3

An organization in a related business was recently hacked. The hackers downloaded several GB worth of files with private information and posted it on the Internet. The news article states:

“They were able to feed our system a pseudo-encryption key that the system should not have accepted but did because of software errors”

Since I live in a Windows world, this terminology is unfamiliar to me. Please can someone explain what this means and how it might apply to Windows? I believe I'm following all best practices, but I'm trying to determine if there's something I can learn from the above that could apply to me in a Windows environment.

  • 1
    The phrase "pseudo-encryption key" is new to me, too. I wonder if the person saying it misspoke? – schroeder Jan 29 '16 at 22:44
  • 2
    Pseudo could be taken by its literal meaning, not genuine. Basically meaning that a key used for encryption was arbitrarily defined by the attacker when it should not have been possible to do so. – Jonathan Gray Jan 30 '16 at 3:23
  • 1
    There's some more information here (warning: language). – benrg Mar 9 '16 at 4:42
1

Normally this would be a "fake encryption key".

In the response to the report:

Now you are making **** up. As it turns out, I was told what you might be hinting at here, and it’s clear you have no idea what the **** you are talking about.

In other words, in this context it's just a made up thing.

However, there are other situations, for example IPSEC "NULL Encryption Algorithm" or in GSM (A5/0) where you might give a key during a setup call that would then be ignored. You could then call it a "pseudo-encryption key" since it would be in the place where an encryption key should be but would be ignored. This would happen, for example, in some kind of encryption downgrade attack.

  • thanks to @benrg - used his link for this answer and basically jonathan-gray's phrasing. I starred out words from the original comment since I guess that that matches site policy?? The quote is, I think crucial since it's clear evidence that the "pseudo-encryption key" was just a way of avoiding admitting ignorance. – Michael Apr 19 '16 at 10:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.