Slashdot Mirror
How the Secret Service Cracks Encrypted Evidence
tabdelgawad writes "The Washington Post offers this writeup about how the U.S. Secret Service uses a Distributed Network Attack program to crack encryption on computers and drives seized as evidence. How can brute force still succeed with 256-bit encryption, you ask? Customized password dictionaries from the seized computer's email files and browser cache: People still use non-random passwords."
King Roland: The combination is: one . . . Dark Helmet: One. Col. Sandurz: One. King Roland: Two . . . Dark Helmet: Two. Col. Sandurz: Two. King Roland: Three . . . Dark Helmet: Three. Col. Sandurz: Three. King Roland: Four . . . Dark Helmet: Four. Col. Sandurz: Four. King Roland: Five . . . Dark Helmet: Five. Col. Sandurz: Five. Dark Helmet: So, the combination is: one, two, three, four, five. That's the stupidest combination I ever heard in my life! That's the kind of thing an idiot would have on his luggage!
My password is totally unguessable - I mean, who else has the password asdjklf;@#$#@jjdakl?
No - wait, I meant that *wasn't* my password! Hey, stop ssh'ing into my box! No - not my 20 GB of Sailor Moon music collection!
Well, guess I'll have to use my backup password of qwurf$#@ff5a` from now on - No, wait -
Damn it!
52 Weeks, 52 Religions with John Hummel
for having my hard drive encrypted by a key, on a flash drive, which is encrypted by a password that is generated randomly every five minutes and hased twice before I lock it in my safe deposit box.
If you're tired, sleep! Wenn Sie muede sind, schlafen!
Well, not until you put it in my browser cache. Thanks a lot, buddy.
666-607: 6th floor apartment of the beast
Or just remove punctuation (like apostrophes).
(Sorry....couldnt resist :)
Have you read my blog lately?
How the Secret Services Cracks Encrypted Evidence
Looks like someone used Microsoft's Grammar Checker to create the headline.
Of course I'd probably end up in Camp-XRay being tortured for the password. That's not where I want to spend my summer vacation.
There is nothing so silly as other peoples traditions, and nothing so sacred as our own.
"This is probably because people still have non-random memories."
Pfff. I can remember the opcode for the 6502 halt-catch-fire instruction. I can't, however, remember what I had for breakfast. How's that for random?
You know, it's amazing that Kevin Flynn had such trouble getting the info he needed to hang Ed Dillinger out to dry, considering that the password for the Master Control Program was "master".
I guess we've come a long way in the past quarter century. Except when it comes to choosing passwords.
It looks like they figured it out after all. I just hope Martin is OK...
My parents only let me use alphanumerics to name my dog.
Enter a new password: ***** [penis]
Sorry, your password is not long enough.
Enter a new password:
There's no place like ~/
Way too long to type. I personally wouldn't want to spend all day trying to type in my password without error; I'd much rather be out playing frungy or something.
I once listened to a Philip Glass record for an hour and a half before I realized it was skipping.
no, no...
thanks to the patriot act, they do not need any decryption methods anymore. Because every system sold since 2001 is bugged when leaving the factory.
At my former job, one of the programs we used would return "Password is not correct" if you input the wrong password.
:P
So, for a month, my password was "correct".
Hey, at least I had a handy reminder if I ever forgot what it was.
Personally I always use 4 to 5 word phrases that I make up with some random number or symbols between each word. It's easy as hell to remember and hard as hell to crack. So you get the best of both worlds.
I once had to terminal service into our server to unlock it for a support tech. The tech hit the floor as I was entering the password and he saw how many character it was.
Looks like your password is the least of your problems....
Hey, SS!
