start	end	text
0	1640	I get to cheat.
11310	21390	All right. And we're live. All right. So we're here with Mike Stay,
21390	28990	another fantastic speaker for virtual DEF CON safe mode. He is covering how he recovered
30250	34250	a six digit sum of worth of Bitcoin from an encrypted zip file.
35130	40430	And I guess if you just want to like quickly go into your talk, spend just like a minute or two,
40430	48750	and then we'll start asking you some questions. Yeah, sure. So short summary is I used to work
48750	56230	as a reverse engineer back in the late 90s. I broke the zip encryption that was used by
56230	61370	InfoZip, which was the open source version. And so everybody accepts PKZip based their
61370	67990	encryption on that, particularly WinZip that had like 95% of market at the time.
68470	75750	And yeah, so then 20 years later, somebody locked up their Bitcoin in a zip file that they made on
75750	82790	their Linux box and forgot the password. So they came to me and said, hey, I found your paper.
82990	85930	What's the current state of the art? Can you help me with this?
86890	89670	And this is your first time talking at DEF CON, right?
89670	95550	Yes. Yep. So we've given him fair warning, but there is a tradition for first time speakers
95550	101850	of DEF CON. They get to take a shot with us on stage. QA session is the closest thing to a stage.
101850	107290	So thank you, Mike, for providing DEF CON with some wonderful content. Cheers to you, man.
107530	109350	Thank you for having me.
112780	114220	All right.
118040	124680	Okay, so I was actually kind of surprised. So I have never thought about zip encryption as being
125540	129640	something that would be difficult to get around. You did go into a couple of different types of
129640	134000	encryption. I was also surprised that like, well, I wasn't surprised that early word
134840	140440	was as difficult as it was. But later on, the 40-bit encryption that was just really difficult
140440	144640	to brute force, that one kind of surprised me. Do you have any other... have you worked with
144640	149760	any other type of encryptions that have been surprisingly difficult to get into for being
149760	160630	such a legacy, weird proprietary protocol? Let's see. There were a couple where
161290	171750	they clearly knew enough to be dangerous, but then completely screwed it up. Like early word
171750	181250	perfect. You know, the founder of the company had broken that one himself. And then when they
181250	185390	released their new version saying, oh, now we're using strong crypto, nobody will be able to break
185390	191570	this. Went in and found that they took the password and then ran it through DES in the
191570	197550	wrong way and got out some vector and then just XORed their file with it or something ridiculous
197550	205550	like that. So they had DES, but they didn't use it right. It was so close. Yeah. There were ones like
209170	217050	Microsoft Access 97, I think was one where they had RC4 encryption, but it was a fixed key. And
217050	221750	so they would RC4 encrypt the file with this fixed key and then you'd go to this offset in the file
221750	230090	and look up the password and it was just sitting there in plain text. Some of the details might
230090	239370	be off. It's been 20 years. Fair. Go ahead. I want to ask a really, while we wait for people
239370	242510	to come up with some really good technical questions to throw at you, I'm going to do
242510	249170	one that... all right. So let's say that I don't know everything there is to know about encryption
249170	255170	out there. Let's say I want you to do... I'm going to ask you to do a similar thing that you did in
255170	262350	your talk. And I know that my password starts with a word and has some unknown thing after that.
262350	267950	Are there things that I can provide you that I might know about the password that will help you
267950	273230	get through this? Or does the encryption work in such a way that that doesn't mean...
273230	279970	Dictionary attack, right? The product you're using has strong crypto. The guys that built it
279970	283910	knew what they were doing. Then pretty much a dictionary attack is the only option you've got
283910	293910	left. And so there are specialized attack software that you can get. One of them is called Hashcat.
294290	300590	It's built for running on GPU farms. That was what we were originally looking at is maybe
300590	306470	writing a Hashcat module for this. But it's really designed for processing a key space.
307490	316890	And so you can give it a dictionary. You can then say, take this and then do all alphanumeric
316890	323170	strings up to length six after it. Or take this and try all different capitalizations. Replace
324330	329970	vowels with numbers. Say, you know, an I goes to a one or an O to a zero and so on.
