As a theorist, I often motivate the need for strong cryptography via simplistic methods, such as "If this did not exist, your online bank transactions would be vulnerable". This is of course true if "this did not exist" means that we are in Minicrypt (or some weaker "world"), but I also sometimes use this to motivate switching off of particular weak cryptographic primitives. In this setting, it seems like social/legal conventions would mitigate the potential harm to the user --- for example, simple ways to attempt to leverage the total break of a cryptographic primitive (say transferring a ton of money into your personal bank account) would easily be undone through legal avenues.

In truth, I suspect that most of the hypotheticals that I can think of for how to nefariously exploit a broken cryptographic primitive in the wild would be easily reversed by law enforcement (perhaps I am just a bad cybercriminal though). That, coupled with my perception that "most" cybercrime does not rely on breaking the "actual" cryptographic primitives that are used (and rather implementation errors/social engineering), makes me curious if cybercriminals have ever attacked underlying cryptographic primitives as part of their criminal enterprise. I would be most interested in novel attacks / attacks against primitives that were thought to be strong beforehand, but as I suspect these do not exist I would also be interested in attacks against primitives that are known to be weak, provided they were against some notable company (where "notable" essentially means "something an average person may have heard of").

I want to exclude attacks by governments in this question, as these (especially via the NSA) tend to be fairly well-documented already, and seem to mostly sidestep the "law enforcement could/would undo the damage" argument.

  • $\begingroup$ Err, the second to last paragraph has no place in this site, AFAIK. $\endgroup$ – kelalaka Apr 11 at 18:13
  • 1
    $\begingroup$ Did SolarWind involve actuak cryptography breaking though? I thought it was "just" a supply chain attack. I dont want to include things like that because their root cause could be "simpler" things like social engineering $\endgroup$ – Mark Apr 11 at 19:06
  • $\begingroup$ And I include the second to last paragraph because if one doesn't, there are simple answers that perform much better in theory than they likely would "in real life". For example, one could MiTM banking credentials and transfer tons of money into your personal banking account. This attack is somewhat compelling for why we need strong cryptography, but also would be trivially "countered" by law enforcement, so is not actually a compelling example (although is vaguely related to an example which may be compelling). $\endgroup$ – Mark Apr 11 at 19:13
  • $\begingroup$ I read it like show me the ways :). Well, banks check unusual activities, they have tons of mechanisms apart from cryptography. Also, poor entropy sources are another way to attack. $\endgroup$ – kelalaka Apr 11 at 19:20
  • 1
    $\begingroup$ @kelalaka yeah, maybe I'll try rewriting the question. I think in hindsight what I really want to get at is applications of non-trivial cryptanalysis to cybercrime in particular. Among theorists there is a sense that cryptography itself usually doesn't break, and security vulnerabilities come from implementation issues/side-channels/social engineering (whether or not that is cryptography breaking is up to the reader). Clearly there are some threats of groups actually breaking cryptography, but they are usually government groups that people are worried about. $\endgroup$ – Mark Apr 11 at 19:35

I would also be interested in attacks against primitives that are known to be weak, provided they were against some notable company (where "notable" essentially means "something an average person may have heard of").

The first example that comes to mind in TJX's use of WEP 5 years after the break was announced; that lead to millions of credit cards being stolen.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.