Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/375 Thanks!
He's a malware researcher at
Checkpoint and comes from the Israel
Institute of Technology and
he's going to tell us something about
streamy radios and how to
avoid to spend nights and nights
trying to understand a crypto protocol.
But was it worth the time
to use?
I mean, in terms of spending
your night developing these other
software for automatism days instead
of checking by yourself.
Let's see.
Thank you.
Please give him another round of
applause.
Hi, I'm Ben, I'm from
the, uh, Checkpoint Moral Vulnerability
Research Group, and
this was mentioned earlier, but I felt
like mentioning it again.
And what I do is I look at the
applications of theoretical computer
science to problems facing that we come
across in the field.
And, uh, in less
whitewashed terms, what this means is
that I am an amateur mathematician,
was infiltrated the industry somehow
don't tell anyone, especially the people
working with me.
It's hard enough to keep this undercover
says it is, considering that when I
handed my boss the first draft of this
presentation, he took one look at it and
he said, you're really going to present
this with all of those formulas, they're
going to lynch you.
So first of all, please don't lynch me.
Second of all, I really tried my best to
take away most of the formulas.
There's one formula somewhere in one of
the slides.
Uh,
so this stock, as
I said, it is about, uh, automatic
detection of Kypreos vulnerabilities.
I would like to dove right into that,
unfortunately.
First, I'm going to have to explain what
the curious vulnerability is.
And unfortunately, to explain what
that means, I'm going to have to explain
how a stream system works.
So let's go over it as quickly
as we can.
OK, this
is how extreme cipher works, basically,
does this machinery call the pseudo
random number generator and the pseudo
random number generator except the short
and outputs what what basically
looks like noise to anyone who is not
familiar with the key?
It looks like noise
and what you can do is you can
use it for encryption, how you insert
the symmetrically known to both parties
trying to communicate, say, Alice and
Bob, and the sort
of random number generator at which this
key string that looks like a new X or
the plaintext here, it's the smiley
image.
And you get the ciphertext, which is
a plaintext X or the key stream.
And to the uninitiated, anyone
who is not familiar with the
key or the kitchen, it looks also like
this is a property of the X Corporation.
You take a nice plaintext and you what
looks like noise, you also get something
that looks like noise.
Next, what can you do now?
There is the ciphertext.
It looks like noise. But if you saw it
again with the same key stream, which is
what, Bob, on the other side of the
communication, we do get the plaintext
back again. Why?
Because this is another property of the X
Corporation.
If you X or something with the same
element, whether it's nice or not nice,
twice you get that element
cancels itself out.
You extra noise with noise again,
the noise cancels itself out and you get
that plaintext back again.
So
what's curious?
Curious, astonishingly, it is when
you reuse the same key string twice
to encrypt to different plaintext.
And as you can see it, lets take
a certain key.
This is the key and
we xor the
text with the first plaintext
with the key and the second plaintext
again with the same key and we get two
bunches of noise.
As we said earlier, if you exclude
the noise, you get something that looks
like noise unless you know the in advance
generated the key stream.
And now if it stands in the middle of the
communication, she's eavesdropping on
the communication and she gets this
noise and this other noise and it
all looks like moist air.
And of course, she can't do anything.
And there is no such thing as a curious
vulnerability. You can get up on stage
and go home.
No, not really.
This is what happens if you in two
different plaintext with the same
key. It is possible for you
has access to both ciphertext
to X or the two ciphertext.
And what did we say earlier about having
the same element twice in the next
operation here? The key appears twice.
You have the first plaintext X or the key
in the second plaintext X or the key.
And if you X or the two ciphertext
that result of the key, cancel itself out
and you get the first plaintext
X or the second plaintext.
This is not something that you want to
enable.
OK, I can see here it's
very easy for you to take a look
at this thing and
have a very good idea of what the
original plaintext were.
Now, this is due to the redundancy in
the two original plaintext.
In our context, the context that
we will be working with and mentioning at
the moment, it's a bit more difficult
than that. It's not so obvious.
It doesn't just jump out at you like
that. In fact, there's all the
effort and the algorithms dedicated
to extracting the original plaintext.
But this is an example.
You can look at it and see how horrible
this vulnerability is if if
it exists, it's not something very nice.
So.
What is it good for?
Why do we want to Zekeria, here's
the first example. This is a document for
Devinn on a project of another project,
ran for 40 years from the 1940s
to the 1980s, initiated by
the NSA to eavesdrop on Soviet
communication.
This was started before the NSA even
existed.
And the Soviets,
they were using their systems at one
time, at one time pad.