329970	335150	E to a three. Whenever you do that sort of thing, you can... there are these rule sets that you can
335150	339710	say, okay, Hashcat, this is what you're going to start with and these are the rule sets that I want
339710	345830	you to use when processing it. Because this is best in my memory what the password looked like.
345970	350490	On the other hand, if you're doing something like correct battery horse staple from XKCD,
350490	355410	you've got too much entropy. And that's really the way to protect your files if you're doing
355410	363130	something is just make it longer, right? Because if you go from 26 characters, which is, you know,
363130	376130	lowercase letters, to 97, you've roughly tripled. That's adding two bits per character to the
376130	383790	entropy, right? So if you've got a length eight password, 26 to the eighth has, you know, all
383790	390370	possible lowercase letters there. But if you go up to 97, all printable characters, that's only
390370	397630	adding two bits per password. I'm sorry, two bits per character. So on a length eight password,
397630	405990	that's, let's see, 26 is about five bits. That's 32. And two times eight is 16. So it's adding
405990	411690	three characters to the length of your password. Adding printable characters to a password
412450	418910	of the same length, you know, it's just adding a few more. But if you go and add a whole bunch
418910	424250	more characters to your password, make it a long one, that'll make it really secure.
424750	430630	Use a passphrase instead of a short random string. Yeah, and so if you, even if you're using
430630	436390	English words, right, if you make it a passphrase rather than password, that'll make it really
438770	444990	so vulnerable to a dictionary attack. There may be other attacks if the crypto is bad, but if the
444990	451410	it'll protect you. So just this is entirely for my own curiosity. So after you broke through this
451410	457330	zip file, you got the password that you could use to decrypt the zip file? No, we didn't recover
457330	461950	the password. Oh, you didn't recover the password. Okay. Yeah. So the way the way zip works is it
461950	468290	derives a 96 bit key from the password. And it was 96 bit key that we recovered. Now, if we wanted
468290	474030	the password, we could take those 96 bits and then go launch a hashcat attack using dictionary and
474030	480010	and some other stuff that that others have have worked out to get a few of the initial characters.
480290	485130	That's where it fits into the type of password cracking that many of us are familiar with.
485130	489970	Hashcat or John the Ripper. Okay. So if you've got the 96 bits, then there's something you can do
489970	495830	with the dictionary attack that'll see whether the initialization process gives you those bits or not.
495830	499730	That's great. Yeah, what I was going to ask is if you got far enough to see if like a dictionary
499730	504610	attack would actually work against the zip file in less time than you spending all this time to
504610	514570	brute force it. But if you didn't... He suspected it was on the order of, you know, 20 something
514570	520890	characters or more, so it took him quite a while to to brute force. Would this technique that you went
520890	527410	through work for any encrypted zip file? Yeah, yeah. This will work on any zip file with...
527970	534710	So my original attack back in the late 90s required five bytes, five files in the
534710	539990	archive with the same password. This one we were able to get away with two because we also knew the
542570	549770	the timestamp. So if you've got the timestamp and you've got two files, then this will work
549770	555030	on any of them. So how does the number of files affect the craftability of the zip file?
558770	565910	When... Suppose you don't have the timestamp. Okay. In InfoZip, it was meant to run on Unix
565910	571230	machines as well as Windows machines. So on PKZip, they just allocated some memory and used whatever
571230	578290	bytes were there. Those random bytes. In InfoZip on many Unix machines, it would initialize the
578290	583970	bytes to zero. And so there would be no randomness there. So they used the process ID and the
583970	590330	timestamp to get a little bit of entropy and then fed the XOR of those two into C's RAND function
590330	597730	and generated a bunch of bytes. But they thought maybe that's too weak, right? There were some
597730	605210	known plain text attacks. And they're like, well, if they brute force the timestamp and the process
605210	611390	ID, then they can derive the rest of these bytes. And so they took the password and encrypted those
611390	616590	bytes once. And that's what they used as the random bytes when they encrypted that and the
616590	622870	rest of the file. But when they encrypted it twice, because of the way the ZipCypher works,
622870	627950	it produced the same stream byte twice at the beginning. So it encrypted it once and then it
627950	634470	decrypted it for the first byte of each file. So when you say that, is it files in the archive?
