3

An organization in a related business was recently hacked. The hackers downloaded several GB worth of files with private information and posted it on the Internet. The news article states:

“They were able to feed our system a pseudo-encryption key that the system should not have accepted but did because of software errors”

Since I live in a Windows world, this terminology is unfamiliar to me. Please can someone explain what this means and how it might apply to Windows? I believe I'm following all best practices, but I'm trying to determine if there's something I can learn from the above that could apply to me in a Windows environment.

Improve this question
3
  • 1
    The phrase "pseudo-encryption key" is new to me, too. I wonder if the person saying it misspoke?
    – schroeder ♦
    Jan 29, 2016 at 22:44
  • 2
    Pseudo could be taken by its literal meaning, not genuine. Basically meaning that a key used for encryption was arbitrarily defined by the attacker when it should not have been possible to do so.
    – Jonathan Gray
    Jan 30, 2016 at 3:23
  • 1
    There's some more information here (warning: language).
    – benrg
    Mar 9, 2016 at 4:42

1 Answer 1

Reset to default
1

Normally this would be a "fake encryption key".

In the response to the report:

Now you are making **** up. As it turns out, I was told what you might be hinting at here, and it’s clear you have no idea what the **** you are talking about.

In other words, in this context it's just a made up thing.

However, there are other situations, for example IPSEC "NULL Encryption Algorithm" or in GSM (A5/0) where you might give a key during a setup call that would then be ignored. You could then call it a "pseudo-encryption key" since it would be in the place where an encryption key should be but would be ignored. This would happen, for example, in some kind of encryption downgrade attack.

Improve this answer
1
  • thanks to @benrg - used his link for this answer and basically jonathan-gray's phrasing. I starred out words from the original comment since I guess that that matches site policy?? The quote is, I think crucial since it's clear evidence that the "pseudo-encryption key" was just a way of avoiding admitting ignorance.
    – Michael
    Apr 19, 2016 at 10:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .