David Wong

cryptologie.net

cryptography, security, and random thoughts

Hey! I'm David, cofounder of zkSecurity, research advisor at Archetype, and author of the Real-World Cryptography book. I was previously a cryptography architect of Mina at O(1) Labs, the security lead for Libra/Diem at Facebook, and a security engineer at the Cryptography Services of NCC Group. Welcome to my blog about cryptography, security, and other related topics.

← back to all posts

The ghetto way of extracting the private key of superfish

blog

A realy entertaining piece by Errata Security where Robert Graham ghetto reverse the current controversial superfish of Lenovo.

(if you have been living under a rock

The goal is to set the right break point before it actually infects your machine – reversers have been known to infect themselves this way.

his ghetto way of reversing is first to infect himself with the “virus” and then using procdump to dump the process memory. Then dumping all the strings that the memory contains with the tool strings and voila. You have have the private certificate in the clear.

But the private certificate is protected by a passphrase. But apparently not, it was just protected by a password contained in the memory in clear as well…

I advise you to read the article, it comes with screenshots and nice commands that use text processing tools:

grep "^[a-z]*$" super.txt | sort | uniq > super.dict

spoiler alert, the password to protect the certificate is komodia the name of the company who created this mitm adware.

Note that if they would have used an RSA whitebox this would not have happened… so quickly.

← back to all posts blog • 2015-02-26
currently reading:
The ghetto way of extracting the private key of superfish
02-26 blog
📖 my book
Real-World Cryptography is available from Manning Publications.
A practical guide to applied cryptography for developers and security professionals.
🎙️ my podcast
Two And A Half Coins on Spotify.
Discussing cryptocurrencies, databases, banking, and distributed systems.
📺 my youtube
Cryptography videos on YouTube.
Video explanations of cryptographic concepts and security topics.