Browsed by
Category: Technical

When is quantum cracking going to happen? Much sooner than bitcoin owners would like

When is quantum cracking going to happen? Much sooner than bitcoin owners would like

Q-Day is the day when classical computational cryptography we use today is slated to be obsolete, because quantum computers will finally be powerful enough to crack them. It is likely to have a similar effect as the Y2K crisis in that many digital security systems are not using quantum cryptography safe algorithms. The good news is that people can, and are, starting to fix things now. The bad news is that when it happens, the effects will be very immediate and catastrophic. Even that, however, is only half the story. We knew exactly when Y2k would happen (January 1, 2000 at 12:01am), but we don’t know when Q-day will hits us – until it’s already happening.

Konstanitinos Karagiannis provides one of the best, fullest discussion of the upcoming crisis. He gives a much clearer idea of when quantum computers will be able to break just about all existing cryptography – including all the encryption underlying Bitcoin and other online digital currencies. And it’s much sooner than people were thinking even 2 or 3 years ago. Like fusion power, it was always thought Q-day was 10-20 years away. It’s certainly what bitcoin promoters will tell you.

The summary?

The NIST says that all systems should have switched to quantum computing safe security algorithms by 2035 – but Konstanitinos says it’s MUCH more likely that we’ll see real quantum cracking happen sometime at early as 2027 based on the recent rapid developments in quantum computing and algorithm improvements. He points out its likely to start from government backed security agencies or very powerful, well funded organized crime groups.

What does this mean? It means any companies not updated to quantum secure cryptography will have computing systems almost completely vulnerable to having financial accounts emptied, customer data stolen, system take-overs or destruction, and ransom attacks. Secure emails and chat communications will be perfectly readable and usable for blackmail or extortion. Secure government and military communications will become vulnerable to infiltration. Infrastructure systems from airline traffic control, public transit, water systems, government computing services, to power systems become vulnerable to ransom attacks, havoc, and destruction.

It also means bitcoin and all digital currencies based on elliptical encryption/similar algorithms are very likely to drop from their current values to zero within hours after the first confirmed cracks happen. Clever attackers will likely crack a large number of digital wallets quietly over weeks and months by simply capturing the encrypted transaction data, and then flash-liquidate as many wallets as they can before the scheme is discovered and values go to zero. It’ll likely happen in less than a day. North Korea, even without quantum computing, already is doing this to the tune of billions per year.

You’re not even safe now. It’s also highly likely governments are using record-now-crack-later strategy of recording secret communications and bank transactions now so they can uncrack them later when quantum computing is cheap and easy. It’s very likely we’ll see it used for extortion in just a few years when everyone’s communications, web traffic, and bank transactions become public knowledge. If you thought Wikileaks revealed a lot of stuff, wait until governments and organized crime groups unencrypt years worth of recorded traffic.

He also covers the good points. There are cryptographic algorithms that are secure from quantum attack – which you should be using today. He also outlines how we will detect if people are using quantum computers to crack things by describing the current cracking algorithms and their telltale signatures.

Still – quantum cryptographic cracking is likely to be like lightening from the blue. Everything will be fine until it’s discovered to be happening. It’s very possible that literally trillions of dollars could be stolen in the matter of hours or days.

Fluxfox floppy disk visualizer

Fluxfox floppy disk visualizer

Fluxfox is a floppy disk image library – written in Rust. It’s intended to serve the needs of the emulator world and supports IBM, Amiga, Macintosh, and Atari ST formats. It can even perform operations on disk images consistent with typical operations of a PC floppy disk controller, while also giving low-level access to the track bitstream for other controllers.

It’s written by martypc/GloriousCow that has written a lot about floppy protection schemes.

When floppy disk copy protection was a thing

When floppy disk copy protection was a thing

Back in the day, software didn’t come on encrypted, online, distributed marketplaces, they came on humble floppy disks. This made them susceptible to copying. To fight this, developers started using all kinds of interesting tricks, which hackers would try to break. Thus started a nearly decade-long war of hackers and copy protection schemes.

GloriousCow started a series of investigations on historical floppy protection schemes on his blog. His site is amazing – he makes his own tools as well as shows the assembly code and has great diagrams. He covers things like EliaShim CodeSafe, XEMAG Xelok, Vault Prolok, EA Interlock, Softguard Superlok, Formaster Copy-Lock, and even got an interview with Robert McQuaid who made the protection circumventing CopyWrite software.

I particularly like his article about Copy-Lock mechanism used by Kings Quest. Copy-Lock employed several tricks such as sectors with non-standard sizes and putting purposefully incorrect CRC values on tracks to make standard copying incorrect.

In this case, Copy-Lock used a mechanism in which sector 1 on track 6 was intentionally written as only 256 bytes (instead of 512 bytes), with a 256-byte blank section to fill the gap. Additionally, the CRC was also altered to make a normal read think it was invalid. A normal INT 13h disk read would search and fail the read and CRC check.

CopyLock worked by bypassing the BIOS and talking directly to the disk controller. It would issue an INT 13h read on sector 1 track 6 that it knew would fail. This would place the head on the right track. The code would then tell the floppy controller directly to read track – and dump all 512 bytes. It was looking for the special byte 0xF7 as the final byte of that supposedly empty section of the track. The key is that it is not possible to create invalid tracks with invalid CRC’s like this using a standard IBM PC floppy controller. Copy-Lock created the special hardware that could write in this way and sold that, along with the checking code, as their solution.

His article has all the assembly code – which is really awesome.

Links:

Security expert hacks the USPS text scammers

Security expert hacks the USPS text scammers

Grant Smith got one of the USPS delivery scam text messages. He decided to track the scammers and uncovered a Chinese-language group behind the campaign. He hacked their systems, discovered their mechanisms, and gathered victim data. He handed it to USPS, bank, and FBI investigators – as well published information about their operations online and at Defcon.

He discovered the group sold their scamming kits to set up their own operations for a $200/mo subscription. Similar scams showed up in half dozen other countries.

What’s interesting is he reported how many people fell for it. The triad sent 50,000-100,000 text messages a day. In total, US victims for just this one (albeit very large) operation entered 438,669 credit card numbers. Many people entered multiple cards.

Read more about it here.

A brief encounter with Hyperbowl

A brief encounter with Hyperbowl

LGR had a recent video about the PC game Hyperbowl. They brought up the fact it started life as an arcade game at Sony’s Metreon Entertainment Center in downtown San Francisco.

The game came in several forms, but the one I remember is the one above. There was a giant bowling ball mounted as a trackball style controller that let you steer the ball down the course. There was a mock ball return and a set of bowling alley style seats while waiting your turn.

What’s more interesting is I met the developers of this game around 1999 and visited their studio in California – which I believe included Terence Bordelon. I remember seeing physical mockups of the arcade system setting around the studio – which was really just a big room with black painted walls, black curtains to hide different parts, and no windows. Secrecy was definitely a thing. There were various full-size mockups of what would become the official arcade machines sitting around. The trackball bowling ball controller was on a stand, There was the ball return mock in 2 pieces, and one of the stand-up arcade verisons. What I do remember is that the stand-up arcade version had a standard Windows mini-tower PC bolted into the arcade cabinet. I believe when they booted it I saw the logo for a 3DFX card in it.

This was the late 1990’s, and it was that awkward time where arcade games stopped using custom hardware and started using off the shelf PC hardware. It was much cheaper, much faster to develop on, and meant you already had your game ported to a PC platform – which opened selling the game on two fronts. Now games are written on engines that let you ship on 4 and even more platforms simultaneously. Video games were always about 5 years ahead of other software development when it came to maximizing sales.

LGR’s video reminded me of this wonderful bit of history. It’s amazing how far the industry has developed in 25 years…

Links: