6 ms·

> TDL-4's makers created their own encryption algorithm Two comments about this -- I give it maybe a week or two against a good cryptographer. You never, ever

by Xk 15y ago

> TDL-4's makers created their own encryption algorithm Two comments about this -- I give it maybe a week or two against a good cryptographer. You never, ever invent your own encryption algorithm. -- Even if the encryption algorithm happens to be secure against differential/linear/slide/boomerang attacks, I bet there will be an implementation flaw. It's really hard to get implementation right on those things, even if you have an almost perfect algorithm. Not that that all really matters -- anything that it's encrypted can be decrypted since they key lives on the computer -- but the fact that they created their own encryption algorithm gives some insight in to their minds. Namely, that they they they are smarter than they really are, and that despite all of that, they don't know enough about security to stick with AES. > and the botnet uses the domain names of the C&C servers as the encryption keys. ... what? That kind of defeats the entire purpose of encryption when they key is something like that. Besides, what are they using this encryption for. It seems more likely they want a check on the integrity of messages. And even still, a MAC is equally worthless since it's not public/private key. Either (1) this botnet is really weak or (2) the writers of this article have distorted the truth.

felipemnoa 15y ago
> TDL-4's makers created their own encryption algorithm Well, they could simply be using more than one algorithm. They could use AES as the main one and then re-encrypt everything with their own algorithm. If cryptographers break through their own created algorithm (probably just a variation of 3DES or AES) then they still have to break through the standard AES. I would be surprised if they were not doing something like this. As you say, everybody knows that you do not create your own algorithm. However, layering it with different algorithms, would probably be a good idea and it would make cryptographers work a lot harder (maybe?) Although if the keys are as easily accessible as they say then I agree with you, what is the point?
- Xk 15y ago
  If they're using their own algorithm and then AES, what's the point? They're worrying about AES being broken? But yeah, you're right. Seems like it would be better to spend time on the implementation of other parts of their botnet (like ... public key cryptography instead of using domain names as a key?).
nl 15y ago
> and the botnet uses the domain names of the C&C servers as the encryption keys. ... what? That kind of defeats the entire purpose of encryption when they key is something like that. Besides, what are they using this encryption for. It seems more likely they want a check on the integrity of messages. And even still, a MAC is equally worthless since it's not public/private key. Maybe it is public/private key, and they use (derive?) the public key from the name of the server? Either (1) this botnet is really weak or (2) the writers of this article have distorted the truth. I suspect (2), but I don't think they did it deliberately. I suspect it was an attempt at simplification, but they went too far.
- Xk 15y ago
  > Maybe it is public/private key, and they use (derive?) the public key from the name of the server? How would that work though? Maybe I just don't know enough, but I can't think of a way to generate a public key from some known source, and then somehow derive a private key from that source such that no one else can derive that same private key. I guess you could generate an RSA key pair using the domain name as a seed for your random number generator, but that seems like a terrible idea. As soon as they introduce some real randomness in to it, then you're no longer deriving the key from the domain name. I also suspect (2), but I wouldn't be surprised if they added some extra distortion to make the article read more like "Look how impressive these guys are! They made their own encryption algorithm!".
  - nl 15y ago
    Maybe the server generates the private key/public key pair, then derives the domain name from the public key (eg, long-random-string-that-comes-from-public-key.dyndns.com)? This derivation process could be the "encryption algorithm" the article refers to? The client is given the new servername via the P2P network, then derives the public key from the hostname, encrypts using it and communicates with the server which can decode using the private key. I'm not sure what the max length of a hostname is, which might be a problem. Another possibility is to put the public key in a TEXT DNS for the server hostname. That could be what they meant maybe?
  - rufibarbatus 15y ago
HNUsedToBeGood 15y ago
>> You never, ever invent your own encryption algorithm. That is a good advice for the average enterprise/startup programer. But these guys are: 1. Rockstar programers, probably a lot smarter then you or me (don't waste their time writing comments, but have created probably the most cost-efficient cloud platform in the world). 2. Afraid that NSA can come after them. And I'm pretty sure that NSA can crack the popular implementations of AES.
rdtsc 15y ago
> The code in the MBR uses an unsophisticated encryption algorithm, but even small modifications to the algorithm are sufficient to evade signature-based detection by most antivirus products. from http://www.securelist.com/en/analysis/204792157/TDSS_TDL_4 http://www.securelist.com/en/analysis/204792157/TDSS_TDL_4 So it is mainly there to fool anti-virus programs that look for a particular fingerpring, and not necessarily to pass secret info back and forth.
marshray 15y ago
I give it maybe a week or two against a good cryptographer. You never, ever invent your own encryption algorithm. Don't rule out the possibility that the botnet code was written by a good cryptographer. It may be that they're using a well-designed algorithm that these researchers didn't happen to recognize. Even if the encryption algorithm happens to be secure against differential/linear/slide/boomerang attacks, I bet there will be an implementation flaw. It's really hard to get implementation right on those things, even if you have an almost perfect algorithm. Sometimes something that would be bad as a standard building block can hold up in a specific use case. Maybe this thing really only needs to obfuscate the communications. Not that that all really matters -- anything that it's encrypted can be decrypted since they key lives on the computer -- but the fact that they created their own encryption algorithm gives some insight in to their minds. Namely, that they they they are smarter than they really are, and that despite all of that, they don't know enough about security to stick with AES. I wouldn't underestimate the Russians and Eastern Europeans like that. [...] Either (1) this botnet is really weak or (2) the writers of this article have distorted the truth. Probably both, at least (2). It's really really hard to write technically accurate descriptions of these things that are also accessible to a wide enough audience that you reach the people you need to reach.
- tptacek 15y ago
  Has any botnet ever been written by a good cryptographer? I remember Vern Paxson getting a whole paper out of supposedly-skillful botnet authors not even being able to generate random numbers securely.
  - icey 15y ago
    I'm not saying that's the case here, but surely cryptographers are just as corruptible as everyone else. There's nothing preventing a scenario where someone with nefarious intent and a large pile of money convinces a skillful cryptographer into building a cipher robust enough be resistant to cryptanalysis. (I'm not your downvoter by the way)
    - JoachimSchipper 15y ago