634470	643690	I have every 10th output of that C's RAND function and 40 bits were enough to figure
643690	648690	out the 31-bit internal state of C's RAND function. So once I knew the internal state
648690	654090	of C's RAND function, I could generate those first 10 bytes of each file. And then I would
654090	660890	do a bunch of bit guesses. And because of the way the Cypher was designed, not all 96 bits were used
660890	668790	when producing each output byte of the stream. So I guess like 40-something bits up front.
669070	673870	And then because I had five files there, and I knew what those bytes had to be, I could filter
673870	680270	all of those bits. I could say, I've got to know which of these 40-bit guesses are correct before
680270	685850	moving on to the next stage. Got it. And so by having five files, I could both derive the internal
685850	692710	state of C's RAND function and filter my guesses and finish one stage before moving on to the next
692710	698830	one. And so it was a parallel divide-and-conquer attack. In this case, I only had two files.
698830	704070	So even though I was making a 40-something-bit guess, I only had two bytes to filter it with.
704070	710250	So I, you know, that meant 2 to the 24th wrong key guesses went to the next stage,
710250	714370	and I had to guess more. And so it just kept getting bigger and bigger and bigger up to 2
714370	719330	to the 60-something before I could start paring it down at the other end.
719330	723670	So just for clarification, it's resetting the stream cipher every single time it encrypts a
723670	726030	separate file, and that's why you're able to do this?
726030	730550	Yes, yeah. So it starts over again with the same password, resets it to the original state,
730910	735550	and starts from there. Because you want to be able to extract a single file from the zip file
735550	737370	without having to extract all of them.
737370	737650	That makes sense.
737650	740510	I think you just answered one of the questions we got with the new attack,
740510	743590	is there an acceleration in having more files in the archive?
743590	749050	Absolutely. I mean, in the original attack, the more files you had, the faster it went.
749990	753450	And so this is just a refinement of the original attack.
754650	758130	But certainly having more files means more bits to filter with,
758130	760670	and getting rid of false positives earlier.
760910	764150	And sort of closely associated with that,
764150	770090	do you know if this kind of attack works with the other encrypted archives like 7-zip and RAR?
770090	776070	Most archival software now uses AES, like RAR5 switched to AES-256.
776070	779450	So this isn't going to work against anything except zip files.
779690	782330	Going for best standards, I like to see that.
782490	786370	Even WinZip switched to AES a while ago.
786370	790370	Fair enough. We had another question.
790770	795090	Do you know if your client was the legit owner of the Bitcoin?
795970	803690	I can't be certain, but we looked him up online.
803710	809310	We knew his real name, and we looked him up online and found that he had reason to be owning Bitcoin.
809870	814610	It didn't seem too shady. It wasn't someone reaching out across the dark web from...
815470	818610	It was part of his employment that he would be dealing with Bitcoin.
818610	819610	Fair enough.
823250	825070	No, that makes sense.
825070	827530	So this is really interesting.
828510	835190	Do you expect with putting this out here and providing this talk,
835190	839010	do you expect to get more of these requests to crack more things?
839010	846190	If you do get more of these requests, do you have an answer pre-built of how you might respond?
846190	857130	As far as breaking into Bitcoin wallets, yeah, when I first wrote this up on my blog,
857130	859090	we got a whole bunch of requests.
859470	865090	And for most of them, I had to say, nope, sorry, the best you can do is a dictionary attack.
865090	869330	Many of them said, you know, I bought Bitcoin with a credit card ages ago,
869330	870730	but now I can't find my wallet.
870730	873470	Can you help me? I've got my credit card records.
873830	875570	No, we need a little more than that.
876250	884130	The one that was most interesting was a guy who claimed that his hard drive had crashed,
884130	886210	that had Bitcoin on it.
886210	888650	And so we were working with him to get some data recovery.
888650	894490	But after a while, it became clear that he was perhaps schizophrenic or delusional,
894490	900090	that he believed that someone was cheating him out of his Bitcoin and had stolen.
900090	903190	Anyway, it was interesting.
903190	910670	That said, there are about four situations where we could potentially recover software.
910670	920490	One of them is if you printed out or wrote down the seed phrase for generating the 128-bit key,
920490	920710	right?
