Slashdot Mirror
NSA's 'Codebreaker Challenge' Features Exploiting Blockchain To Steal Ethereum (ltsnet.net)
"The National Security Agency's 2018 Codebreaker Challenge kicked off on Friday, 9/21, and runs through 12/31," writes Slashdot reader eatvegetables. Each year's challenge -- which is open to U.S. students -- comes with its own (fictitious) backstory which the organizers say is "meant for providing realistic context."
This year's story? A new strain of ransomware has managed to penetrate several critical government networks and NSA has been called upon to assist in remediating the infection to prevent massive data losses. For each infected machine, an encrypted copy of the key needed to decrypt the ransomed files has been stored in a smart contract on the Ethereum blockchain* and is set to only be unlocked upon receipt of the ransom payment. Your mission is to ultimately (1) find a way to unlock the ransomware without giving in to the attacker's demands and (2) figure out a way to recover all of the funds already paid by other victims.
* For the purposes of this challenge, a private blockchain has been created with no real monetary value associated with the Ether.
"The first half focuses on network protocol analysis and binary reverse-engineering," writes eatvegetables, while "The second half is all about attempting to exploit the blockchain."
An email address from "a recognized U.S. school or university" is required, and the original submission notes that America's college students "are already hard at work trying to push their school to the top of the leaderboard."
This year's story? A new strain of ransomware has managed to penetrate several critical government networks and NSA has been called upon to assist in remediating the infection to prevent massive data losses. For each infected machine, an encrypted copy of the key needed to decrypt the ransomed files has been stored in a smart contract on the Ethereum blockchain* and is set to only be unlocked upon receipt of the ransom payment. Your mission is to ultimately (1) find a way to unlock the ransomware without giving in to the attacker's demands and (2) figure out a way to recover all of the funds already paid by other victims.
* For the purposes of this challenge, a private blockchain has been created with no real monetary value associated with the Ether.
"The first half focuses on network protocol analysis and binary reverse-engineering," writes eatvegetables, while "The second half is all about attempting to exploit the blockchain."
An email address from "a recognized U.S. school or university" is required, and the original submission notes that America's college students "are already hard at work trying to push their school to the top of the leaderboard."
A new strain of ransomware has managed to penetrate several critical government networks and NSA has been called upon to assist in remediating the infection to prevent massive data losses.
Restore from backups! No backups? Let's start with who we're going to fire for not having backups and work our way up to indictments for gross negligence. ;)
Anons need not reply. Questions end with a question mark.
Editor changed post to sensationalist crap! The new title is nonsensical. The content of original post hacked up and a mess.
They will hack into a school computer and enter the competition to win the prix.
Unless you've examined the "ransomware" in question, and seen the smart contract, I'm not sure how you can properly make such an analysis.
AC its a "difficult if not impossible tasks" when attempted in the middle of the network.
Go to the end of the network and read along well before encryption.
No need to worry about difficult real time encryption. The solution is waiting and very readable on a distant computer and consumer OS.
Domestic spying is now "Benign Information Gathering"
AC re "advertising their success"
The Nsa Worked To “Track Down” Bitcoin Users, Snowden Documents Reveal (March 21 2018)
https://theintercept.com/2018/...
"... report dating to March 2013" Welcome back to XKeyScore MONKEYROCKET, OAKSTAR AC .
Domestic spying is now "Benign Information Gathering"
You mean technology developed 10 years ago is the most proven ever in the history of computing?
Riveting.
We used HDD systems for backup in freaking 1999.
But if you do not need fast random access, good old tapes haven't stood still, and still have *insane* densities and data rates.
The solution is not collegiate.
SO each participant have self pre-qual their code as candidate, target or suspect in future. Very much like fingerprinting is their signature coding style.
Smart!
you forgot the people that did all you say, were all promoted and are still employed or very comfortably retired.
Nah. Doable. The easiest solution is probably not available, though. Need to conduct a 51% attack. If it's pow, you'll need to throw hash power at it. If it's clique or that other protocol Parity uses (whose name escapes me), which is likely since most reasonable private networks are, then you're boned because you'll need a quorum to add nodes and if you have control of that you don't need the attack. 51% attack will let you approve the transactions you need to set the balances to the ransom, return the ransom funds to those wallets that paid, and then delete the contract, rendering the funds irretrievable and irrelevant. The keys could unlock and you're saved. This isn't realistic on a real public chain, unless you're the NSA with almost unlimited compute resources available. Now if it's a matter of hacking the contract, that's a different story, but start with tools like Mythril or Quantstamp and see what you find. This will be the only approach if it's a POA network instead of POW because if you had the quorum to add sealer nodes you already have the 51% attack right there.
Since the inception of cryptocurrency, it was bound to be exploited to this particular degree. In reality, the fact remains that cryptocurrency as a whole will continue to falter as a viable currency in it's current state at this current time.
Changes in blockchain technology may improve this in the future, however, in it's current state it is too volatile to trust as a constant construct for valued currency.