When used correctly, it is an unbreakable
cipher, but they were reusing their one
thing.
That's and what happened
is that the vulnerability that
we saw earlier arose because of
that. And the U.S.
intelligence was able to extract
information from those encrypted messages
for the following 40 years.
Isn't the case that the Soviets continue
sending vulnerable information for 40
years? It was only for four years and
then they wised up.
But for 40 years, the Americans continued
working on this project, instructing them
on more information. And they got all
sorts of useful intelligence, including
the names and identities of
spy rings and such.
So this is one use for it.
If you can look at the traffic
and say there's been
curios here, that's helpful,
you can then start to attack the traffic
and look for information.
This is another use.
Now, I will be shamelessly promoting my
tie because these are some NITI.
And earlier this year we research
a certain ransomware Verant
called Decrypt.
It's basically like a cryptococcal
wannabee. It infects your computer and
it starts encrypting your files.
And unfortunately,
as I dug deeper into the source
code, it found that there Creped
commits couriers.
It basically it uses streamside
four hours before.
This is a good point to mention that
everything I'm talking about right now
applies only to stream ciphers
and 110 pounds, which are like streamside
for not block ciphers, like a yes
and doesn't like and.
And I found out that that's what happens.
There's a.
Every single file encrypted by Decrypt
using our support
uses the same key.
It was a five letter key black
in all lowercase, and this
means that all encrypted files
could theoretically be recovered
using depending on redundancy
in the plaintext. Anyway, it's not
something that the malware offer planned
on. Now, the funny thing is that
we didn't even have to go that far
because the our offer actually
included the key in
every file.
We don't really know why.
Probably it seemed like what they did to
him at the time.
And so
unless the author
had done this thing,
we could have recovered that plaintext or
a large part of the plaintext anyway,
because this is mysterious.
Now, if we had a way to look at the files
and come to an epiphany, there's been
curious here and I wouldn't have had to
sit down in front of the screen looking
at either pro and are
there's tears of blood in his eyes for
nights and nights on end.
We could have just looked
at the files and say, hey, there's a
curious vulnerability here and proceeded
from there and saved a lot of time and
effort.
This is something similar.
This is traffic from the Romney campaign
where Romney came out around
2010.
It still credentials introduced to commit
financial fraud and
Romney sends it strophic
in a special homebrewed protocol over
part four for free.
It's not actually to celebrate.
It's of for free.
And this protocol contains
blocks and some of the books can be
encrypted.
And every single book is encrypted
with the same key, with the sort of
random number generator generator
restarted before of use.
So basically here you have curios on the
block level. Every single block is
encrypted using the same key.
So if we can look at this
traffic and understand
something, you look at it and say there's
been key here.
Again, that's useful because coming
into this traffic, we don't even know
anything about it.
And now just if we're just looking at the
traffic, say curios has been committed
here, that's interesting.
Not we don't expect
Cuba to use in a regular traffic.
And this is our last example.
Lest you think that only malware authors
and shady characters commit use,
Microsoft committed in the
2003 version of office
and in their document encryption
function, basically.
Every time you saved
the file, you modify the file and
you saved it again, it was encrypted
again with the same key.
The key was bound to file.
It was a single key every time.
And someone monitored your directory over
a long time, could look at the files
again and again and see as the
basically different plaintext.
Different files are encrypted again and
again with the same string.
And this enables a curious attack.
So it took time for people to
catch on to this. If we could only look
at the files and come again to an
epiphany. Oh, wow. There's curious here.
It could have been detected much earlier.
So how do we
manage to actually do this thing, and I
spent four slides explaining how
wonderful it would be if we could just
look at the heap of bytes and
understand there's been curious here.
That's nice. But how do we actually pull
this off?
Well, do you remember
has any one of you ever got stuck in one
of those early 90s quests, like someone
the saucer on Monkey Island,
when you are completely stuck and you
have no more ideas of what to do, what
you do? That's right.
You try everything on everything else
until something works.
So this is
what we're going to do here.
Basically, if we take every byte
from our original input and
it with every other byte,
we're going to get this space
where, again, everybody's excited.
Every everybody, for example, this
square will be the result of X on the
R with the R, and it's going to be an all
back because I think X itself
is an object and
every square, every tile in this
space is going to be basically the X of
the character from each column and the
character from it.
So what is this good for?
I'm going to see in a moment.
First of all, this is what it looks like.
As you can see along the diagonal,
everything is now light,
right?
Because it's a character itself.
So
what's our game plan based on the above
that if we take our input, let's
look at a typical
input that we might want to operate on
and find something interesting.
Let's take this input.
There's all sorts of noise in here
somewhere in here.
Are you going to ciphertext each
encrypted? Jutras There are both two
different plaintext encrypted with the
same key.
This is the thing that we are about to
find out. And if we x every
bytes with every other byte somewhere
in here. Right.
This is the first bite of this ciphertext
except with the first bite of this
ciphertext.
Why do we care?
Because of the phenomenon that we saw
earlier, if we
saw the first bite
of the two ciphertext, the key
bite cancels itself out.
And the same applies
if we exclude the second bites of the two
ciphertext and along
this diagonal, right.
If you go up one
unit and to the right one unit, we
basically advance to the next character
in both, uh, strings.
So along this white line, you can
basically you will be able to see
the two ciphertext with the
extraordinary charvat, basically the two
different ciphertext, actually, which can
be read along these diagonal.
And why do we care again?
Because we saw earlier what happens if
you do that? The key concerns itself out.
You could actually see the smiley face
and send a message here.
It's not going to be so obvious,
but it's still
a step that helps us see
what we need to do.
Why?
Because when you take,
uh, we come into this
whole thing, assuming something about the
plaintext distribution that we are going
to see. PlainText is different from
random characters, right?
You expect letters, you expect
punctuation. You expect at any rate,
the distribution is different as opposed
to random characters that are distributed
evenly.
The this is not the plaintext
distribution. This is the actual
distribution. This is the distribution
that you get.
If you pick a random plaintext, uh,
character from diplomatic distribution
and then a number, uh, another,
uh, random character from diplomatics
distribution and you exclude the two of
them, you get another distribution
in.
This distribution is again different from
the random distribution.
So it looks
to us differently. Right.
If we look at the byte that came
from two different plaintext
characters being accurate, it's going to
appear different to us from just
a random byte in the long run.
So what are we going to do?
We're going to scan this space
that I mentioned earlier, we're going to
construct it and we're going to scan it.
They're going to they're going to fashion
because the damning evidence
is like a crime scene.
And the damning evidence were all the
are going to look suspicious,
look like they came out of a different
distribution of the random distribution.
There are going to appear along a
diagonal such as this.
Of course, we don't have all those
colors and all this.
All right. When we come into this, all we
have is the input. But we know that if we
scan this diagonally and it just so
happens that there's curios here
somewhere, we're going to come across
this diagonal eventually and
we're going to look basically each byte
is like a little piece of evidence
that may be pointing in the
direction that there's been curious here.
And we are right now looking at two
ciphertext that had been in sync
with each other.
And we are going to walk along
the diagonals and each time we come
across a map, we're going to pick it up
and look at it and say, hmm,
this looks like evidence for
our hypothesis and maybe it gets hard
parts of this. And if we walk along
a diagonal and we found
we find an overwhelming amount,
a sufficient amount of evidence that
supports our our hypothesis that there
has been curios here, then
we raise the alarm and we say this
is enough evidence.
There's no way this was a coincidence.
There's been Chirinos here and
the vulnerable ciphertext to the
curious expecting attack are
in this offset and this offset.
And the length is so and so.
This is the formula I warned you
about Eternia and
this this is the failure of the math
involved, basically I said look
at the evidence, look at the evidence.
I'm going to have to mention what I mean
by that.
Basically, there's
a quantifier rubric
for deciding how much
bite a piece of evidence influences
our hypothesis and makes it things that
makes us think that the hypothesis is
more likely.
This is basically a computation involving
the disparity between the probability
that this might will arise from
the cortex, the distribution in blue
that you saw earlier and
the probability that it would arise
randomly.
I'm not going to actually go into the
formula, but anyway, uh,
it's important.
And, uh, regarding the question
of how much evidence is enough, this is
an important question. You can set the
bar high, we can set the bar low, and
we for the sake of the proof of concept,
we set the bar such that, uh, one
false positive is what we're willing
to live with.
Of course, you can send, uh, set it
to, uh, lower chance.
It depends on the context where you're
going to use this thing.
And the question is, if we
set the bar of evidence that I can
actually detect something, uh,
because
it may well be the case that if we're
just demanding when we come across
the actual thing that we're looking
for, the two excellent ciphertext, we're
not going to be able to find them because
there won't be enough evidence.
Uh, but as it turns
out, there's this one, right?
Uh, we found it using
what's called the trebuchets inequality.
The long and short of it is basically
that as long as the string,
the ciphertext, uh, that
we are looking for is long enough,
everybody is going to give us some amount
of evidence, uh, positive evidence
that, uh, tells us this may be
the real thing.
And basically,
if the string is long enough, we're going
to have enough evidence.