920710	925550	When you generate it, the wallet software always says, keep this in a secure place, right?
925550	932150	And it's this 30-odd word phrase that'll generate the 128-bit key.
932150	935570	If you've got that, you can recover the key, you can recover all your Bitcoin.
936210	944050	The next case is if you have had damage to your hard drive, right?
944050	949190	If the hard drive crashes, then the data in the sector is probably okay.
949270	954370	And even if the data in the sector is bad, we only need eight bytes to be okay,
954370	957090	that has the encrypted key in it, right?
957090	961030	So if we can recover that data, then we can probably recover your wallet.
961790	965410	If you have the wallet software, you don't have the original phrase,
965410	972290	but you know you used a weak password, then we can try and do the dictionary attack approach.
972930	980830	And then the least probable, there have been wallets with security flaws that make them
980830	983670	susceptible to breaking more easily.
983670	990590	And if you happened to use one of those back when they were being used,
990590	992530	most of them have been fixed since then.
992530	996830	But if you happen to use one that had a flaw, then we could try to exploit that flaw.
996830	1004750	Yeah, so this was an attack on a zip file, but you're talking directly about Bitcoin wallets.
1004750	1012230	Do they also use some zip-like structure? Have you attacked the Bitcoin wallets themselves?
1012890	1021530	The Bitcoin wallet takes the key, the private key information that you sign your transactions with,
1021530	1026610	and a password, and generates a symmetric key from the password and some salt,
1026610	1028650	and then encrypts the private key.
1028830	1032050	So that private key is really what gets you access to the Bitcoin.
1032050	1037990	What we can do is try to either recover the private key by means of that really long phrase,
1037990	1040270	regenerate that same private key.
1040890	1044330	Or we can attack the password, if you've got the wallet,
1044330	1047090	so that we can decrypt the private key that you had stored.
1047090	1053490	Or we can attack some flaw in the cipher where, for instance,
1055170	1060370	when they were coming up with the symmetric key, they didn't use the entropy properly.
1060370	1063590	And so there's a much smaller key space that we would have to brute force.
1063750	1067970	There are very few of those that were out there, but there were some.
1068550	1070930	There's a possibility we could do that.
1072450	1077890	So I like asking this question to people who know this technology really well.
1077890	1081450	Feel free to tell me, no, you're not going to answer this question,
1081450	1086410	but do you yourself hold any value in any cryptocurrencies?
1086410	1088790	Because you seem to understand how it works.
1089430	1097750	Um, I don't, because I have... I mean, there's no inherent...
1102400	1105160	When you pay taxes, you pay taxes in dollars,
1105160	1108260	because the government says you have to pay taxes in dollars.
1108260	1113520	So there is this built-in necessity to own dollars at some point.
1113520	1119320	There is no built-in necessity to own Bitcoin or any other cryptocurrency, right?
1119320	1128680	There's... and for Bitcoin and Ethereum, I think that proof of work has shown itself
1129260	1137020	to be susceptible to attacks like Sybil attacks, 51% attacks,
1137020	1143940	like Bitcoin Cash and Ethereum Classic have both suffered 51% attacks.
1143940	1146680	They were, you know, rebuffed eventually,
1146680	1150200	but, you know, if Google wanted to deploy their whole infrastructure,
1150200	1152720	they could completely own Bitcoin.
1152760	1159480	There are existing companies that could do that, not to mention nation states, right?
1159480	1163400	If the US wanted to take it down, they've got this thing in Tooele here in Utah
1163400	1169080	that they could deploy against taking down Bitcoin.
1169080	1176060	So my personal take, and we designed a system to do this,
1176060	1179380	is that you need to use a consensus algorithm with true finality,
1180520	1183280	that proof of stake and bandwidth.
1183780	1186880	And then after a certain point, when you have enough witnesses,
1186880	1189740	you say, this block is finalized and it can't ever change.
1190280	1195660	Ethereum is trying to move in that direction with their proof of stake algorithms, but...
1196680	1202220	Yeah, I've heard of proof of stake, but the finality piece is new to me.
1202880	1204960	You've definitely given me a few pieces already
1204960	1206860	that I'm going to need to go Google.
