Comments

David • March 14, 2007 1:52 PM

Bruce has been punked along with everyone else. The authors mentioned that it was faked and the software doesn’t work.

This was posted on several places a while back.

the internet is a hoax • March 14, 2007 2:16 PM

Its not really a hoax. It does brute force windows activy thingy. But it takes a really long time……

Wyle_E • March 14, 2007 4:43 PM

OK, a brute-force cracker would take too long to produce usable results against Vista. What about the other approach I’ve read about, grabbing activation keys off retail packages in the store with a camera phone? Was M$ really stupid enough to put the whole key on the outside of the box?

K. Signal Eingang • March 14, 2007 6:17 PM

@TG:

For what it’s worth, I remember back in the day a piece of software with a 30-plus-character activation key that was easily brute-force crackable. It turned out (we discovered) that the last two characters were used as a checksum for the rest, and that was the sole validation mechanism. They even gave you a huge hint by seperating those last two characters from the rest with a hyphen (all the other characters were in blocks of six) All you had to do was type in a random string, then keep trying different possibilities for the last two characters until you got a hit.

One would hope Vista activation wouldn’t be quite that brain-dead of course, but just sayin’.

Anonymous • March 14, 2007 9:42 PM

Since per Vista product id is signed with 384 bits elliptic curves algorithm. The activation is probably signed using the same signature algorithm with different key and it is hardly brute forcable.

frodo baggins • March 14, 2007 10:27 PM

Brute force attacks will always work, but they won’t ever be fast.

The bios driver hack does work, i can vouch for that.

one would need to determine the method of valid key generation in order to create pirate keys at any useful rate.

Ping-Che Chen • March 14, 2007 11:37 PM

Actually, there were XP key generators using brute force which worked, probably because the keys were too well distributed. In XP SP2 Microsoft invalidated a lot of keys which were generated by these generators.

Apparently Microsoft has fixed the problem on Vista.

Ken • March 15, 2007 1:23 AM

The chance of hitting a correct key using brute force should be less than that of winning a Lottery.

Shachar Shemesh • March 15, 2007 1:52 AM

@TG
The math you point to is bad. 36 combinations in 25 spots is not, as they claim, 25^36. It is, rather, 36^25, which is 808,281,277,464,764,060,643,139,600,456,536,293,376.

This number is 36 digits long, instead of 50. It is 10^14 easier to brute force it.

Even that sounds like a lot, granted, so lets translate it into numbers we are more familiar with. log2(36^25)=129.248

That’s right, 129 bits.

If there is anything I can say with certainty, it’s that Anonymous (#c154695) is wrong. This is, most definitely, NOT a 384 bit signature, unless it was truncated (in which case, it may have been once, but it no longer is, a 384 bit anything).

Obviously, 129 bits is still quite a bit outside what we can brute force at the moment, but you have to remember that it is highly unlikely that there is only one activation key. In fact, I can pretty much guarantee that this is not the case. This means that the 129 bit space is filled with an unknown amount of actual keys.

The real question regarding how feasible a brute force attack is, then, is “how dense are the keys”, or “how far apart, on average, are two keys?”

I don’t know the answer. However, whatever it is, it is bound by the number of product activation keys MS intended to produce. I think it is safe to assume that MS wouldn’t want to change the key method merely because Vista became popular. This means that they must have let the valid keys range be at least 32 bits. That means we have at least 32 bits worth of freedom in getting a single key.

The distance between keys must, therefor, not be more than 129.3-32=97.3 bits.

Yes, it’s still a lot. This may still not be brute forcable. Still, it is very far from the “384 bits” discussed above.

Shachar

Supersnail • March 15, 2007 3:21 AM

So you have 36^25 possible keys.

Microsofts are aiming at say 350 million vista sales == 35^7 which leaves us with approx 1^18 chance of any given key being valid.
Still too slow for a bute force attack.

What I am really curious about is why dosnt anyone actually hack anymore?
It surley cant be that hard to stick a “jmp” instruction at the right spot to jump past the key check?

fastersnail • March 15, 2007 4:12 AM

@supersnail,

it is a little bit more complicated than a jmp. that “jmp” will be in a signed binary, and when you tamper with it it will be detected. Also it might be updated on a update form MS and you will have to start form the beginnning. Disabling the check for singed binaries is also not a simple jmp.

phil • March 15, 2007 7:56 AM

Quick and dirty analysis:

If we take all the letters+numbers, we have 36 possible characters. Let’s ignore a few (like number zero vs. letter “O”) to reduce ambiguity. We wind up with 32 characters. 32 characters == 5 bits.

Microsoft product keys are 25 characters long. 25 characters times 5 bits per character == 125 bits.

OK, so let’s start allocating bits. We need a product (SKU) number. Each product (including beta releases, multiple variants of a product, etc.) would get a separate product SKU number. If we allocate 24 bits for the SKU, that’s 16 million possible products.

Next, we need a unique serial number for each copy of a given product. Let’s just arbitrarily say that 32 bits (4 billion) will be enough unique numbers per SKU.

Some SKUs, mostly betas but some demo products as well, are time-bombed. They expire after a given date or some number of days after installation. Let’s give 16 bits to the expiration date (say, this product expires X number of days after Jan 1, 2000), and another 8 bits for a “expiration X days after installation” field.

OK, so now we’re at 80 bits. With a total of 125 bits, we’ve got 45 bits left over. So, let’s sign the whole thing we’ve got so far with something like MD5, take 45 bits of the MD5 signature and add it to the end. That means that only one out of every 2^45 (3.5×10^13) product keys is valid. That’s a brute-forcible number, but only if you know what SKU number was used for the product you’re trying to find the key for (and the other numbers). Without knowing the SKU, you could generate a valid product key, but it woudn’t necessarily be valid for the product you’re trying to crack.

Neal • March 15, 2007 10:26 AM

Can someone explain how signed binaries or drivers serve any purpose? A good link will do. I don’t comprehend how signing solves or prevents anything if it’s not compared to a remote, secure, reference each and every time a binary is accessed.

Anonymous • March 15, 2007 10:38 AM

@Neal,

binary_1
binary_2
sign(binary_2, key)

With binary_1 I am assured nothing.

binary_2 + sign(binary_2, key) assures me that the owner of key signed binary_2 at some point.

Chris • March 15, 2007 10:59 AM

You can’t assume that, just because someone said they made a hoax, that they did in fact make a hoax.

People lie all the time. Sometimes they even lie about lying.

dhasenan • March 15, 2007 11:42 AM

Phil: I think you can combine the SKU and the expiration date by having per-product expirations. Also, you can reduce the space allocated to the product identifier: I doubt you’ll get more than 65K products from Microsoft; also, since each MS product can send an identifier with its product key, you don’t need to include any identifier in the key. (This could allow you to modify Vista into identifying itself as WinXP so you can validate it with a WinXP key, but you’d have to sign the binary with MS’s key.)

This leaves you with the full ~125 bits, if you can live with collisions between keys for your various products.

SecureIntent • March 15, 2007 12:02 PM

I thought that vista activation was possible without a crack. MS built it in. It will not last forever but it just requires a regedit.

Here are the details:

The following describes the Registry key that’s involved.

Step 1. While running a copy of Windows Vista that hasn’t yet been activated, click the Start button, type regedit into the Search box, then press Enter to launch the Registry Editor.

Step 2. Explore down to the following Registry key:

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ SL

Step 3. Right-click the Registry key named SkipRearm and click Edit. The default is a Dword (a double word or 4 bytes) with a hex value of 00000000. Change this value to any positive integer, such as 00000001, save the change, and close the Registry Editor.

Step 4. Start a command prompt with administrative rights. The fastest way to do this is to click the Start button, enter cmd in the Search box, then press Ctrl+Shift+Enter. If you’re asked for a network username and password, provide the ones that log you into your domain. You may be asked to approve a User Account Control prompt and to provide an administrator password.

