Virtus Designs Malware Controversy

Virtus Designs Malware

Here is one definition of Malware. It is, as of this writing, the first paragraph in an article entitled 'Malware' at Wikipedia:

"Malware, short for malicious software, is software designed to secretly access a computer system without the owner's informed consent. The expression is a general term used by computer professionals to mean a variety of forms of hostile, intrusive, or annoying software or program code. "

The invasive junk attempting to insinuate itself deeper into my system from Virtus Designs is, by any reasonable definition of the term, Malware. Certainly, for my purposes it is and since I have been a paid computer professional since 1982, I feel qualified to make that statement. There is no question in my mind that it is Malware with a capital 'M'. There is no ambiguity here, no gray area. The fact that the perpetrator of this deed lacks a moral compass and a sense of shame for his misdeeds does not make it any better. In fact, it makes it worse. It means that, unless he is stopped, he will do it again. As far as I know, he *is* doing it still, even as you read this. Worse still, since he feels he is firmly in the camp with the good guys, and has strayed this far for money, chances are very good he will stray even further afield until finally, he is forcibly removed from cyberspace.

I had the misfortune to install a Firefox Theme called 'Aero Fox'. It was probably last year, I don't recall. I did it, as I do from time to time, just to take a look at the theme. Seeing how it is a Theme, not even the active one, came directly from Mozilla and did nothing in particular beyond dress up the Browser when the active theme, I had no reason to expect it was not benign. I have, until now, typically left such things installed in case I wish to refer back to them. A theme has no legitimate reason to do anything at all if it is not the active theme. If it is the active theme, it has the right to (temporarily!) replace icons and backgrounds and stuff like that within the browser.

Yesterday, I started Firefox to take a look at something and as happens now just about every single time I start Firefox, it stopped loading so it could install a pile of updates. It is a story for another day, but the constant updating of Windows, Java, Firefox and the like is getting so irritating I am shifting some stuff to Linux, do nothing with Java unless forced and have taken to using Google's Chrome browser most of the time.

To my horror, one of the things, while 'updating itself', began to veer off course and installed another plug-in -- malware that threatened to and I quote:

'...offer you an opportunity to try out Bing by setting it as your default search."

The window is still open now as I figure out how to determine precisely the extent of the invasion, the particular vector(s) that got it this far and how to eradicate it and its criminal buddies from my system.

Should you get here as a result of a search, be assured that you are not alone in your surprise and yes, indeed, it is an untoward invasion of your machine by someone who has put the needs of the few (themselves) ahead of the needs of the many (you and I). It is wrongful behavior and nothing will put a good face on that.

I will let you judge for yourself what the perpetrators of this offense have to say for themselves. Here they are 'clarifying' for your edification why this outrageous breach of trust is just dandy and you can expect them to carry on doing that and (if this is an indication) more until somebody stops them:

http://www.virtusdesigns.com/?p=1816&cpage=1

Archived copy: [http://web.archive.org/web/20100822055538/http://www.virtusdesigns.com/?p=1816]

Later in my (long) piece here is the harsh comment that I submitted to that page. A part of my ire is because this came at a bad time and interrupted the flow of my work while I investigated the extent to which this Malware had compromised my system. However, a part of my ire is simply disgust at a shameful practice and the fact that the people doing it are not only unrepentant; they are still doing it. They will continue to do so until they are stopped.

If my comment appears on their page in the next few days, I will update this to express that. At least it will lend some credence to the idea that they are honest enough to disclose that some people disagree with them. My suspicion is that they won't allow my comment to remain there. If you do not see a correction here to say they have posted the comment it means they did not. In the fullness of time, this blog entry will be indexed by Google; they will see it and may make a post-facto alteration to include the comment. However, it will be suspect since they did not post it until they were apprised of the fact that it existed on the Internet already.

If my comment does not appear at that site, consider this: Some of the comments are negative and the moderator of that comment area (and, it seems, one of the 'perps' in this shameful affair) alludes to comments elsewhere that are more negative. If you do not see my comment, what it means is that they don't show you all the negative comments. Therefore, whatever they *do* show you is a dishonest reflection of the true feedback they are getting and you should not trust what they say at all. Certainly, you can be forgiven for not trusting them. If you are reading this, chances are good they have already violated your trust at least once as far as you know.

