Slashdot Mirror
How the Secret Service Cracks Encrypted Evidence
tabdelgawad writes "The Washington Post offers this writeup about how the U.S. Secret Service uses a Distributed Network Attack program to crack encryption on computers and drives seized as evidence. How can brute force still succeed with 256-bit encryption, you ask? Customized password dictionaries from the seized computer's email files and browser cache: People still use non-random passwords."
King Roland: The combination is: one . . . Dark Helmet: One. Col. Sandurz: One. King Roland: Two . . . Dark Helmet: Two. Col. Sandurz: Two. King Roland: Three . . . Dark Helmet: Three. Col. Sandurz: Three. King Roland: Four . . . Dark Helmet: Four. Col. Sandurz: Four. King Roland: Five . . . Dark Helmet: Five. Col. Sandurz: Five. Dark Helmet: So, the combination is: one, two, three, four, five. That's the stupidest combination I ever heard in my life! That's the kind of thing an idiot would have on his luggage!
Sounds pretty logical to me.
Why did they not keep their tactic of creating customized password dictionaries secret? Seems like they just gave potential criminals a big warning...
My password is totally unguessable - I mean, who else has the password asdjklf;@#$#@jjdakl?
No - wait, I meant that *wasn't* my password! Hey, stop ssh'ing into my box! No - not my 20 GB of Sailor Moon music collection!
Well, guess I'll have to use my backup password of qwurf$#@ff5a` from now on - No, wait -
Damn it!
52 Weeks, 52 Religions with John Hummel
If your password is something you've ever written on your computer, its likely they'll crack it? Interesting.... moral of the story: dont use words found in the dictionary as your password. Inject spaces or numbers or punctuation into the word if you do. And dont write it down on a sticky note under your keyboard.
The Doormat
If you're not outraged, then you're not paying attention.
for having my hard drive encrypted by a key, on a flash drive, which is encrypted by a password that is generated randomly every five minutes and hased twice before I lock it in my safe deposit box.
If you're tired, sleep! Wenn Sie muede sind, schlafen!
Which kind of makes much hard for conspiracy theories that the FBI/NSA/Secret Service require all these back doors into encryption software and/or operating systems. What's the point when humans are still the weakest link?
It's always been known that a fully random password is more secure.
But it's a bitch to remember, so people use easier-to-guess passwords anyway.
Knowledge of this technique changes nothing. Any crook smart enough to use totally random passwords after this incident probably is already doing so.
retrorocket.o not found, launch anyway?
In cases like this (and many others) security is only as strong as the person who manages it. Choose a weak password, choose weak security. I'm sure, however, if this information is public that their actual system is much more advanced. Sort of makes you wonder how sophisticated the NSA's equipment is.
shop.envescent.com - Computer hardware and more.
I use the built in crypto in Fedora (the device level encryption passed to a loopback file mounted under /enc). I doubt that, absent a key sniffer, my passwords would *ever* be discovered. I have some english words in them (most are long phrases with nonsense punctuation thrown in at several places), so I guess that could be some kind of issue. But overall, I feel pretty secure.
;)
Of course, I'm not actually defending any data that the government would care about, so it's all moot
(Unless the government has a pressing need to read my private journal about me bitching about how I can't get a date. In that case, those spooks are outta luck!)
Comment removed based on user account deletion
The U.S. Secret Service is having success with breaking keys using dictionary-attacks.
Now, reading between the lines:
The U.S. Secret Service has just perfected a brilliant new method of brute-forcing 256-bit keys in a matter of minutes using the same processing power as a pocket calculator.
Therefore the previous dictionary-attack system can safely become public knowledge.
Ripping an new rectum in the fabric of spacetime.
Well, not until you put it in my browser cache. Thanks a lot, buddy.
666-607: 6th floor apartment of the beast
This ties in nicely with the "BBC Writer Tries PC Repair" thread. Most people don't understand their computer's software, even if they're criminals trying to hide evidence, apparently.
Have you read my blog lately?
"People still use non-random passwords."
What's easier to remember, Your dogs name or z*4jhDm28&:1~. Now I will wait for someone to reply with "but my dogs name is z*4jhDm28&:1~"
And you know what happens when people use a random password? They write it down and either put it in their top desk draw or on a nice post-it note on their monitor.
How the Secret Services Cracks Encrypted Evidence
Looks like someone used Microsoft's Grammar Checker to create the headline.
