You Alone Can Save The Internet By Factoring This Number

You Alone Can Save The Internet By Factoring This Number

A hot topic in security research communities as of late is the Conficker B worm. This worm has infected nearly 10 million computers around the globe, and doesnt seem to be slowing down. The worm uses several different technologies to secure its payload, obscuring its contents and its intentions from researchers who wish to disable it. One of these technologies is RSA 4094, which is a very strong flavor of public key encryption. This encryption is used to obscure the contents of software delivered to infected machines, which seem to include updates to the worms code, and command and control information relayed from whoever is responsible for the worm. The encryption, however, has a unique weakness.

RSA’s security lies in the difficulty of factoring extremely large composite numbers Semi-Prime numbers quickly. A semi-prime compsite number is the product of 2 primes. Semi-prime Composite numbers have a unique property in that they only have 4 factors, 1 and itself, and each of the  prime numbers used to create it.

The semi-prime modulus of Conficker is known, and so far its only known weakness is the inability of researchers to crack the encryption on the payload of the worm. If we could crack the encryption, we may be able to provide a payload for conficker that disables the worm all together. Some may note that cracking RSA 4094 is currently thought to be unfeasible, but I say it is only unfeasible if you don’t try.  Without further adue, the Modulus of conficker:

Modulus: size = 256 words = 4094 bits

88A8BEE7 7DED455C 41CD6883 2C79C3B2 BC4D7333 4C801030 96846399 ECDB7018 CAFE9CDD B5263FBA B749DA71 441FFD7F 2D179ADF C4031AE3 3AF0EB57 D4086357

A30F204B 744CAEF5 06443787 00D5E18A 485BC1AD 0BE12269 2E6B7924 CB3F9D36 D2130437 3366D8C0 97D227BD 61DAF2E5 95A3B0D3 A76030BA 5249A1CC FBA5B7FA

ECFA3218 25BD3CAD E6DCE7D6 ED7104DC 4992AA42 07F91D7E 9247CB15 A800C61E 0EF33ACF 9CC24C76 08701C1A B047261B C80DF107 7A5D9E2D A28E983C 9DB1835B

09404D47 2D58E6B6 1C2C8A60 26BD6B76 B13400BC D6B7D9ED 9721E605 EEF95D08 53A64B60 7398D7FD D1FC30CD 4A29DE21 3D315A49 EB6AE350 74D7D161 7ED4993B

E435259A A8D920C3 56E53DC8 3972665D 23F17BDC C69E9393 A87D628A 6811EE23 7E386DEC 02DADFEB BB6AD6F3 D930A4E5 8AC26CE4 13659917 3140864C 605B400C

BB43338E 938A8712 F97E9E45 93E92944 CC880FCB 14349915 5FF6C269 AF873383 8045DBD2 BF802693 8A08DA5B 319EC35B BCFCCF8C 578E9E8D CC03D4BC B6DA1CEA

10D57010 92AD0968 B6985FF2 FFC6C9A2 2989D649 F24D2F2F 4DF38C9D 2E2472AF 4CF2D003 D86AA6DE 422B5CD7 9FC8901B 39455258 E93DB6B2 2D9A7897 FB59E1DD

B385DF72 7E83E2CB 25418501 967F5912 4DADA619 3603E8EC 42934976 333406E6 21E95687 CD44E85E F375EB4B 8BF0723C BA1B4C72 D61E44E6 4912CA45 F52DA7E7

  • rc

    You clearly have no idea the magnitude of how infeasable this is. LITERALLY all of the computing world could not factor this within 10 years. Trying is an utter waste of time.

  • I do, in fact, know how infeasible it is. Most approaches with all the known computing power in the world couldn’t crack this before the sun burns out.

    However, they were saying that about rsa 640 for a long time as well.

  • cavedave

    How do you know this key is only for downadup? It could be for a bank or a nuclear submarine or something for all you know. Maybe the malware writer wants you to factor this key for him so he can then use it to steal maoney from a bank.

  • Excellent question!

    In my case, I read about it here:

    That is a interesting hypothesis, and definitely a thought out of left field, but it is not quite possible.

    The issue is that the package has been encrypted with a public and private key, which in order to create, require knowledge of the factors of the modulus. So if the real intent was to discover the factors of the modulus, they would not have been able to use the modulus to secure their package.

Comments are closed.