Il super-spammer che rischia decenni di carcere

Re: I crack all' AACS sono pilotati...
- Scritto da:

- Scritto da:



- Scritto da:





- Scritto da:



..prima di tutto dall' HD-DVD Forum che non
sa



più che cosa inventarsi per spingere la
gente

a



comprare il mediocre formato HD-DVD.







Ed in secondo luogo dai produttori di

hardware,



senza "la pirateria" non si abbattono i
costi



perchè non sale la domanda. Così come
avvenne


con



il CSS dei DVD hanno dovuto auto-crackarsi
l'



AACS tirando fuori i soliti presunti



super-hacker-cracker-geni-12enni ... ehhh!
Ed



infatti sui forum sono apparsi vari
nickname..



chissà quanta gente c'è dietro ogni
nickname
e



quali multinazionali..







Far credere che sistemi DRM con complessi



algoritmi di crittografia siano
semplicemente



crackabili senza conoscere le specifiche e
le



eventuali backdoor da qualche ragazzino va

bene



per la massa ignorante, anche se è triste

sempre



più spesso vedere gente con qualifiche del



settore avallare l'idiozia del



ragazzino-super-genio che cracka complessi



algoritmi..



ehh!





Tre osservazioni:


- AACS è utilizzato anche dai Blu-ray, bel


vantaggio per l'HD-DVD


Forum.


- Le specifiche AACS sono pubbliche.


- La security through obscurity dà un senso di


sicurezza solo agli stolti, Windows e
qualunque


altro software closed-surce


docet.



Sì, certo.. che se tutti gli algoritmi e tutte
le

specifiche fossero pubbliche sarebbero più

sicure, eh?

Certo. AES ti risulta craccato? Serpent ti
risulta craccato? Leggiti qualche libro di
crittografia applicata prima di venire qui a dire
follie. TUTTA la sicurezza di un algoritmo
crittografico sicuro risiede esclusivamente nella
chiave, pertanto l'algoritmo puo' essere pubblico
e non cambia assolutamente
nulla.-
http://www.security-forums.com/viewtopic.php?p=261765&sid=99f99722c1499c69813671fadb3c434eAuthor MessagedevilsadvocateJust ArrivedJust ArrivedJoined: 01 Apr 2007Posts: 2OfflinePostPosted: Sun Apr 01, 2007 4:39 pm Post subject: Can AES be Cracked?? Reply with quoteI use Twofish 256bit AES encryption for some of my data. I have had a look on Google and most if not all sites suggest it has not even been cracked by anybody to date. Is that correct??The data in encrypt is extremely confidential and i need to know it is 100% safeAny help would be appreciatedBack to top View user's profile Send private message dveuveRegular MemberRegular MemberJoined: 28 Dec 2006Posts: 65OfflinePostPosted: Sun Apr 01, 2007 5:51 pm Post subject: Reply with quoteThe encryption itself can't be cracked yet, however there are far easier ways to get access to the data. For example, exploiting windows (and then PGP, or etc as applicable), getting the private key, and then just decrypting it. Or viewing the data as you view it, or etc.You need to make sure that your system is absurdly secure from viruses, spyware, hackers and etc to get near 100%. Actually reaching 100% is impossible, so you just need to aim to get close. If it's really that important, unplug the computer from the network. Oh, and backup the data in a very secure way too. If, for example, you use the Windows Encrypting File System, and someone tries to get access to the data by changing the password on the system, that will remove your own ability to access the data, in addition to the would-be attacker.Back to top View user's profile Send private message AIM Address bhavukLurkerLurkerJoined: 03 Apr 2007Posts: 18Location: New DelhiOfflinePostPosted: Tue Apr 03, 2007 10:49 am Post subject: Reply with quotethe modern encryptions are always difficult to crack. is the end systems that are insecure. if either the delivery terminal or the receiver terminal is compromised, the intruder will have access to plain text info, no matter what the encryption. so ensure terminal safety too._________________If it's there, it will be hacked -UnknownBack to top View user's profile Send private message Visit poster's website Dan.MTrusted SF MemberTrusted SF MemberJoined: 14 Feb 2007Posts: 75Location: Jacksonville, FL USAOfflinePostPosted: Wed Apr 04, 2007 6:02 pm Post subject: Reply with quoteTo answer your question: There are currently no known weaknesses in Twofish (that I know of).Can it be broken? Sure. All encryption can. The idea is to make it astronomically expensive and time consuming to do so.As others have pointed out, it is usually much easier to work around encryption or to simply take advantage of the weakest attack vector (such as the passphrase) than it is to break it. It is trivial for a powerful system working on a disk image to attempt hundreds of millions of passphrases in a couple of days. If your passphrase is shorter than 9 characters or doesn't contain special characters it would be a fairly simple and quick process to obtain your data.For reference, a decent PC can attack twofish passphrases at about 900 per second. That's 77760000/permutations a day, which doesn't seem like a lot but it can exhaust an 8-character lower-case alphabet spectrum in 2685 days (~7 years). If you use 10 PCs to perform the task, that is less than a year. A supercomputer cluster could probably pull it off in seconds.That doesn't even include lots & lots of dictionary-style attacks, shortcuts (rainbow tables), or simpler methods (such as mining data on your PC to try to match that against your password... page files can be gold mines for this).If you use a specialized password cracking device (FPGA system) passwords can be attacked at a rate of about 250,000/second. That will exhaust the entire 8-character spectrum (all possible characters including special, numbers, etc) in 33,435 days. At a cost of about $10,000 each, a million bucks will have you exhausting the full 8-character spectrum in less than a year.That is *not* a lot of money. Especially for governments and organized crime. I wouldn't be surprised if the U.S. government has the equivalent of over 100,000 FPGA cracking machines working in parallel at their disposal with all the fancy tricks added on to speed things up even further.So the lesson here is this: The longer and more entropy in your password, the better =)_________________Dan McDougall - CISSP, LPIC, SCSAIdea Information Security - Consulting, Assessments, Penetration Tests, HIPAA, SOX, ISO17799"The day before a breach, the ROI is zero. The day after, it is infinite." -Dennis Hoffman