The only question is it's a numbers game
of what is the chance that we're going to
fail anyway, even though the string was
long enough in theory and we expected it
to work, this is what the inequality
is for it to bounce from above
the probability that something unlikely
will happen.
So if the string is long enough and if
you look at the formula, you
will be able to infer that
there long enough is logarithmic in
the length of the input, which is good.
If we double the input, we just need one
more Corktown to ciphertext for alarm
to ring.
And
basically this is what it is.
We will look at the formula and
I, I don't really expect,
uh, anyone here to
just, you know, look at it and
realize how the hell we came up with this
thing. But it's just proof that we
looked into it. This algorithm should
work in theory. No, uh, that's
all nice and good.
But we're going to have
to actually show
how it works in practice, because
I don't think looking at the formula
convinced anyone here very much.
And basically
we're going to look at
sort of heightmap, uh,
you're going to see what the algorithm
sees when it operates, when
the algorithm iterates over, the space
is reconstructed.
It's going to look at different bytes and
each byte is going to look like more
evidence or less evidence for
the, uh, hypothesis that we're looking
at, the case of key areas
and the areas,
the bites that are that
contribute more evidence are going to be
in red and the biases contribute less
evidence are going to be in blue.
And the algorithm looks
for diagonals that are basically
streak's. There are lots and lots of, uh,
evidence for our hypothesis.
And we're going to appear in red.
We're not going to look at the heat map
of the evidence heat map of the Romney
communication that I mentioned earlier.
Well.
First of all, there's this, ignore this,
this is the main diagonal.
This is the diagonal where the
input is itself.
It's on nailbiter.
So, of course, it looks suspicious to the
algorithm. It doesn't look random at all.
But if you look a bit further
and you said here it is,
this is the long diagonal,
unique diagonal of where the algorithm
is going to detect the curious because
there is a streak of evidence here
along these diagonal.
You know, you can see this is
actually elliptic for anyone,
for some reason, fancy laser pointers,
and this is
this is the map for the second case,
it's a bit more difficult.
I don't know if anyone can see it here,
but again, you have the main diagonal and
it's trivial. But this is the heat map of
two fires encrypted by
the decrypt malware
that I talked about earlier.
And the two files were
the two files were encrypted using
the same key stream.
So we should be able to see
the key areas.
If we look at this, it's going to appear
as a red diagonal somewhere here and
it's here, right.
They're going to be over the war in
Angola, where everybody basically looks
like looks suspicious, looks more or less
like it came out, not out,
not out of a random distribution, but out
of a distribution of plaintext
by its exorbitant exploits.
Right.
Uh, so I
don't know if you noticed, but basically
we have succeeded in our plan.
We have managed to just take the
input, not knowing anything about it
beforehand and
computed all sorts of, uh,
properties regarding the exodus
of different whites.
And the other thing is that just
like you are able to look at this
diagonal and automatically
detect where the killer uses so
and the algorithm,
let's see if we have time for the
demo.
I see the other demo
isn't working for some reason.
Well, never mind, the other demo wasn't
as exciting as this one, because it
basically it showed you a script running
the script that generates this
basically the.
Romney's, uh, my that
we saw earlier, since this communication
in the script iterates over this and
eventually the script ran across to
actually see the script running across
this, uh, diagonal
and accumulating evidence and says, I see
this amount of positive evidence, this
amount of positive evidence, and it grows
and grows.
Eventually it terminates because it runs
across the end of the input.
And then it says, aha, I found it
and I found the cure, isn't
it? Output's the two offsets.
So actually, this is the more exciting
thing.
There's no need to look at the demo to
understand what's going on here, uh,
that we have succeeded, uh,
in our plan, uh, by
using that game plan that I outlined
earlier.
And I really hope that,
uh, this thing will be useful.
I plan on, uh, uploading it.
And at the moment
that I can actually get the code to a
state where I can actually give it to
someone to look at and then later look
them in the eye.
This is going to be, uh, uploaded,
uh, for the sake of anyone who wants to
take a look at it.
And, uh, this
is basically I, uh, hope
that you now understand better
what Chirinos is and how we
detect it using this method.
OK, and.
Now, any questions at all?
OK.
The heat map,
this one.
Test, I was wondering
about that totally not suspicious aren't
on the line at the.
Yeah. The horizontal lines, they are
probably the artifact
basically. What's the horizontal line?
This is a specific
character from one of the
from the plaintext episode with the
rest of the deciphered text.
It's basically it doesn't
have an application to what we were
talking about earlier, because
specifically, when you are two
ciphertext, it's going to appear along
the diagonal.