by Xk 15y ago

felipemnoa 15y ago

> TDL-4's makers created their own encryption algorithm Well, they could simply be using more than one algorithm. They could use AES as the main one and then re-encrypt everything with their own algorithm. If cryptographers break through their own created algorithm (probably just a variation of 3DES or AES) then they still have to break through the standard AES. I would be surprised if they were not doing something like this. As you say, everybody knows that you do not create your own algorithm. However, layering it with different algorithms, would probably be a good idea and it would make cryptographers work a lot harder (maybe?) Although if the keys are as easily accessible as they say then I agree with you, what is the point?

Xk 15y ago
If they're using their own algorithm and then AES, what's the point? They're worrying about AES being broken? But yeah, you're right. Seems like it would be better to spend time on the implementation of other parts of their botnet (like ... public key cryptography instead of using domain names as a key?).

nl 15y ago

> and the botnet uses the domain names of the C&C servers as the encryption keys. ... what? That kind of defeats the entire purpose of encryption when they key is something like that. Besides, what are they using this encryption for. It seems more likely they want a check on the integrity of messages. And even still, a MAC is equally worthless since it's not public/private key. Maybe it is public/private key, and they use (derive?) the public key from the name of the server? Either (1) this botnet is really weak or (2) the writers of this article have distorted the truth. I suspect (2), but I don't think they did it deliberately. I suspect it was an attempt at simplification, but they went too far.

Xk 15y ago
> Maybe it is public/private key, and they use (derive?) the public key from the name of the server? How would that work though? Maybe I just don't know enough, but I can't think of a way to generate a public key from some known source, and then somehow derive a private key from that source such that no one else can derive that same private key. I guess you could generate an RSA key pair using the domain name as a seed for your random number generator, but that seems like a terrible idea. As soon as they introduce some real randomness in to it, then you're no longer deriving the key from the domain name. I also suspect (2), but I wouldn't be surprised if they added some extra distortion to make the article read more like "Look how impressive these guys are! They made their own encryption algorithm!".
- nl 15y ago
  Maybe the server generates the private key/public key pair, then derives the domain name from the public key (eg, long-random-string-that-comes-from-public-key.dyndns.com)? This derivation process could be the "encryption algorithm" the article refers to? The client is given the new servername via the P2P network, then derives the public key from the hostname, encrypts using it and communicates with the server which can decode using the private key. I'm not sure what the max length of a hostname is, which might be a problem. Another possibility is to put the public key in a TEXT DNS for the server hostname. That could be what they meant maybe?
- rufibarbatus 15y ago

HNUsedToBeGood 15y ago

>> You never, ever invent your own encryption algorithm. That is a good advice for the average enterprise/startup programer. But these guys are: 1. Rockstar programers, probably a lot smarter then you or me (don't waste their time writing comments, but have created probably the most cost-efficient cloud platform in the world). 2. Afraid that NSA can come after them. And I'm pretty sure that NSA can crack the popular implementations of AES.

rdtsc 15y ago

> The code in the MBR uses an unsophisticated encryption algorithm, but even small modifications to the algorithm are sufficient to evade signature-based detection by most antivirus products. from http://www.securelist.com/en/analysis/204792157/TDSS_TDL_4 http://www.securelist.com/en/analysis/204792157/TDSS_TDL_4 So it is mainly there to fool anti-virus programs that look for a particular fingerpring, and not necessarily to pass secret info back and forth.

marshray 15y ago

I give it maybe a week or two against a good cryptographer. You never, ever invent your own encryption algorithm. Don't rule out the possibility that the botnet code was written by a good cryptographer. It may be that they're using a well-designed algorithm that these researchers didn't happen to recognize. Even if the encryption algorithm happens to be secure against differential/linear/slide/boomerang attacks, I bet there will be an implementation flaw. It's really hard to get implementation right on those things, even if you have an almost perfect algorithm. Sometimes something that would be bad as a standard building block can hold up in a specific use case. Maybe this thing really only needs to obfuscate the communications. Not that that all really matters -- anything that it's encrypted can be decrypted since they key lives on the computer -- but the fact that they created their own encryption algorithm gives some insight in to their minds. Namely, that they they they are smarter than they really are, and that despite all of that, they don't know enough about security to stick with AES. I wouldn't underestimate the Russians and Eastern Europeans like that. [...] Either (1) this botnet is really weak or (2) the writers of this article have distorted the truth. Probably both, at least (2). It's really really hard to write technically accurate descriptions of these things that are also accessible to a wide enough audience that you reach the people you need to reach.

tptacek 15y ago
Has any botnet ever been written by a good cryptographer? I remember Vern Paxson getting a whole paper out of supposedly-skillful botnet authors not even being able to generate random numbers securely.
- icey 15y ago
  I'm not saying that's the case here, but surely cryptographers are just as corruptible as everyone else. There's nothing preventing a scenario where someone with nefarious intent and a large pile of money convinces a skillful cryptographer into building a cipher robust enough be resistant to cryptanalysis. (I'm not your downvoter by the way)
  - JoachimSchipper 15y ago