SimpleX goes NFT, and published it only on Xitter, wonder why?

It's really unfortunate to see that @simplex went the Tokenization/NFTs route to fund the project, and also chose Ethereum (which was 70% pre-mined by it's developers), inventing your own coin doesn't suddenly give it value (no matter what restrictions you […]

[Original post on mementomori.social]

Experts decoded encryption keys used by DarkBit ransomware gang Encryption key for Darkbit ransomware Good news for people affected by the DarkBit ransomware: experts from Profero have cracked the encryption process, allowing victims to recover their files for free without paying any ransom. However, the company has not yet released the decryptor. The National Cyber Directorate from Israel connected the DarkBit ransomware operation to the Iran-nexus cybercriminal gang called “MuddyWater APT.” How the attack started After a DarkBit ransomware attack in 2023, Profero encrypted various VMware ESXi servers, which were believed as retaliation for Iranian drone attacks. The threat actors did not negotiate the ransom and emphasized disrupting operations and campaigns to damage the target’s reputation. The gang posed as pro-Iran hackers and had a history of attacking Israeli agencies. In this incident, the gang asked for 80 Bitcoins and had anti-Israel messages in ransom notes. Profero, however, cracked the encryption, allowing free recovery. How did the experts find out While studying DarkBit ransomware, experts discovered that its AES-128-CBC key generation tactic gave weak and predictable keys. Profero used file timestamps and a known VMDK header to limit the keyspace to billions of probabilities, allowing effective brute-force. “We made use of an AES-128-CBC key-breaking harness to test if our theory was correct, as well as a decryptor which would take an encrypted VMDK and a key and IV pair as input to produce the unencrypted file. The harness ran in a high-performance environment, allowing us to speed through the task as quickly as possible, and after a day of brute-forcing, we were successful!” according to the Profero report.  Persistent effort led to successful encryption The experts had proven that it was possible and got the key. They continued brute-forcing another VMDK. This method, however, was not scalable for the following reasons: * Each VMDK would require a day for the experts to decrypt * The harness resides in an HPC environment and is difficult to scale “While expensive, it ended up being possible. We decided to once again take a look at any potential weaknesses in the crypto,” Proffero experts said. The experts made a tool to check all possible seeds and create key and IV pairs to match them against VMDK headers. This allowed them to restore the decryption keys. Profero also leveraged the scarce VMDK files, where most of the content was unencrypted, as the ransom was partially encrypted. The experts then directly recovered the most needed files, avoiding brute-force decryption for most of the data.

Experts decoded encryption keys used by DarkBit ransomware gang #DarkBit #Encyption #Internet

This is what we call a beachhead.

If Florida, or any 1 state passes a law requiring a backdoor in Signal, the government now has a backdoor they can use anywhere, anytime.

#Signal #InfoSec #Privacy #Security #Encyption

RE: mastodon.social/users/eff/statuses/11438...

Signal shuns Sweden over proposed encryption-busting laws Experts warned the UK’s recent 'victory' over Apple would kickstart something of a domino effect

I like Signal, however, this is something I have been tracking for some time and I now use matrix.org because Matrix is an open protocol for decentralized, secure communications

www.theregister.com/2025/02/26/s...

#signal #E2EE #encyption #sweden