
___________________________________________________________________
(page generated 2024-05-28 23:01 UTC)