Recover Bitcoin money in a ZIP file: high-flying rescue

Credit: Eivind Pedersen – Pixabay

The ex-Google engineer and CTO of the Daap Pyrofex application describes how he was contacted by a Russian internet user who wanted to recover Bitcoin private keys. To obtain these precious keys, however, it was necessary to break the encryption of a ZIP file.

Successful rescue in the universe of cryptocurrency. The story is told by Mike Stay on his blog. The latter was faced with a challenge: break a ZIP archive containing two files, but not just any.

It was indeed private keys giving access to around 275,000 euros in Bitcoin bought earlier in 2016. Mike Stay was hired by a Russian surfer, the unlucky owner of this small fortune. He had lost the password protecting the ZIP archive for bitcoins whose initial value was between 8,000 and 13,000 euros.

An attack technique and months of calculation to break the file

But why Mike Stay? Because as he reports, he started his professional career specializing in reverse engineering and cryptography. In 2001, the engineer, notably through Google, had even published an article on a technique for cracking a ZIP.

Stay was therefore contacted on LinkedIn six months earlier by a Russian whose identity is not specified. It seems, however, to be the rightful owner of the bitcoins. This one indeed had essential information to crack the archive.

In his blog post, Mike Stay said, "Fortunately, he still had the original laptop and knew exactly when the encryption took place. However, this data was essential in order to break the protection of the document by reducing the number of possibilities (10 quintillions).

Stay was therefore hired to collect the Bitcoin keys and return them to their owner. The software engineer however estimated that several months of work would be necessary, as a significant computing power through a GPU farm. [processeurs graphiques].

New code to crack ZIP in one day

Despite his past experiences in this area, the task has not been easy.

I spent some time reconstructing the attack from the article. To my great regret, I had removed some sensitive details from my article, but I reworked them. Then I discovered that I had made a terrible mistake in evaluating the work! ”, He relates.

Clearly, the past method would take hundreds of thousands of years. With Nash Foster, his partner, Mike Stay therefore developed a new method based on an attack of the type " meet-in-the-middle "

After a first failure, followed by optimizations on the code, success was there.

We fixed the bug, relaunched the code and found the right key in one day. Our client was very happy and gave us a big bonus for finding the key so quickly and saving him a lot of money compared to our initial estimate, ”he said.

But why share such a story? To expand his CV in particular. Stay concludes his post by stating that he is currently looking for a new job as an engineer or data scientist. "If you have interesting technical analysis or optimization problems, don't hesitate to contact me and talk to me," he says.