Before I put my comment text in here, I would like to address the entirely self-serving and patently dishonest commentary that one of the perps has put at the beginning of that page.

Bear in mind, what that page *should* be is an ABJECT AND GROVELLING APOLOGY and instructions for minimizing the injury they have done to your system and the time they have wasted. Instead, what you get is gems like this:

"There seems to be a misunderstanding out there due to the purposeful spreading of misinformation by people who want to do nothing other than cause problems and attack AMO developers." -- Posted by 'Brett' at VirtusDesigns.com

I can assure you (better, you can just look for me elsewhere around the net and assure yourself) that I had no particular axe to grind against 'AMO developers'. I don't even know *what* an AMO developer is, let alone who. I sure do not have an ongoing relationship with them and as soon as I am done this and have cleaned their malware off of my systems I hope never to hear from them again.

Our man 'Brett' goes on to say:

"One of the common things I read by people who leave negative reviews is that I hijack people's browsers by forcing them to install an Ask.com toolbar. Every bit of that accusation is false."

Contrary to what Brett would have you believe, most of that accusation is true and arguably, at least in spirit, every bit of it is true. Brett can say what he will. His assertion that those people are wrong does not make it so. He is the one who is wrong and dramatically so.

Brett then proceeds to systematically pile one whopper on top of another by way of demonstrating how each of the accusations is false.

He says:

"1. Nothing is hijacked. There is no adware or malware installed on a user's system. The only thing that the bundled Ask extension does is add a custom search plugin in the search window of the browser toolbar. "

I am not sure if I have to rebut that point since it appears to rebut itself. It starts out saying that their software does NOTHING and then proceeds to 'prove' it by telling you what it DOES. Something is most assuredly hijacked or you would not be reading either this posting or his. His post would have no reason to exist since its entire purpose is to address the aftermath of his HIJACKING people's browsers. He tells you that it installs NOTHING and proves his point by telling you that all it DOES 'add' is a custom search plug-in in the [...blah blah blah]. It is a fine and effectively irrelevant distinction between 'adding' and installing in this case and it is also quite misleading and dishonest because it attempts to do more than just *ADD* their search engine plug-in, it attempts to REPLACE your default search engine with theirs. You can rest assured that my inconvenience by having to deal with a wrecked default search is the expense I PAY so that THEY can get advertising dollars (which are swiped from Google and, I suppose, split with Bing). It is entirely beside the point what the precise arrangement is. Somebody gains at the expense of me and my legitimate search provider. They take something FROM me and they give it TO someone else without my knowledge or permission. Yeah Brett, something *IS* most assuredly hijacked and since you presumably had your arms in this up to your elbows you *know* it was.

He then offers:

"2. Nothing is forced on a user. When installing the theme on AMO, a user must accept the EULA by clicking on the accept button. When installation begins, a popup window displays asking the user if they would like to proceed with the addition of the Ask.com search plug-in. Nobody is required to use the search and you can switch back anytime. On my website, you must accept the EULA but there is no opt-in popup so the user has total control of what is being installed on their system."

Good lord. I can assure you that the very existence of this software on my system was accomplished by what is effectively force. I at no point ever agreed in any way to such an invasion and I would never knowingly do such a thing. The fact that I am not the only one to complain is proof enough they did this without permission. Beyond what threshold against someone's will do we start calling it force. No means no. Failing to say no when you are not even asked is not equivalent in any way to saying 'yes'. Like the first point he made, this one essentially negates itself. After saying 'nothing is forced...' he then goes on to say "a user MUST ACCEPT THE EULA..." (emphasis mine). I invite the reader to pause for a moment and familiarize themselves with the notion of a 'contract of adhesion'. If you think there ought to be a law, there is. A contract such as the EULA in question is not enforceable. It is not a meaningful (or even real) agreement between two equal parties. I will bet if you asked a thousand people to tell you what was in the contract they had clicked through, not even a single one would be able to tell you what was in that contract. When somebody shoves a boiler-plate agreement drafted by them to their advantage in your face en-passant all that you agree to is something vaguely 'reasonable'. Any other provision is meaningless. Installing unrelated software a year hence under the guise of an upgrade is NOT reasonable. It is not even close.

With respect to 'total control', it is to laugh. I would NEVER, not in a million years, have ever voluntarily put such an invasive thing on my computer. I had no control at all. Our friend Brett and his co-conspirators added a chunk of malware post-facto to my machine and even as I write this the pop up inviting me to screw-up my browser is sitting front and center on my screen. This is not control at all, let alone 'total control' and they know it.

Brett continues with his third point:

"3. There is no toolbar installed. All that is added is the simple plugin making Ask.com a search option. Ask is set as the default search instead of Google. This is my main source of revenue to support the continued development of my current themes and the many more I have planned."

Here we get to the crux of the matter. Whilst attempting unconvincingly to misdirect attention away from his invasion of your machine to a discussion of the *style* of the invasion, he slips in the fact that he is ripping off Google by stealing, against both Google's wishes and my wishes traffic from Google to create revenue for someone else who gives him a cut of the stolen revenue.

I do not even want Ask.com as an *option*, let alone have it hijack my main search provider. If who you used for search was not important, Google would not be worth $200 Billion Dollars. Ask.com, by the way, is not even really in the search business anymore. Despite the conversation about hijacking for Ask.com, the current hijacking is on behalf of Bing now. If either Ask.com or Bing were preferable to anyone they would not have to rely on Malware to get on to our machines.

Finally, Brett closes with this:

"Fortunately, I have great users overall and the vast majority of you are supportive, kind, and very encouraging and I appreciate that tremendously. Unfortunately, however, there is a tiny, yet very loud, minority out there that feels it is their purpose in life to attack, smear, and call names for no other reason than to cause problems. I thank you for your continued support. If you do not want install the extension, you can simply add the search plugin by clicking here."

That last sentence gives me pause. I think he closed this shameless attempt at rationalization by trying again to fool me into screwing up my browser. Mercifully, the link appears to be incorrect.

I doubt those allegedly supportive users would be nearly so kind if they knew what Brett was doing to them. The 'tiny, yet very loud minority' includes people like me whose opinion in these matters has been formed over decades in cyberspace. Yes -- I started using computers in 1976 and I registered my first '.com' name in 1988. The 'minority' opinion of his users happens to represent the *majority* opinion of people who know anything about this stuff. This stuff, as it manifests on my machine is malware and malware is entirely a bad thing. Likely most people have been under attack by malware and to the extent that they know what is happening to them, they are not only against it, they are vehemently against it. What Brett has done on my machine is borderline illegal and the penalties are severe if he is charged. If I see he has attempted to worm his way back on to my workstation, I will pursue sanctions. So should you.

With respect to his notion that people like me feel we have a "purpose in life to attack, smear, and call names for no other reason than to cause problems." That is some sort of sick joke. I want him to stop stealthily worming his way on to people's machines and hijacking their browsers and search providers. You can bet I want to cause problems with this guy. I want to shut down his quasi-criminal enterprise. In my opinion, the net effect of shutting this guy down REMOVES problems. Specifically, if I get my way, his Malware will stop infecting my machine and the machines of others.

Here, in all its gory glory is the comment they appear to be too afraid to display:

-------
I got here by doing a search for ‘virtus’ and ‘malware’.

I am the only one who ever uses this particular workstation and my default answer to anything that wants to install itself is ‘NO’. Anything that got as close as this did to altering the configuration of my system did so entirely without my permission and against my wishes.
There is no way that anything like this should ever, ever, EVER, EVER, EVER be popping up on my machine.

You may be of the opinion that it is OK to start installing software on someone’s machine as long as you interrupt their work by popping up and asking them if it is OK to install the software. That is fine for you, and you are welcome to deal in this junk as you wish. It is NOT OK AT ALL to start installing your software on MY WORKSTATION. I had to do a double-take while writing this to confirm that you are attempting the highly disruptive move of replacing my default search provider. I am still puzzling over this. It is shockingly unethical behavior on your part.

This is just Malware, plain and simple. I did not ask for it to come on to my machine and it is attempting to sneak its way deeper into my system by pretending to ask my permission. You have no valid reason to expect you have permission to even install something capable of asking the question, let alone trying to fool me into doing it. By what appears to be your reasoning as long as you can fool somebody into installing your software on their machine, their time, attention and resources are fair game and you may take them as you see fit. Wrong. My time, attention and computing resources are MINE and mine alone, not yours. You have not even a whisper of permission to do anything of the sort, let alone stealth your way into my machine with a ’sleeper’ Trojan in the guise of a browser plug-in that nobody would be expecting to start installing unrelated software whilst pretending to update itself.

Whatever I did with respect to your stuff, I did in a good faith belief that it did what it said it did and did not include any other unexpected (and thereby noxious) behavior. What you have done is in extremely bad faith. That you have trouble seeing it, even when it is pointed out to you shows that you can be expected to be even worse in the future.
I am going to attempt to track down and gut whatever the heck it is you have installed on my machine and hope that I have seen the end of it.

The next time you EVER have to dismiss an annoying pop-up or look carefully to catch some crap like this trying to dig itself into YOUR system, think back on this note and try to imagine all the misery you have created with this obnoxious breach of trust.

Rather than your mealy-mouthed attempt to rationalize and defend behavior that is well over the line and beyond defense, you owe me and anyone else who has had the misfortune to have your malware visited upon them a BIG FAT APOLOGY. You also owe everyone a promise that you will cease and desist and do whatever you can to repair the damage already done. Naturally, you have already written a cheque you cannot honor. You do not have the resources to return to me and everyone else the time, attention and peace of mind you have misappropriated.
Anyone who sees this and wishes to take more aggressive action may feel free to track me down. I have used my real name and I’m easy to find. If this person is still perpetrating this nonsense on people, I will be happy to support you if you pursue this in the courts.

If you can’t use software development tools responsibly, then don’t use them at all.

Do you want the following program to make changes to this computer

Similar to an item mentioned in another article, this is yet another annoying message from Windows:

Do you want to allow the following program to make changes to this computer?

Program name: Microsoft Windows
Verified publisher: Microsoft Corporation
File origin: Hard drive on this computer
CLSID: {BDB57FF2-79B9-4205-9447-F5FE85F37312}

[Yes][No]

The above is what you get. Who knows what it's about? Apparently, it is some program *using* Microsoft Windows to do something, but what? Unfortunately, Windows, which in my case was being hijacked by a malicious site won't tell you. You just have to take your chances.

In my case, the thing causing this was a 'pop-under' window attempting to serve up an advertisement for Match.com through a known adver-spamming outfit at cdn.optmd.com using a tortured series of obscured calls going from one server to another, planting web 'bugs', etc. This is not even close to anything legitimate which I did or would agree to start loading software on to my machine.

It should be against the law for these firms to do this sort of thing. In fact, it may already be against the law. Meantime, it flies under the radar by taking advantage of what I could only describe as a security hole in Microsoft Windows. It was *NOT* Microsoft or its operating system Windows that was actually originating this attempt to misuse the resources of my system. It was a source I would *NEVER, NOT EVER* trust. In fact, the domain 'optmd.com' is usually redirected to 127.0.0.1 (the address of your local machine) on most of my machines to prevent them from ever loading any pages on my system. The one particular machine had an out of date hosts file.

What sort of malicious stuff was it trying to do? Well, for one thing, it was somehow managing to circumvent security on my system by forcing a 'popunder' window to load. My systems usually employ a variety of methods to stop that from happening. These guys are constantly looking for cheats to bypass security on the systems of their victims. For another, it surely was attempting to plant tracking 'bugs' on my machine and as near as I can tell it was successful with this. Worse than those, though, is the fact that it attempted to hijack my CPU, my bandwidth and my attention.

This is SPAM, plain and simple. It costs next to nothing for the 'perps' to deliver that stuff on to my machine and costs me dearly to be infected by it.

The bottom line is that if you get that message you should almost certainly say 'NO' and may want to investigate which hostile site is attempting to misuse your trust.

Trueswitch

Trueswitch had an ugly failure while I was away from my desk. I have no idea what the fix might be, but this is just to let you know that you are not alone. It is no problem for me. I have decided not to go through with the transfer. Your mileage may vary ...

HTTP Status 500 -

---

type Exception report

message

description The server encountered an internal error () that prevented it from fulfilling this request.

exception

java.lang.NullPointerException  esaya.web.Controller.doPost(Controller.java:90)  esaya.web.Controller.doGet(Controller.java:175)  javax.servlet.http.HttpServlet.service(HttpServlet.java:743)  javax.servlet.http.HttpServlet.service(HttpServlet.java:856) 

note The full stack trace of the root cause is available in the Tomcat logs.

---

Apache Tomcat/5.0.18

Image Composer Black Screen

Image Composer Black Screen Fix

Occasionally, Microsoft Image Composer 1.5 will blow up on you and when you start it again, you are presented with a black screen.

There does not seem to be either a way to fix this from within Image Composer and I was not able to find anything anywhere except for the question as to how to fix it.

You can try to recover by using the registry and editing values back to something sane. However, there are a lot of them. To return it back to the way it was at installation, all you have to do is exit Image Composer and [NOTE: ALL NORMAL CAVEATS APPLY. IT CAN BE DANGEROUS MESSING WITH THE REGISTRY] delete this key:


HKEY_CURRENT_USER\Software\Microsoft\Microsoft Image Composer\

Re-Run Image Composer. It should now be fixed.

Happy belated 25th GNU!

The GNU concept was announced more than a quarter of a century ago on a mailing list by Richard Stallman. The date was Sept. 27. I am a few weeks late mentioning it.

In fairness, the founding of the Free Software Foundation did not happen until a couple of years later and I would expect that to be a bigger celebration. We shall see.

I wrote an article about Richard Stallman a number of years ago where I said:

"Here is what Richard has done for us all: He has created and protected the 'free software' movement. This has been a difficult task against great odds and he has taken a lot of unwarranted personal grief over the years."

True Liberty in all of its various forms still gets a bad rap. It was ever thus.

I am gratified that a true champion of Freedom like Richard Stallman and people like Lawrence Lessig are still around. They have taken outrageous attacks over the years, but I think that might finally be starting to settle down for them. Of course, one worries that this might be preamble to attempting to co-opt them. Lessig appeared to cave a little on DRM, but I can't see Richard ever being anything but his own man.

Congratulations to the FSF and to all of us. It is a milestone worth celebrating.

Original DataHush Encryption Strategies

Description

This section discusses some of the encryption strategies originally employed by DataHush. Some novel strategies remain unpublished.

In general, an encryption’s strength relies upon the following:

- Encryption algorithm – the ‘formula’ used to encrypt

- Length of key

- Processing power/time

We have the following techniques that we feel make it possible to strongly secure a transmission:

Dual encryption technique and compression

Two strong encryptions are used. One method is based on a known published method, the other proprietary. A third layer is related in that the stream is compressed according to one of a battery of techniques. Compression is a form of encoding that effectively strengthens the encryption, since even if the decompression technique is known, it increases the burden of overhead required to break the code.

Physical possession

It is possible to require a proprietary hardware device. This would require physical possession of the hardware device to make a transmission (the software would not work without it).

Challenge-response

The system can be configured to require a challenge-response from either party to a transmission. This involves in addition a ‘two-way’ lock box of data that has never been transmitted, as well as a real-time requirement by a spoofing machine that will likely exceed the ability of any known machine.

Processor dependent key-scaling

This is an aid to making the encryption future-proof. The length of the key and the intensity of the calculations required are negotiated by either end of the system based on the CPU cycles available at either end. Ten years from now, the same software will require much greater capacity, even of a trusted party to decrypt. This means that if the processing power of a common workstation such as a PC is 4 orders of magnitude below that of the largest known machine, and it can force a real-time response that exceeds the capability of the larger machine, then as long as the differential in capacity holds true, the encryption can never be broken by superior processing power.

Two-way lock box

A large body of data used only as additional encryption will be transmitted by a trusted means to both parties. This store of data will be used by both parties as a method of lengthening the encryption key. Without access to this store, an intercepting party is forced to crack the encryption using the entire key.

Non-deterministic decryption algorithm

This technique is used to ‘up the ante’ in terms of required processing power. Not all of the information required to decrypt will be available to the receiving party. This can impose an arbitrary time of decryption, even if keys are intercepted. This will require the decryption process to actually guess part of the key. Sometimes, a packet will fail to transmit end to end, since the receiving party simply does not have the resources to decrypt. This introduces a further variable of noise that will confound an intruder, but be scaled within the limits of both ends of the trusted parties.

Decoying and nested decoys

Not all of the data in our secured transmissions will be data. Some of it will be noise, and the amount will vary from transmission to transmission. In addition, mock data that appears to be encrypted by simpler methods will be included in the transmission. This will occupy the resources of an intruder that might otherwise be engaged in breaking the true transmission. Decoying is nested at each level of the encryption process, requiring an intruder to follow many blind alleys at each level.

Public Key Encryption

Explaining Public Key Encryption

Many years ago, as a part of my company's research, I built a tool called 'DataHush'. It was a drag and drop encryption/decryption program. The tool, as I built it for original demonstration, did not include standard Public Key encryption. Patents encumbered well-known systems and I have always shied away from patents.

Despite not supporting it in the original tool, the design demanded Public Key encryption and supporting Infrastructure (PKI). It also had facilities that I felt improved upon the strength of PKI as generally practiced. I felt it necessary to explain to business partners just exactly HOW Public Key encryption worked and how, for banking and mission critical information PKI alone was (potentially) flawed.

I am currently working on a project where I have been asked to deliver some tools and protocols for an advanced secure infrastructure. First, though, it requires PKI and most people have such a hard time with the basics they have no hope of understanding the finer points of what my company has done to improve upon current PKI.

When I originally published information on our old system, I put together as simple an explanation as I could for PKI. This is still not entirely accessible to people without at least High School Math from the latter years. However, it does convey a concrete interpretation that should be meaningful to more people than typical discussions of this subject. So ... I dug up my old explanation (from the WayBack machine, bless them), formatted it for this environment and ... Here it is.

Here’s How it works

Public key encryption is based on a mathematical relationship between prime numbers, and the (presumed) computational difficulty of doing particular mathematical operations on large numbers( such as factoring (RSA) or discrete log (ElGamal)).

Here is an example of a particular public key system (RSA) whose strength depends upon the difficulty of factoring large numbers:

To start, we need to pick two prime numbers. In practice, these are very large multi-digit numbers. Here, we use small values to make it easier to understand.

Chose p1 and p2, say 3 and 11. We obtain an exponent value from the following equation:

(p1-1) * (p2-1) + 1 = x


For our numbers, this works out to be:

(3-1) * (11-1) + 1

= 2 * 10 + 1

and

x = 21


Now, multiply p1 by p2 to obtain a ‘modulus’ value (m). For our numbers, this equals:

3 * 11

and

m = 33


For any value (v) from 0 to (m-1), there is an equation that holds true:

v = vx mod m


Now we factor the exponent value such that factor 1 (f1) multiplied by factor 2 (f2) is equal to the exponent value. In our case:

f1 * f2 = x


3 * 7 = 21


So:

f1 = 3 and f2 = 7


One of the factors is chosen as our public key, the other our private key. We make life easier for the public by choosing the smaller of the two.

To encrypt a message, someone takes the (known) public key and uses that to encrypt the message using the following formula:

Encrypted = Plain ^ f1 mod m


For our example, let’s say the letter G is being encoded and (to make the math easier) it’s the 7th letter in our alphabet. We assign it a value of 7. So:

Encrypted = 7^3 mod 33


= 13

To decrypt, you use the formula ‘in reverse’:

Decrypted = Encrypted ^ f2 mod 33


In our case, this yields:

Decrypted = 13 ^ 7 mod 33


= 7


We have our original message back. Math weenies go nuts for this stuff!

It is important to understand, math aside, that the encryption is not symmetrical. This gives it important properties, which we exploit.

1) You can only read a message encrypted with one key if you hold the other key.

2) Anybody can send you a secure message by encrypting with your public key.

3) If we can decrypt with the public key, the sender encrypted with the private one.

It is essentially (with some optimizations) item three above that constitutes digital 'signing'. If we know you are the owner of a given public key and we can prove that a message decrypts with that public key and your private key is only under your control, then you must have 'signed' that message.

Here’s How it Fails

Public key encryption has a point of weakness in that two vital pieces of information are known by the attacker - the public key and the algorithm chosen for encryption. Although no civilian scientist has published an elegant method of attacking the algorithm mathematically, it has not been proved invulnerable to attack. It may already be the case that military or government scientists have discovered a computationally simple way of cracking this method of encryption. It is certainly a possibility. Meantime, a modified brute force method leaves public key encryption highly suspect. Here’s why:

Although it is computationally very difficult to examine and try all of the prime numbers in the ‘open’ range, in practice the method of generating keys is such that once one of the keys is chosen, the other may fall within a range that can be narrowed down using the public key. Once you have chosen a limited selection of numbers to try, you simply run the whole set through the known algorithm until you reveal the private key. Once a private key has been discovered, it is useless and all messages encoded with that key are open to examination.