Dictionary attacks and other brute force attacks still don't work too well on passphrases so those who use them can protect their drug money for a little while longer. It should also be noted that the DNA attack won't work unless the Secret Service has your private key file. The actual encryption can't be broken easily so they have to attack the weak encryption on the digital private key that's stored on your computer. If the key is stored in a manner that they can't get to it, then your data will still be safe. E.g. the key is stored on an IC in the computer that self destructs if it is tampered with like IBM's ultra-paranoid laptops. The IC would detect a brute force attack and destroy the key.
--
Want a free iPod?
Or try a free Nintendo DS, GC, PS2, Xbox. (you only need 4 referrals)
Wired article as proof
Of course I'd probably end up in Camp-XRay being tortured for the password. That's not where I want to spend my summer vacation.
There is nothing so silly as other peoples traditions, and nothing so sacred as our own.
"This is probably because people still have non-random memories."
Pfff. I can remember the opcode for the 6502 halt-catch-fire instruction. I can't, however, remember what I had for breakfast. How's that for random?
It's becoming increasingly clear that human language facility is mostly a giant system of cross references. Sometimes those references attach to other experiences outside the language network, like other sensations and actions. But the language itself is a highly flexible collection of weighted references. There's no intrinsic "meaning" to the words and other language elements, just our shared experiences, including our experience of language itself. These private dictionary attacks are an extremely sophisticated attack on the very human space of personal language constraints.
--
make install -not war
You know, it's amazing that Kevin Flynn had such trouble getting the info he needed to hang Ed Dillinger out to dry, considering that the password for the Master Control Program was "master".
I guess we've come a long way in the past quarter century. Except when it comes to choosing passwords.
Especially when all they have to do is offer them chocolate before they bust them;-)
If brevity is the soul of wit, then how does one explain Twitter?
You don't have to use random passwords to be secure. Slightly modified acronym passwords tend to be almost as good as completely random passwords, and people tend not to mention the phrase that the acronym is from very often.
For example, a password 'JWfimf#aIgtVae' is about as good as random; and yet, it's simply an acronym for "Juffo-Wup fills in my fibers and I grow turgid. Violent action ensues." with a hash sign thrown in for good measure. Any Star Control II fan would have an easy time remembering it after just a couple uses.
I once listened to a Philip Glass record for an hour and a half before I realized it was skipping.
It all comes back to the old axiom: If you rob a bank, make damn sure you pay your taxes.
The basic idea is, if you break the law, you cover every hole you can think of, no matter how trivial. Just like Al Capone should have paid his taxes, criminals (and everybody else for that matter) today need to start using better passwords.
Enter a new password: ***** [penis]
Sorry, your password is not long enough.
Enter a new password:
There's no place like ~/
Erh, yes they can : The Diceware Passphrase Home Page
criminals (and everybody else for that matter) today need to start using better passwords
Well, OK, so you're talking about this in more or less academic terms... but, I'd say that what criminals really need to do (um, espcially the ones that are smart enough read up on this sort of thing) is to use their brains for, say, something other than crime.
Don't disappoint your bird dog. Go to the range.
Passphrases are the only sensible solution I've ever heard of for divising keys that are both relatively easy to remember and sufficiently random so as to be secure. A random string of characters cannot be reliably memorized. Any word, no matter in what language and no matter how obscure, can be cracked by a dictionary attack. A sequence of words chosen at random can be memorized, and if it's about six or seven words long, is probably beyond the reach of cracker software, even the Secret Service's.
One of the best ways I've seen to construct a secure passphrase is Diceware. Arnold Reinhold constructed a list of about 7500 words of up to six characters in length. Roll five dice to pick out a word in the list; do this a few times to create a passphrase, commit the phrase to memory, and burn anything you might have written down. He calculated that if you choose a passphrase consisting of seven words this way, you have about 90 bits of entropy, which a cracker probably couldn't break in this lifetime. His sample phrase is cleft cam synod lacy yr, which probably takes some practice to memorize, but it can be done.
Always keep a sapphire in your mind
You've never seen the "shoot here to destroy" stickers that Uncle sam sticks on his computers, usually they are just slightly off center of the hard drive spindles, not sure how a multi-disk box gets tagged, but its probably in a similar manner.
Remember that P-3 that landed in chicom airspace back in 2000/2001, supposedly hammers were used to beat the interior of that bird all to hell when the pilot realized they weren't going to make it to a safe landing area.
09f911029d74e35bd84156c5635688c0
This might not be new to some, but it's quite easy to create random passwords that you can remember, although, I suppose you could argue that they are not completely random. Anyway, here goes:
1. Think of a sentence that you can remember, e.g., "My two lovely kids Spike and Mary eat noodles every day!"
2. Take the first letter of each word and use some common substitutions: "M2lkS&Mened!" - Bingo, not only is it a pretty random collection of letters but it includes numbers, upper case and lower case mixed and even punctuation. All lovely stuff to blunt brute force password attacks.