W MS bDwKKMWLDYRUG88 15gzDnFVPCDgH9L/ 0Rzyh7hF1J5xm2t wZhkXjCaTR02/H9+ AQ8lDFKVDQYYAiA wGUJc/GOgAbO668a KoitTl8bwK8AmrO SpddpBa2gWgfs8lm b6KUrfCes38xSe5 b05d6LKHphwyXXb1 rrDaw2ct6Qt5lAq qIFNM+UHcIQCP6kE eIj6niRoG87m7XU mRfoYnj9H4WpHd2X PdIT6AZX23rWK84 dj+A1ee7y/w255AS JxBoteG0EKC1j8H jouJ6RdammqmHWYC sjpmATiWHEP6jfM OPb0qSCyk8DWaEt0 IZIjqS/QwVV3Ng2 GSy2D9i1P6/xiy6a ASo8qSeArFO4KZl E05enZbjjD9zuliM M09a1L9RDGwB1TQ M8AszGHfdK07+VI7 4sODIqxI46pd/aN Oftik4aRCNozbquR 0wJ+UDaX8f2Qf34 BVR0sFMO/Pw8tktG 70WC3Y6rDt02G97 nCPRIkfrZQ6GUNIQ jDhNphAkJjZQg7g IZRGRTBiSTyC4u9d fF1NLlh/iDHEwH7 l00xu9nQCt5PA+qf xIkJN4vsIidT0hD HP7FGrsEsjtrSEDE wEXjKPAltPlmQTr ms/8QXoDCJ/TGbFR b8vpes6+8ce5iiO RX0rs8uzlaDNYnP+ PSwMYBPLhLEbznV hyvtB0UxjP8VeVGY +ZIMgT+pnKyuGb/ xR7XScBtV7W4dSPu 0uiwSnoprHDY10G ZKL17aTZzxxwLgcC q0EfCKNuAR09pms q/bQw8y5OG0j96ym h5CA4YlCfJvdGVT 3z/mHqNvkddu5QPj iIn4BXsLTIUMBv0 GWlHtF9zrDZ4JO8z aubc1mOsEDI1hfE KGIGd+I0l32NbU1n OB6ju7MtqzYGgaZ kcP1uN1mKiFtMQxF QxiPU+bUJhvCI=
Go stick a pig
-----BEGIN PGP MESSAGE-----
Version: PGP 8.1
qANQR1DBw04DB6hKqQuGABkQD/4ndRFLEcpsuHpf24/Moh2
4Jap4LfE3kpiVoiHvKWpSTz2z6lxbknY8
nVF1z1EkQPgNJhk8nrzSs3fu96D9wSuLE
XI4Z1knJn+kLvXhyDOXfoyBp8htnRsG5A
HNgk/wpSGPODVb1VQ3CL8uy1F1efM1UWm
tzfZ1b0RxyeKJkkSAwJFRH9pJb3cmXfw7
Ot8+RMrUVd1w3EXEZFO2lV0NeHyWlw0V8
EbdUD8Q7rrW8ELD1MBYR/uW0paxJKClUf
GLJPRDo+1DK5JWGzCDmpCqPCk/hC6IaTY
EEgdDMGn0/7PVP221FfvUmHiEptXaOIfr
V1Vw12K2pNTt5h9oVhf0N0g1GyD4jLLmp
i6516BAAj4IEcxfYcbEyxvfyDqwkxzJ6R
ATj5YyIDe2HnX66b6z9KaJrRlStSAhKr8
glArSeHh09AKDyYOYRA3eOp6Tdlog4qua
frOd100aZXP0w5928LbQT4HSUw9pQAsIL
tvX51ONAm2hSsjkWiBO9n2TMnYYV4th1m
ZE6hbscNP2dPGk9Zn1xn0HJSzogOqOYwc
4X31KiVUuJ4LsTNrpvLwl1P+rvzrPHr3E
MdarZSX1QRgEJt/ncSvfhqHwGo21HR9lZ
YcopCBgJX61SHI+zdZkvbZ+z0NrrnTx5Q
dzMXIikb/312gs99vRUxKh+4tQlSQKlrW
7iIxoRlYaN5QcwPizj9cFy6AQBGHZGnXD
JD0YluWuDrSeGkgFtYzFSf/HPdv8jrHPd
liHKlUowBHmL7pbP5F/A348XNovPFL/YG
rRO7SHaproOa+CchbNySs2raYmqk02veb
P54a5qvTc3f3qv5MhvktHrQV6BGzBJvZP
pfRCp8Np+DUPqT7CswmULPjYlsJJjHsxa
+yPSaWVugMtoyBwruemTV9AwgE90W6nw5
LPNVSamLx1VY4rwe7yePeAredp8VuT+nJ
yiiy1f9TE3GVMogQ00c4OIpWXjNMa2GZF
=qYai
-----END PGP MESSAGE-----
and you mother, too!
M
trustedworlds.net - gaming, security, and the gunk that lives in between
Frungy! Frungy! Frungy!
SILENCE BLATHERING TOADIES! We are your new masters.
:) )
(Hmm... "SBTWaynm" - a nice 8 character password
Three guys from the CIA, Mossad, and the Iranian Secret Police have a competition. Each of them has a burlap sack, and must go into the jungle to capture a wild boar. The CIA goes first. 30 minutes later, he's back, with a wild boar in the sack. Mossad goes next, and he comes back in just 15 minutes with a similar catch.
The Iranian Secret Police goes next. He's back in 2 minutes. The CIA and Mossad are shocked. "No, you can't have alreayd caught a wild boar."
"Open the sack and see for yourself." The CIA and Mossad look in the bag and see a rabbit with cigarette burns, bruises, cuts, and possibly a few broken bones.
"That's not a boar, that's a rabbit. You lose."
On hearing this, the rabbit shrieks out, "no!!!!!! I'm a wild boar! I've been a wild boar for seven years. I can give you the names of other wild boars who are still loose in the jungle!"
-paul
Pistol caliber is like religion: everyone has their favourite, and theirs is the only right choice.
No, but it is my Slashdot username!!! (apparently, slashdot doesn't allow colons, ampersands or tildes)
He then proceeds to get his golf bag and head for the links. The course is beautiful, the sun is shining, and his game is great.
Up in heaven, St. Peter asks God "Aren't you going to do something about this?" God replies, "Wait and see."
As the round of golf continues, the minister is shooting the best game of his life. On the 18th tee, The minister swings... God commands the ball and it bounces off the water, out of a bunker, and right into the cup.
St. Peter is incredulous. "Why are you REWARDING this man for shirking his duty!? I don't understand?!"
God replies "Who's he going to be able to tell about it?"
Why, oh why, didn't I take the Blue Pill?
"The effort started nearly three years ago to battle a surge in the number of cases in which savvy computer criminals have used commercial or free encryption software to safeguard stolen financial information, according to DNA program manager Al Lewis."
Oh, how the might have fallen...
"Win treats sysadmins better than users. Mac treats users better than sysadmins. Linux treats everyone like sysadmins."
Your dog is insecure. Shame on your parents for not teaching you best practices!
Think about it: this article would just encourage high profile targets to use 30+ characters of random garbage for their keychain passwords, rendering their methods next to useless. They're not that stupid.
"How did you break that 256-bit encryption so fast?"
"With our mad deadly worldwide gangster communist frankenstein distributed computing network, bitch."
Tin foil is still the best buffer.
From http://www.irs.gov/pub/irs-pdf/i1040gi.pdf :
Line 21
Other Income
Use line 21 to report any income not reported elsehwere on your return or other schedules....
How about "fuck off pig?" That way when they ask you under oath what you pass word is you can sincerally tell them what it is and what they can do.
Supporting World Peace Through Nuclear Pacification
The priest is quiet for a moment and then says, "are you sorry for your sins?"
The man replies, "Sins? What do you mean?"
The priest sounds concerned. "What do I mean? What kind of Catholic are you?"
The man replies, "Catholic? Father, I'm Jewish!"
The priest is incredulous. "Well then why are you telling me this?
The man replies, "are you kidding? I'm telling everybody!"
I have a friend that works as a defense contractor and he has a security clearence and all that. His job is to build the radios that the FBI, Secret Service, etc use and if you think that stuff is paranoid, these guys are nuts.
The radios are encrypted (obviously) using NSA techniques. The NSA techniques cannot be written down anywhere, and to find out how they work, they ask some dude who has been employed by said defense contractor for his entire life and his job is to remember this technique without ever writing it down or such. He is well paid too.
Once this said technique is written and tested to work 100% of the time, and not 99.99999999% like many programs, it is compiled and the source file is then given to the NSA for safe keeping/code review.
The radios themselves are the height of paranioa. The radios if tampered or left unguarded for 15 minutes, it will automatically wipe out the flash card (thus destroying the encryption key and non hardware based technique). This makes the radio a $1000 dollar brick which then needs to be sent back to the manufacturer to work again. (for a nice profit too!)
Also, once a radio is compromised, the other radios are distributed new encryption keys, so their communications are now secure. The radios in said group are also re-keyed at normal intervals.
Now, these radios if compromised are not totally useless. They can be used as remote listening devices (transmit when button not pressed, and "other" features) and can be broadcast fake information(duh).
Also, in those type situations, I have another friend who says the destruction method of choice for paper and tapes are incendiary grenades. Load the classified manuals(these are just lit with a lighter, but you get the point), important computer chips and other stuff into a box, place the nade and watch it flame and then after it has burned, chuck it off said airplane.
Also, most of the memory devices have a self-wipe feature. For hardware, the sledgehammer method is used. "take one, and apply liberally"
After that, to break the individual chips, smaller boards are collected in boxes and smashed with said hammers and stepped on etc.
He said his training instructor said, "Have you ever wanted to trash a room like a rock star? Leave nothing intact, and just destroy everything in sight? Except instead of some hotel room, it would be millions of dollars of equipment, and you get to destroy it? Nothing off limits? This is your chance. Live your dreams.
Just before you land, make you sure you destroy the more valuable stuff first, and toss the remains out the airplane too. "
He also claims(this one I doubt), that the flight crew in case of a crash landing, where they survive, knows how to blow up the entire airplane and remaining(if any) avionics equipment.
Mod Wisely.
The next logical step is to provide a free screen saver download, to lend home computing power to the Secret Service's decription effort. We might call it SecretService@Home.
To encourage participation, our agency might make the decryption process a background feature of a download more likely to be wildly popular .... maybe a game ... perhaps we could call it something appealling to young people with lots of excess computing power ... a name like "America's Army".
And if we wanted to throw scruples out the [MS]window, our agency might create a zombie net exploiting security ports (formerly known as "security holes") to allow truly huge DNAs. Our legal advisors recommend coding our zombierecruiters to target computers outside our country, whose owners may expect little in the way of protection under our Constitution.
DISCLAIMER: Our government never would do this! No, Never!
--- Attorneys Assisting Citizen-Soldiers & Families -