Um, probably
it's one specific part of the ciphertext
when X would be itself produced, some
sort of anomaly.
Uh, thankfully, it doesn't appear along
the diagonal. So we're not going to
suffer any false positives because of it.
OK, thanks.
OK, and once
the segments
where the same stream
stream says the safest reading, the key
stream is used, reused,
once you identify the segments,
which amount of manual
decryption, you need to recall that the
plaintext, uh,
actually, uh, I so, uh,
and so published exactly on this,
there's Phanatic methods for extracting
the plain text in this case where you
already have two ciphertext that you know
are vulnerable to the attack.
It doesn't work 100 percent of the cases.
But I saw this applied to the
actual case of war 2003 encryption,
and it works pretty nicely
if you don't have to use a manual
work in order to decrypt deserves
automatic, uh, methods for doing that.
Yes.
Uh, so you need to know
the distribution
of the plaintext.
Yes, yes.
Yes, that's right. You need to.
And actually these estimates were
generated with, uh, I guess
we came in with the guess of what
plaintext more or less looks like.
Uh, you're going to have some uppercase
letters and lowercase letters and
characters and such.
And hopefully this
August is going to be close enough to any
case of actual plaintext.
That is the alarm is going to raise
regardless of the actual precise
distribution.
There's one question for accuracy.
Yes, thanks.
The question from the Internet, are the
docs somewhere available?
You refer to
the documents available somehow?
Uh, the documents?
Uh, no, they're not.
But, uh, as I said, I'm planning to, uh,
work this out and, uh, upload this and,
uh, I will put out the notices, uh,
the moment that this will be available
to Travnik.
Um, thanks for showing this for your
ability to stream service, um,
in general today.
I think for anyone
the recommendation is not to use
streamside force at all.
So I think if anyone, including
Magwood designers, want
to design their own krypto system,
which is obviously a stupid idea,
then they should better be used to
be using these
deciphers authenticating
encryption ciphers.
Yeah, this is true then, because
not only because what
you didn't mention was
just encrypting the data
in the way you did alone is not
sufficient. You also need
to keep messages along with it
and which to which these new asifa
would actually bring in. And that's the
reason why in the new version of our
transportation security that's being
worked on, you don't find any of these
ciphers anymore because they're insecure.
Yeah, this is true.
Actually, the malware
malware is often used to suffer because
they're easy to implement.
Our software, for example, is very
popular because it's easy to implement.
And this is why you see it.
As you can understand, achieving
actual security, good security is
not the first thing on their minds.
I don't know what Microsoft is thinking
to themselves, but the malware for
doing this, basically, they said to
themselves, OK, I'm going to use
encryption. But apparently he
didn't go much further than that.
Yeah. To three.
So just a quick question about here.
Just a quick question about the
visualization part.
So are you doing like
just a bit for bit?
Because this is like two colors, right?
Or is more colors?
Are you the color you basically I looked
at random distribution
of RGV volumes from red to
blue and I computed it standard deviation
and its main, which is of course, in the
middle. And then basically I
looked at the distribution of evidence
along this, the values
of evidence of appear here.
And I use the matching function from
the first min
from the evidence to the mean of the
columns. And I
computed the calibrated
grades right.
Uh, of
the value of the evidence values
relative to the meaning of the evidence
and divided by the standard deviation.
Uh, to come up with this is quite four
bytes. Four bytes.
Yes. I say about four bytes.
Right.
You said that this is streamside
of like I'll see for Windber
to this problem, but
what about when you
use your eyes and see
mode or mode or something
like this? What's so
vulnerable to this problem?
I think when you did, I just explain
the class of cyphers vulnerable to
this problem is every cipher
where you come up with
a key stream of some sort.
Basically, there's a random key and you
get the ciphertext by ring
the plaintext.
If this goes through any other kind of
cipher, as I said earlier, block cipher
or anything like that is not vulnerable
to this kind of attack.
But what happens when you use
the countdown mode and you use the nouns,
the I don't I don't understand, can
you please repeat the question when
you say countdown mode and we use
the nouns from
I think that's what this reside
in, the same problem.
I think when
you, uh, when you use
a yes.
And the count.
Yes. No, no, no.
Not because you mean because there's X
ring somewhere within the operation of
the cipher.
No, this is really, really a specific
artifact of the fact that you do a linear
operation. The ciphertext is a linear
function of the plaintext
and the random key, the
moment that your encryption
operation involves X or operation,
but it isn't wholly linear.
There are stages of it that make sure
that it is not vinyard and the result is
not vulnerable to this kind of attack
anymore.
OK, thanks.
Well, uh, I guess we're done.
So thank you, Ben, again.