3. When you type it in, say the sentence to yourself in your head. It's really quite easy to remember that way. Also, you can even just about get away with writing it down (in an office environment) and not many people will understand it. Of course, I don't recommend this but people are people.
4. Don't forget to dump the sentence every few months or so and make up a new one. It's no big deal, they're easy to remember.
Hope that helps some.
At my former job, one of the programs we used would return "Password is not correct" if you input the wrong password.
:P
So, for a month, my password was "correct".
Hey, at least I had a handy reminder if I ever forgot what it was.
Hey, SS!
W MS bDwKKMWLDYRUG88 15gzDnFVPCDgH9L/ 0Rzyh7hF1J5xm2t wZhkXjCaTR02/H9+ AQ8lDFKVDQYYAiA wGUJc/GOgAbO668a KoitTl8bwK8AmrO SpddpBa2gWgfs8lm b6KUrfCes38xSe5 b05d6LKHphwyXXb1 rrDaw2ct6Qt5lAq qIFNM+UHcIQCP6kE eIj6niRoG87m7XU mRfoYnj9H4WpHd2X PdIT6AZX23rWK84 dj+A1ee7y/w255AS JxBoteG0EKC1j8H jouJ6RdammqmHWYC sjpmATiWHEP6jfM OPb0qSCyk8DWaEt0 IZIjqS/QwVV3Ng2 GSy2D9i1P6/xiy6a ASo8qSeArFO4KZl E05enZbjjD9zuliM M09a1L9RDGwB1TQ M8AszGHfdK07+VI7 4sODIqxI46pd/aN Oftik4aRCNozbquR 0wJ+UDaX8f2Qf34 BVR0sFMO/Pw8tktG 70WC3Y6rDt02G97 nCPRIkfrZQ6GUNIQ jDhNphAkJjZQg7g IZRGRTBiSTyC4u9d fF1NLlh/iDHEwH7 l00xu9nQCt5PA+qf xIkJN4vsIidT0hD HP7FGrsEsjtrSEDE wEXjKPAltPlmQTr ms/8QXoDCJ/TGbFR b8vpes6+8ce5iiO RX0rs8uzlaDNYnP+ PSwMYBPLhLEbznV hyvtB0UxjP8VeVGY +ZIMgT+pnKyuGb/ xR7XScBtV7W4dSPu 0uiwSnoprHDY10G ZKL17aTZzxxwLgcC q0EfCKNuAR09pms q/bQw8y5OG0j96ym h5CA4YlCfJvdGVT 3z/mHqNvkddu5QPj iIn4BXsLTIUMBv0 GWlHtF9zrDZ4JO8z aubc1mOsEDI1hfE KGIGd+I0l32NbU1n OB6ju7MtqzYGgaZ kcP1uN1mKiFtMQxF QxiPU+bUJhvCI=
Go stick a pig
-----BEGIN PGP MESSAGE-----
Version: PGP 8.1
qANQR1DBw04DB6hKqQuGABkQD/4ndRFLEcpsuHpf24/Moh2
4Jap4LfE3kpiVoiHvKWpSTz2z6lxbknY8
nVF1z1EkQPgNJhk8nrzSs3fu96D9wSuLE
XI4Z1knJn+kLvXhyDOXfoyBp8htnRsG5A
HNgk/wpSGPODVb1VQ3CL8uy1F1efM1UWm
tzfZ1b0RxyeKJkkSAwJFRH9pJb3cmXfw7
Ot8+RMrUVd1w3EXEZFO2lV0NeHyWlw0V8
EbdUD8Q7rrW8ELD1MBYR/uW0paxJKClUf
GLJPRDo+1DK5JWGzCDmpCqPCk/hC6IaTY
EEgdDMGn0/7PVP221FfvUmHiEptXaOIfr
V1Vw12K2pNTt5h9oVhf0N0g1GyD4jLLmp
i6516BAAj4IEcxfYcbEyxvfyDqwkxzJ6R
ATj5YyIDe2HnX66b6z9KaJrRlStSAhKr8
glArSeHh09AKDyYOYRA3eOp6Tdlog4qua
frOd100aZXP0w5928LbQT4HSUw9pQAsIL
tvX51ONAm2hSsjkWiBO9n2TMnYYV4th1m
ZE6hbscNP2dPGk9Zn1xn0HJSzogOqOYwc
4X31KiVUuJ4LsTNrpvLwl1P+rvzrPHr3E
MdarZSX1QRgEJt/ncSvfhqHwGo21HR9lZ
YcopCBgJX61SHI+zdZkvbZ+z0NrrnTx5Q
dzMXIikb/312gs99vRUxKh+4tQlSQKlrW
7iIxoRlYaN5QcwPizj9cFy6AQBGHZGnXD
JD0YluWuDrSeGkgFtYzFSf/HPdv8jrHPd
liHKlUowBHmL7pbP5F/A348XNovPFL/YG
rRO7SHaproOa+CchbNySs2raYmqk02veb
P54a5qvTc3f3qv5MhvktHrQV6BGzBJvZP
pfRCp8Np+DUPqT7CswmULPjYlsJJjHsxa
+yPSaWVugMtoyBwruemTV9AwgE90W6nw5
LPNVSamLx1VY4rwe7yePeAredp8VuT+nJ
yiiy1f9TE3GVMogQ00c4OIpWXjNMa2GZF
=qYai
-----END PGP MESSAGE-----
and you mother, too!
