Hacking The Hacker
Transcript of Hacking The Hacker
Fighting back against the DirCrypt bully
Nitay Artenstein
Michael Shalyt
HACKING THE HACKER
BLACK HAT
“A ‘black hat’ hacker is a hacker who violates computer security for little reason beyond maliciousness or for personal gain“ - Wikipedia.
WHITE HAT
“A ’white hat’ hacker breaks security for non-malicious reasons… The term "white hat" in Internet slang refers to an ethical hacker.” - Wikipedia.
WHITE HAT
“A ’white hat’ hacker breaks security for non-malicious reasons… The term "white hat" in Internet slang refers to an ethical hacker.” - Wikipedia.
THE GRANDMA
THE GRANDDAUGHTER
THE GRANDDAUGHTER
WHAT JUST HAPPENED?
WHAT JUST HAPPENED?
WHAT JUST HAPPENED?
CRYPTERS IN THE WILD
CRYPTERS IN THE WILD
CRYPTERS IN THE WILD
CRYPTERS IN THE WILD
CRYPTERS IN THE WILD
FOR EXAMPLE: DIRCRYPT
ENCRYPTION DEMO
CRYPTO 101
CRYPTERS ARE WRONGER
CRYPTERS ARE WRONGER
• “Innocence based” attacks.
CRYPTERS ARE WRONGER
• “Innocence based” attacks.
• Scare tactics.
CRYPTERS ARE WRONGER
• “Innocence based” attacks.
• Scare tactics.
• The victim pays the price, unlike banking trojans.
CRYPTERS ARE WRONGER
• “Innocence based” attacks.
• Scare tactics.
• The victim pays the price, unlike banking trojans.
• Highschool bully – crypters will evolve and spread as long as victims pay the ransom instead of resisting.
AND NOW FOR THE GOOD PART…
• It‘s hard to implement a secure cryptographic protocol
• Many malware writers are not exactly masters of secure coding
• What if we can hack the hackers and save Grandma?
LOOKS LIKE A JOB FOR A REVERSER
WHAT IS REVERSE ENGINEERING?
• The malware executable holds some of the secrets we need to uncover:
MALWARE RESEARCHER == DETECTIVE
• A malware binary is like a crime scene
• Through skill and experience, a reverse engineer develops a “nose for mystery”
• A bunch of tools help us rise above the bits and bytes, and make it easier to connect the dots
THE GOAL: MOVE FROM THIS…
TO THIS
FROM PLAINTEXT TO CIPHER
IMAGINE YOU WERE A HACKER…
• Where would you hide the key?
• Your options: the registry, a hidden file, or only on the C&C server
• There is always a compromise
A FEW SLEEPLESS NIGHTS LATER…
SO NOW WE HAVE A HINT
THE UNBEARABLE LIGHTNESS OF KEY REUSE
ATTACKING KEY REUSE
ATTACKING KEY REUSE
• Which files will always be on Windows?
ATTACKING KEY REUSE
• Which files will always be on Windows?
• We need the largest file possible. Sample videos?
ATTACKING KEY REUSE
• Which files will always be on Windows?
• We need the largest file possible. Sample videos?
• The max size decryptable will be the size of that file
ATTACKING KEY REUSE
• Which files will always be on Windows?
• We need the largest file possible. Sample videos?
• The max size decryptable will be the size of that file
READY TO SOLVE THE PUZZLE?
THAT AWKWARD MOMENT
WriteToFile(hFile, SymmetricKey, 10);
DECRYPTION DEMO
DECRYPTION… CHECK
GRANDMA IS HAPPY AGAIN