How did cryptographers manage to recover the 20-character RoboForm code after 11 years?
In today's world, where cryptocurrencies are becoming increasingly popular, there are more and more stories about lost and newly found digital treasures. One of these stories happened with a European crypto investor, whom we will call "Michael".
Two years ago, Michael turned to Joe Grand, a well-known specialist in hacking hardware systems, for help. The fact is that in 2013, when the cost of bitcoins was relatively low, Michael decided to protect his 43.6 BTC (at that time about $5,300) from possible cyber attacks.
To do this, he used a software wallet — a special application for storing cryptocurrency on a computer in encrypted form. Unlike hardware wallets, which are physical devices, software solutions are more vulnerable to hacking, but if properly configured, they can also provide a high level of protection.
Michael generated a 20-character password using the RoboForm password manager, and then encrypted it using the TrueCrypt utility. Subsequently, this encrypted file was corrupted, and the only copy of the password was unavailable.
For several years, Michael tried unsuccessfully to get his savings back. He turned to various cryptographic experts, but all of them just shrugged their shoulders — there was almost no chance left. In 2022, Grand was able to help another person by unlocking the Trezor wallet using sophisticated hardware hacking techniques. However, Michael's case was different in that he used a software wallet rather than a hardware wallet, which significantly complicated the task.
Initially, Grand refused to take on the case, but after a while Michael approached him again, and this time the hacker agreed. To work together, he brought in his longtime friend Bruno from Germany, who also has experience in hacking digital wallets.
For many months, Grand and Bruno studied the old version of RoboForm that Michael supposedly used. And so, after much effort, they discovered a critical vulnerability in the pseudorandom number generator responsible for creating passwords. It turned out that passwords were linked to the date and time on the user's computer, which is why they could be predicted with quite high accuracy.
One major problem remained: Michael couldn't remember exactly when he'd generated the ill-fated password. According to the entries in the wallet, it was clear that the first transaction took place on April 14, 2013. But there was still no clear date. The team had to go through various time periods and generation parameters, which took even longer.
Grand and Bruno had to go to Michael regularly for clarification, pestering him with questions about the events of ten years ago. The crypto investor gave examples of old RoboForm passwords, but their parameters sometimes differed. However, in November 2022, experts finally achieved a breakthrough and were able to meet with Michael in person to share the amazing news. They still managed to recreate the original 20-character password generated on May 15, 2013 at 16: 10 GMT.
According to the latest data, the RoboForm development team, apparently, realized the criticality of the vulnerability and fixed it in version 7.9.14 of June 10, 2015, increasing the entropy of the generator. However, the company did not inform its 6 million users about the need to generate new passwords for important accounts.
According to Grand, this could leave vulnerable those who continued to use compromised passwords. He is also not sure that subsequent versions of RoboForm are completely protected from such problems, since it is not known what actions the developers took.
As far as Michael was concerned, the whole thing was very profitable for him. at the time of restoring access to the wallet, the cost of its 43.6 BTC was $2.6 million. He waited a few more months, and when the bitcoin exchange rate rose to $62,000 per coin, he sold some of the assets. Now there are 30 BTC left on his account with a total value of about $3 million.
And the man is in no hurry to part with them, hoping for a further increase in the exchange rate to $100,000. As he admitted with a smile, the fact that he lost access to his wallet a few years ago, in the end, served him well. Otherwise, he could sell off all bitcoins at the rate of $40,000 and lose future millions.
In today's world, where cryptocurrencies are becoming increasingly popular, there are more and more stories about lost and newly found digital treasures. One of these stories happened with a European crypto investor, whom we will call "Michael".
Two years ago, Michael turned to Joe Grand, a well-known specialist in hacking hardware systems, for help. The fact is that in 2013, when the cost of bitcoins was relatively low, Michael decided to protect his 43.6 BTC (at that time about $5,300) from possible cyber attacks.
To do this, he used a software wallet — a special application for storing cryptocurrency on a computer in encrypted form. Unlike hardware wallets, which are physical devices, software solutions are more vulnerable to hacking, but if properly configured, they can also provide a high level of protection.
Michael generated a 20-character password using the RoboForm password manager, and then encrypted it using the TrueCrypt utility. Subsequently, this encrypted file was corrupted, and the only copy of the password was unavailable.
For several years, Michael tried unsuccessfully to get his savings back. He turned to various cryptographic experts, but all of them just shrugged their shoulders — there was almost no chance left. In 2022, Grand was able to help another person by unlocking the Trezor wallet using sophisticated hardware hacking techniques. However, Michael's case was different in that he used a software wallet rather than a hardware wallet, which significantly complicated the task.
Initially, Grand refused to take on the case, but after a while Michael approached him again, and this time the hacker agreed. To work together, he brought in his longtime friend Bruno from Germany, who also has experience in hacking digital wallets.
For many months, Grand and Bruno studied the old version of RoboForm that Michael supposedly used. And so, after much effort, they discovered a critical vulnerability in the pseudorandom number generator responsible for creating passwords. It turned out that passwords were linked to the date and time on the user's computer, which is why they could be predicted with quite high accuracy.
One major problem remained: Michael couldn't remember exactly when he'd generated the ill-fated password. According to the entries in the wallet, it was clear that the first transaction took place on April 14, 2013. But there was still no clear date. The team had to go through various time periods and generation parameters, which took even longer.
Grand and Bruno had to go to Michael regularly for clarification, pestering him with questions about the events of ten years ago. The crypto investor gave examples of old RoboForm passwords, but their parameters sometimes differed. However, in November 2022, experts finally achieved a breakthrough and were able to meet with Michael in person to share the amazing news. They still managed to recreate the original 20-character password generated on May 15, 2013 at 16: 10 GMT.
According to the latest data, the RoboForm development team, apparently, realized the criticality of the vulnerability and fixed it in version 7.9.14 of June 10, 2015, increasing the entropy of the generator. However, the company did not inform its 6 million users about the need to generate new passwords for important accounts.
According to Grand, this could leave vulnerable those who continued to use compromised passwords. He is also not sure that subsequent versions of RoboForm are completely protected from such problems, since it is not known what actions the developers took.
As far as Michael was concerned, the whole thing was very profitable for him. at the time of restoring access to the wallet, the cost of its 43.6 BTC was $2.6 million. He waited a few more months, and when the bitcoin exchange rate rose to $62,000 per coin, he sold some of the assets. Now there are 30 BTC left on his account with a total value of about $3 million.
And the man is in no hurry to part with them, hoping for a further increase in the exchange rate to $100,000. As he admitted with a smile, the fact that he lost access to his wallet a few years ago, in the end, served him well. Otherwise, he could sell off all bitcoins at the rate of $40,000 and lose future millions.