M
trustedworlds.net - gaming, security, and the gunk that lives in between
Wait... Secret Service employees have administrator rights? This is just wrong. Their IS department should know better.
Three guys from the CIA, Mossad, and the Iranian Secret Police have a competition. Each of them has a burlap sack, and must go into the jungle to capture a wild boar. The CIA goes first. 30 minutes later, he's back, with a wild boar in the sack. Mossad goes next, and he comes back in just 15 minutes with a similar catch.
The Iranian Secret Police goes next. He's back in 2 minutes. The CIA and Mossad are shocked. "No, you can't have alreayd caught a wild boar."
"Open the sack and see for yourself." The CIA and Mossad look in the bag and see a rabbit with cigarette burns, bruises, cuts, and possibly a few broken bones.
"That's not a boar, that's a rabbit. You lose."
On hearing this, the rabbit shrieks out, "no!!!!!! I'm a wild boar! I've been a wild boar for seven years. I can give you the names of other wild boars who are still loose in the jungle!"
-paul
Pistol caliber is like religion: everyone has their favourite, and theirs is the only right choice.
He then proceeds to get his golf bag and head for the links. The course is beautiful, the sun is shining, and his game is great.
Up in heaven, St. Peter asks God "Aren't you going to do something about this?" God replies, "Wait and see."
As the round of golf continues, the minister is shooting the best game of his life. On the 18th tee, The minister swings... God commands the ball and it bounces off the water, out of a bunker, and right into the cup.
St. Peter is incredulous. "Why are you REWARDING this man for shirking his duty!? I don't understand?!"
God replies "Who's he going to be able to tell about it?"
Why, oh why, didn't I take the Blue Pill?
Nah, they just need to steal more so they become revolutionaries or businessmen. "One lawyer with a briefcase can steal more than a thousand men with guns"- The Godfather.
My little site.
Logic fails you.
"Criminals with enough money are businessmen" and
"Businessmen with enough money are criminals"
are two different statements. I do not agree with both. HOWEVER, often the means of accumulating large sums of money are closer to crime than should be allowed. Skirting the rules of groups as a whole and "morality" is rewarded too often within the boundaries of our current social systems. I don't particularly believe in morality but i have to sleep with my own dreams, which means I'm not rich and slightly bitter that I'm smart enough to have bad ones when I do bad things.
Quit dragging me off topic with your 'karma to burn' self.
My little site.
The priest is quiet for a moment and then says, "are you sorry for your sins?"
The man replies, "Sins? What do you mean?"
The priest sounds concerned. "What do I mean? What kind of Catholic are you?"
The man replies, "Catholic? Father, I'm Jewish!"
The priest is incredulous. "Well then why are you telling me this?
The man replies, "are you kidding? I'm telling everybody!"
They now have TSA-approved locks which have some kind of TSA symbol on them that identify them as "OK". There's a master key for the key locks and the combination locks.
Prior to this I used tie wraps (the good ones with the metal in the latching end) through the lock holes on the zippers. I stashed an ancient wire cutters in an outer pocket for opening at my destination.
I don't know 'secure' these really are, but I suppose it makes it just hard enough that the crackheads working in baggage will choose someone else's luggage to rifle. I'm sure the master key component of the TSA-approved locks is trivial as well.
But as someone said above, if someone wants it, they'll just rip the fscking thing open. But it should be good enough. People have long complained about pilfering from luggage, but the complaints REALLY went up when the TSA banned luggage locking. IMHO most of the luggage pilfered was unlocked to begin with, and once everyone's was, it was open season for luggage handlers to steal, so a trivial amount of locking ought to deny them the easy opportunities.