Step 5. Type one of the following two commands and press Enter:

slmgr -rearm
or
rundll32 slc.dll,SLReArmWindows

Either command uses Vista’s built-in Software Licensing Manager (SLMGR) to push the activation deadline out to 30 days after the command is run. Changing SkipRearm from 0 to 1 allows SLMGR to do this an indefinite number of times. Running either command initializes the value of SkipRearm back to 0.

Step 6. Reboot the PC to make the postponement take effect. (After you log in, if you like, you can open a command prompt and run the command slmgr -xpr to see Vista’s new expiration date and time. I explained the slmgr command and its parameters in my Feb. 15 article.)

Step 7. To extend the activation deadline of Vista indefinitely, repeat steps 1 through 6 as necessary.

Any crooked PC seller with even the slightest technical skill could easily install a command file that would carry out steps 1 through 6 automatically. The program could run slmgr -rearm three times, 30 days apart, to postpone Vista’s activation deadline to 120 days. It could then run skip -rearm every 30 days, for a period of months if not years, by first resetting the SkipRearm key.

The program could be scheduled to check Vista’s activation deadline during every reboot, and to remind the user to reboot once a month if a deadline was nearing. The buyer of such a PC would never even see an activation reminder, much less be required to go through the activation process.

If you happen to buy a Vista PC from a little-known seller, and the price was too good to be true, use Vista’s search function to look for the string SkipRearm in files. You may discover that your “bargain” computer will mysteriously start demanding activation in a year or two — but your product key won’t be valid.
(excerpt from Microsoft allows bypass of Vista activation by Brian Livingston of Windows Secrets Newsletter • Issue 100 • 2007-03-15 .

So no brute force necessary–please move along.

FP • March 15, 2007 12:33 PM

And don’t forget that Windows’ WGA phones home every day. Presumably Microsoft has a list of license keys that were sold. They can easily deactivate keys that do not match any of the sold copies.

Anonymous • March 16, 2007 6:09 AM

@Shachar

I only studied the pre-Vista product id, so I cannot say for sure any update to Vista. The 25 characters input during install is the product id only, it is a 75bits number. (24 combination x 25) The 384 bits public key to check the signature is embeded in the product installation program. The signature hash is not very big (40bits), so it maybe/was possible to randomly find valid “Product ID”. The data for activation involved combining some hardware information and the product id, so brute forcing the activation I believe is close to impossible (of course unless there is some weakness in the implementation).

Shachar Shemesh • March 18, 2007 5:38 AM

@Anonymous,

You are missing something very basic here, I think.

If you have a 128 bit number for which you need to generate a 384 bit signature in order to generate (or verify), then it is easier to keep searching for keys in the 128bit space than to try and hack the 384bit space.

In other words, a 384 bit signature truncated to 128 bits is still only 128 bits strong, at best.

Shachar

supersaurus • March 19, 2007 4:40 PM

I don’t know about vista, but M$ has had magic keys in the past, for example Visual Studio at one time installed if you typed in something simple like all ones for the key (I forget if it was literally ones, but it was all one char). I did this myself so I know it worked, we had a license for the seats, but I needed an install and didn’t have the proper key. this has been a while though, maybe they learned something since then.

billy • March 21, 2007 8:42 AM

Microsoft probably has more to gain than to lose by using a fairly easily pirated operating system. If those who are smart enough to obtain a copy and a key can install it on their computers, that will prevent that certain segment of the population from turning to alternatives. With a more locked down piece of software, more would turn away from windows, more hardware and software support would be developed for alternatives and the general population would probably latch onto a cheap (or free?) and powerful OS. The lax security insures that Microsoft maintains a stranglehold on the personal computer hardware and software industry. So, even if this is a hoax, I wouldn’t put it past them to do this, maybe even on purpose?

Shankey • April 18, 2007 12:37 PM

Ive installed an RC2 version of vista and I tried to download a crack for it.It turned out to be a virus and it removed my 30 days trial period.So I formatted the whole drive and tried to reinstall it but somehow vista was able to know that and said my trial period was already over.Any suggessions???

H3R3T3K • November 15, 2007 1:01 AM

@ shankey..

your BIOS is prolly storing info

search for vista & SLIC tables

try a BIOS emulator 😀

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.