Cloud Hosting

A previously unknown piece of ransomware, dubbed ShrinkLocker, encrypts victim data using the BitLocker feature built into the Windows operating system.

BitLocker is a full-volume encryptor that debuted in 2007 with the release of Windows Vista. Users employ it to encrypt entire hard drives to prevent people from reading or modifying data in the event they get physical access to the disk. Starting with the rollout of Windows 10, BitLocker by default has used the 128-bit and 256-bit XTS-AES encryption algorithm, giving the feature extra protection from attacks that rely on manipulating cipher text to cause predictable changes in plain text.

Recently, researchers from security firm Kaspersky found a threat actor using BitLocker to encrypt data on systems located in Mexico, Indonesia, and Jordan. The researchers named the new ransomware ShrinkLocker, both for its use of BitLocker and because it shrinks the size of each non-boot partition by 100 MB and splits the newly unallocated space into new primary partitions of the same size.

Our incident response and malware analysis are evidence that attackers are constantly refining their tactics to evade detection, the researchers wrote Friday. In this incident, we observed the abuse of the native BitLocker feature for unauthorized data encryption.

ShrinkLocker isnt the first malware to leverage BitLocker. In 2022, Microsoft reported that ransomware attackers with a nexus to Iran also used the tool to encrypt files. That same year, the Russian agricultural business Miratorg was attacked by ransomware that used BitLocker to encrypt files residing in the system storage of infected devices.

Once installed on a device, ShrinkLocker runs a VisualBasic script that first invokes the Windows Management Instrumentation and Win32_OperatingSystem class to obtain information about the operating system.

For each object within the query results, the script checks if the current domain is different from the target, the Kaspersky researchers wrote. If it is, the script finishes automatically. After that, it checks if the name of the operating system contains 'xp,' '2000,' '2003,' or 'vista,' and if the Windows version matches any one of these, the script finishes automatically and deletes itself.

Kaspersky

The script then continues to use the WMI for querying information about the OS. It goes on to perform the disk resizing operations, which can vary depending on the OS version detected. The ransomware performs these operations only on local, fixed drives. The decision to leave network drives alone is likely motivated by the desire not to trigger network detection protections.

Eventually, ShrinkLocker disables protections designed to secure the BitLocker encryption key and goes on to delete them. It then enables the use of a numerical password, both as a protector against anyone else taking back control of BitLocker and as an encryptor for system data. The reason for deleting the default protectors is to disable key recovery features by the device owner. ShrinkLocker then goes on to generate a 64-character encryption key using random multiplication and replacement of:

After several additional steps, data is encrypted. The next time the device reboots, the display looks like this:

Kaspersky

Decrypting drives without the attacker-supplied key is difficult and likely impossible in many cases. While it is possible to recover some of the passphrases and fixed values used to generate the keys, the script uses variable values that are different on each infected device. These variable values arent easy to recover.

There are no protections specific to ShrinkLocker for preventing successful attacks. Kaspersky advises the following:

Fridays report also includes indicators that organizations can use to determine if they have been targeted by ShrinkLocker.

Listing image by Getty Images

Read more from the original source:
Newly discovered ransomware uses BitLocker to encrypt victim data - Ars Technica

Is End-to-End Encryption (E2EE) a Myth? Traditional encryption has vulnerabilities. Fully Homomorphic Encryption (FHE) offers a new hope for truly secure messaging, cloud storage, and data analysis.

Encryption is like waterproofing: it needs to be all or not at all. Just as it makes no sense to waterproof a left shoe and leave the right unprotected, encrypting the consumer component of a messaging app is pointless if content can later be decrypted on cloud servers.

Its called end-to-end encryption (E2EE) for a reason, but up until now many services claiming to utilize this technology have fallen woefully short. From an architectural perspective, E2EE is difficult to implement, particularly in applications that serve millions of users.

However, the emergence of a relatively new encryption technology is raising hope that E2EE may become a reality rather than an aspiration. Its name is Fully Homomorphic Encryption (FHE) and its unique design makes it ideally suited to services that are reliant on true end-to-end encryption.

End-to-end encryption is a technology thats meant to ensure that only users communicating with one another can read the messages. This could be two individuals chatting via a messaging application or it could be a business exchanging payment data with another entity such as a bank. Data is encrypted on the senders device and decrypted on the recipients device, preventing intermediaries, including service providers, from accessing the content.

This is achieved by using cryptographic keys that encode the message before transmitting it in encrypted form. The counterparty then decodes the message using its own cryptographic key in order to read its content. In addition to messaging apps such as Signal and Telegram, the technology is used by email providers, cloud storage services, and file-sharing platforms. Its no exaggeration to say that E2EE is the backbone of the internet.

While E2EE can prove very effective at preventing third parties from intercepting messages, it is by no means bulletproof. Concerted attempts by adversaries, ranging from governments to state-sponsored hackers, to weaken encryption and introduce backdoors have resulted in many services that purport to use E2EE being vulnerable.

Critically, from the users perspective, there is no easy means of verifying whether encryption has been maintained throughout. As a result, individuals are compelled to take service providers at their word when they promise that messages are fully encrypted.

When a service claims to be end-to-end encrypted, it should be just that. In reality, implementations can differ wildly in terms of encryption strength. While its theoretically possible for users to check that the service theyre using is implementing robust encryption, its technically complex to do so, placing this ability beyond the reach of most users.

Telegram, for instance, allows users to verify that its open-source code is the same as that being used within its mobile applications and on desktop. However, this requires running a series of Terminal commands.

Telegram founder Pavel Durov has previously taken aim at other messaging applications, questioning the integrity of their E2EE. In his personal Telegram channel, hes claimed: An alarming number of important people Ive spoken to remarked that their private Signal messages had been exploited against them in US courts or media. But whenever somebody raises doubt about their encryption, Signals typical response is we are open source so anyone can verify that everything is all right. That, however, is a trick.

He then elaborates on the inability for users to verify that Signals Github code is the same as that running in the app. It should be noted that despite its claims to offer superior encryption, Telegram has also fielded accusations of weaknesses in its own E2EE implementation.

One of the challenges is that even when a service provider has implemented robust encryption, there is still the potential for messages to be deciphered. From weak key management to compromised devices due to malware, theres a multitude of ways in which content can be accessed by adversaries. And when a key is compromised, unless the provider generates new keys for every session, its possible to decrypt the entire messaging history.

Finally, even when E2EE is working optimally, its implementation places additional computational demands on networks, resulting in increased latency and reduced performance, especially on devices with limited processing power or on blockchains where resources are capped. For this reason, E2EE is by no means impregnable. Can FHE solve some of these challenges, or will it run into the same problems that have weakened existing encryption protocols?

One of the weak points with traditional E2EE is when it comes to decrypting the data: its here that theres potential for a third party to gain access to it. FHE, in comparison, allows computation to be performed directly on encrypted data without decryption, ensuring that data remains protected throughout the entire process. This is its greatest attribute and the one that differentiates it from other encryption technologies.

It may be hard to visualize the benefit FHE brings to bear in this respect when considering a messaging application, in which the data must be decrypted before it can be read by the recipient. But consider another instance in which FHE proves superior at safeguarding data within E2EE systems: email. Here, FHE makes it possible for an email provider or cloud service to return results from an encrypted database without actually seeing the data.

This capability can also be extended to numerous other use cases in which data can be analyzed without disclosing its contents: analysts can run algorithms on encrypted datasets, with the results only decryptable by the intended recipient. Or machine learning models can be trained using encrypted data. This allows organizations to leverage powerful AI tools without compromising the privacy of the underlying data.

Within a blockchain context, fully homomorphic encryption also has significant potential, particularly in the construction of end-to-end encrypted applications for messaging or transmitting financial data. Fhenix, for example, is powered by fhEVM, a variation of the Ethereum Virtual Machine, that supports confidential smart contracts. As a result, confidential data can be analyzed and transmitted without its contents being disclosed.

Given that data remains encrypted at all stages with FHE in transit, at rest, and during processing its easy to see why developers are so excited about its potential for strengthening E2EE systems.

FHE can reduce the attack surface and ensure that sensitive data is never exposed to unauthorized parties, even during processing. This eliminates the need to trust service providers since they only handle encrypted data and mitigates the risks associated with data breaches.

If FHE can achieve wider adoption, both in blockchain and traditional systems, end-to-end encryption may soon live up to its name, providing truly unbreakable data protection.

See original here:
How FHE Technology Is Making End-to-End Encryption a Reality - HackRead

Wuthering Waves treasure chests feature all kinds of puzzles for unlocking them, from peculiar training dummy pillars to moving around mysterious repeaters to activate light block mechanisms. The Encryption Block puzzle is an example, requiring you to unlock a specific ability.

Solving the Encryption Block puzzle requires using the Levitator ability to move the Key Repeater pillars onto the blocks surrounding the treasure chest. Doing this causes the blocks to light up, and your objective is to get every block to emit light. Once each Encryption Block emits light, the chest will unlock, allowing you to claim its rewards.

Youll know youre looking at an Encryption Block puzzle when you see spiked pillars and chiseled stone panels on the ground surrounding a locked chest. Unlike other puzzles, you can levitate the pillars and move them onto the blocks, allowing you to see which panels will emit light when you place the pillar.

Once you place each pillar on the Encryption Blocks, youll unlock the chest and claim its reward. Typically, locked treasure chest rewards include Astrite, EXP potions, or character ascension materials.

If you encounter one of these puzzles before unlocking levitation, youll first have to progress far enough into the main story to visit the Jinzhou city hall. Here, youll meet with Sanhua and learn more about your current situation before venturing off to the next area. Before leaving, though, Sanhua will provide you with multiple character abilities, including levitation.

Go here to see the original:
How to open Encryption Block chests in Wuthering Waves - Destructoid

Bluesky, the open source social media service that began as an internal Twitter project, has gained a key feature as it looks to compete with X and Threads. The service has finally added direct messaging capabilities more than a year after it started onboarding new users.

Direct messages are now available on both Blueskys app and website, the company announced in a blog post. The default setting allows users to receive messages from people they follow, though settings can be adjusted to receive messages from everyone or no one. For now, it sounds like DMs on Bluesky are fairly basic and only support person-to-person text chats, but the company says it plans to add support for media and group messaging, as well as end-to-end encryption down the line.

Until then, the company notes that it will be able to access users messages in some situations when its absolutely necessary, such as an investigation into spam or harassment. In rare cases, the Bluesky moderation team may need to open your DMs to investigate broader patterns of abuse, such as spam or coordinated harassment, Bluesky says in a blog post. This would only be done when absolutely necessary to keep Bluesky safe. Access is extremely limited and tracked internally.

So, like most other social platforms, Bluesky DMs are probably not an ideal space for sharing sensitive information. But the addition of messaging will likely be welcome news from users hoping to make more connections on the service and have conversations out of public view.

Read the rest here:
Bluesky finally has DMs, with encrypted messaging coming 'down the line' - Engadget