1207320	1212920	So we got another question. It's sort of a meta question.
1214960	1219400	One of the people that watched your talk had a little bit of struggle following your math.
1219400	1223020	They understood all the aspects individually that you talked about,
1223020	1227800	but zooming back out, they seem to lose pieces in their head.
1227800	1232000	And they want to know, how do you juggle this?
1232000	1235920	Are you aware that some people that follow your talk might have difficulty
1236640	1238880	zooming in and out like that?
1239080	1246380	Yeah. So I had some options when doing this talk.
1246380	1250780	One was to go really deep and really hard on the technical stuff.
1250780	1254540	Another one was to give enough background and the basic idea
1254540	1258860	of how this attack played off and the challenges we faced.
1258860	1267320	So I chose to be less detailed for the sake of the story rather than go deep into it.
1267600	1271400	If anyone has any technical questions, take them offline.
1271400	1275720	I'll be happy to talk through them with you and point at lines of code and that sort of thing.
1275720	1277140	That's great. That's awesome.
1277420	1285240	As far as keeping it in my head, I would have to wake up and then come down and reload everything.
1285240	1288540	I had stuff on whiteboards all over my office, pictures.
1288540	1292680	It was a process. I would even have to remind myself about what was going on
1292680	1295640	because I couldn't keep it all going at once.
1295640	1300800	And it was a months-long process of trying to think through over and over again
1301320	1305900	how things are going wrong and what I might be able to do to fix it.
1305900	1312340	So if you don't get it from one short 45-minute talk, I certainly don't blame you.
1312640	1313980	Makes sense.
1316620	1320520	Did we discuss this at the end? I'm sorry, I missed this point.
1320540	1323660	Did you actually get any compensation for this work?
1323960	1328880	We did, yeah. So when he first talked to us, we said we'd like so much up front.
1329180	1332120	We estimate that the total cost will be about this much.
1332680	1335460	We took longer than we said we would.
1335600	1339240	We expected it to be done in three months.
1339360	1342340	That was October, so November, December, January.
1342340	1348220	It was April before we actually, late March, before we actually got the key back.
1348240	1352580	But because of all of the extra cryptanalytic work that I did,
1352580	1355920	it took a tenth of the time on the hardware.
1355920	1361180	So the hardware cost ended up being only roughly 10, 15 grand
1361840	1365060	as opposed to the 100 grand that we thought it would take at the beginning.
1365060	1367840	So we gave us a bonus afterwards, which was nice.
1367840	1370400	I actually missed this.
1371180	1375880	Another one of the speaker goons mentioned that it was on AWS.
1377220	1383740	And they want to know if the 10 to 15 was about what you were expecting from compute cost.
1384240	1387180	No, we were expecting it to take far more.
1387180	1391540	The original estimate was around 2 to the 64th work,
1391540	1396540	which is comparable to finding a collision in SHA-1,
1396540	1398460	which is 100...
1400240	1405740	Sorry, SHA-1 was 160. MD5 was a 64-bit thing.
1406140	1412520	And there were some recent work where to find a collision,
1412520	1417500	they had to deploy an enormous amount of work to do it.
1417500	1423460	I guess MD5, they were able to do because of flaws in the hash function.
1424200	1431280	SHA-1 took roughly 100k of GPU time to break.
1431280	1435760	And so we were estimating it would be comparable to do this.
1435760	1440280	And this is what your company does, like data recovery?
1440280	1441660	Or is it specific to...
1441660	1443120	Not originally.
1443120	1448660	Originally, we were working on a distributed operating system.
1449980	1453880	And we could get clients interested if we can get in the door,
1453880	1456620	but it was right at the time when cryptocurrency was taking off,
1456620	1459240	and we didn't have to talk to anybody to get them in.
1459900	1462780	We started doing some consulting work there,
1462780	1468980	built up a team of about 20 scholarly developers that were top of the...
1470840	1473300	cream of the crop, top of their field.
1473940	1479780	And then built the rChain cryptocurrency platform.
1480220	1482920	rChain started having some financial troubles.
1482920	1486560	We allowed them to hire the devs early.
1486560	1489000	We had a contract that we'd hold on to them for a while,
1489000	1492180	and then they could hire them after they'd worked for us for a year.
1492180	1494020	But we let them hire them early.
1494160	1496820	So they've taken over the dev team.
1496860	1499180	And then we started working on some other things.
1499180	1503280	And this particular consulting job came up at a nice time.
1503280	1504540	It was a whole lot of fun.
1504540	1510240	But right now we're looking for any interesting consulting work that people have.
1510240	1514900	That was exactly what I wanted to segue into now that you've done this talk.
1515300	1521460	Do you have another research item on your to-do list that you're trying to aim at?
1522220	1523100	Sure.
1523820	1530260	At the moment, I'm doing some consulting work for the Ethereum Foundation.
1530260	1538140	I've got some consensus algorithm research that I'm working on.
1538730	1544140	We got access to GPT-3, so we're building an adventure game,
1544140	1548920	kind of like AI Dungeon, but with more structure using GPT-3.
1549300	1553800	We've got various ideas for voice assistants
1553800	1559040	that will be able to call somebody at a restaurant
1559040	1562240	rather than figure out every different restaurant's online ordering system.
1562240	1566920	You just have your assistant call them up and have a conversation.
1567140	1571000	GPT-3 seems to be able to have conversations, so maybe we can use that.
1571100	1574560	This is probably a really small piece of what you're doing,
1574560	1577660	but I used to be incredibly into MUDs.
1577700	1582160	So an adventure game that's generated by GPT-3 sounds interesting.
1582160	1588460	Yeah, so we're working on the room generation for quests.
1588460	1592100	You have to convince this character to give it to you.
1592100	1594920	He's got desires and needs.
1594920	1598760	So you'll have to be role-playing while you're doing this game,
1598760	1601580	interacting with these characters.
1601580	1605260	There is a person that goes by the handle Evil Mog,
1605260	1609360	is running a DEF CON CTF MUD right now.
1609360	1612180	Just a shout out to him.
1612300	1614440	We are really close to being out of time.
1614440	1617980	There are a lot of questions over here about specific pieces,
1617980	1619400	specific technologies.
1619400	1625540	I think I'd like for people to bring those to you on a less moderated basis.
1625540	1627880	So we'll let those go for now.
1628060	1631240	Before I let you go, I want to know,
1631240	1634920	what is the thing that you would like us to take away from this?
1634920	1640660	If there is a final idea that we should walk away from your talk.
1645260	1648020	That attacks on cryptography only get better.
1649340	1657200	At the time MD5 was proposed, 128 bits for a 64-bit attack was inconceivable.
1657200	1662020	And yet, within 5 to 10 years, they were able to attack that one.
1662020	1664700	And then SHA, there are attacks.
1664920	1670100	AES with the bi-click attack, they've now broken, I think,
1670100	1672840	seven or eight of the 10 rounds.
1673140	1676180	If there is something that you need to keep secure,
1676180	1681380	choose the best software and have a plan for upgrading your crypto
1681380	1683540	and any products that you put crypto into.
1683660	1685520	Because the attacks are going to get better.
1685520	1690260	You'll need at some point to transition from the broken system to a new one.
1690980	1695360	And so that will come up during the lifetime of your product.
1695360	1697400	So be thinking about it.
1697680	1699460	That's definitely good advice.
1699460	1699740	Yeah.
1703880	1706440	Falvo, you got any more questions you want to sneak in under the hood?
1706880	1708120	No, I think I'm good.
1708120	1710560	I really appreciate the work that you've done here.
1710560	1715900	And thank you for coming to present and giving your time to this Q&A session.
1716420	1719420	There are some more people that have some more questions coming in,
1719420	1720880	if you're willing to do so.
1720880	1725800	If you would put your contact information in the TrackOne channel on Discord here,
1725800	1727980	we will get that out there.
1727980	1732600	Folks can look you up if you're willing to be available to that.
1732600	1735720	I also recommend you put all of your company information,
1735720	1736920	if you're willing to do so,
1736920	1739880	because that's a good way for people to find you
1739880	1742060	for those contracts you were talking about.
1742440	1744220	Great. Thank you very much.
1744220	1746300	All right. Take care.