Manual Decryption of Hybrid Backup Sync file

[skocharian]

Hello Mikiya,

So thank you for writing this tool! Quick question on the GUI version. I specify the source and destination paths, but I cant see where to put in a password or to kick off the decryption.

This is what it looks like for me:

Capture.JPG

[Mikiya]

Hi
Create an empty file named "resizeEnable" where your jar is located or simply start it with "r" option : "java -jar GUI_JAR_PATH r". You should be able to resize the window, it can happen when Java cannot properly detects your screen size or your resolution is not commun.

[skocharian]

thank you so much.

[netznutzer]

Hello,

I tried to decrypt some files I downloaded from my AWS S3 and previously uploaded there with Hybrid Backup Sync and its client side encryption using Hybrid backup Sync Decipher 1.5.1 but so far unsuccessful.

When I use the GUI I get the error message "All files fail to deciphered" and the report says the following:

Files in success for decipher operations in Hybrid Backup Sync utility :


----------------

Files in error for decipher operations in Hybrid Backup Sync utility :

/Users/netznutzer/QNAP/song.mp3

When I try using the Terminal after entering the password it says "The file song.mp3 is not a QNAP-ciphered file.", however it absolutely is one.

I only recently installed Hybrid Backup Sync on my QNAP and so far just uploaded a few files with it for testing. I'd like to use it in the future for backing up all my files but it must be with encryption and I would prefer having a way to still decrypt single files if I should need just one from the cloud. The version of Hybrid Backup Sync is 2.1.190329, maybe did some changes happen to the way it encrypts files?

Just to be sure I am not doing something wrong, I create a job to backup a certain folder to my AWS S3 and while doing it under settings I can set a password for the client side encryption which is all I did (didn't find any any advanced setting for example about which cipher or key length to use). Also I am absolutely sure I didn't enter a wrong password, I tested this now many times and uploaded more than one file. The encryption at least seems to work, I can't open them anymore when I download them from my AWS S3. Restoring them in Hybrid Backup Sync also works, just would be great if I could do that on my computer too.

Thanks in advance

[Mikiya]

Hello
My tool is required only for "synchonization mode" to OneDrive, Dropbox, ect ...
When you setup a backup task in HBS to AWS, you use the "backup mode".
When you use this mode, you should be able to use standard "openssl" commands to decrypt your files (like first message of this topic).
Tell me if it's ok with this command.

[netznutzer]

Thanks a lot, the command in the first post worked, glad to know I have a method this way to decrypt single files without the NAS if I should need to
By the way, is there also a GUI available to do these things with OpenSSL, in my case for macOS?

[Mikiya]

I'm currently working on my tool to be able to decipher files in "backup mode" too. As soon as i can get a beta version ready, i will update this topic

[Mikiya]

Hi
I have a private beta version with OpenSSL support for "backup mode" in HBS. Now my tool should support encryption (with or without compression enabled) in backup tasks. How can i sent you a test version before a public release to be sure ?
Thanks !

[Mikiya]

Nevermind, the version is now public https://github.com/Mikiya83/hbs_decipher/releases , if anyone can test with encrypted files from a "Backup task"(i've done some tests with and without compression, it seems ok but i need more testing).
Thanks

[rastabore]

It would be nice to port the command line utility to another language (c?,#c) that makes use of the openssl dlls on windows, because most people there don't have the JRE installed nor are inclined to do so. Browsing the java code (I'm not a developer) it seems not too difficult if you know how to handle the QNAP modified header for synced & encypted files.

[dobri]

I just spend a several hours trying the manually decryption of backup/opensssl format files. Mikiya's tool works fine, but the OpenSSL doesn't.

What happened is openssl switched the default digest and no longer uses MD5 by default as of version 1.1. My QNAP still shows 1.0.2 which is 20 months old.... But on a newer platform you will find more recent version of OpenSSL, and that behaves differently.

Conclusion:
1. If you are using openssl, add the "-md MD5" to the command. That will work with both the old and the new openssl.
2. Everyone should expect that at some point QNAP will switch their program and stop using MD5. If they don't - we all have security issue on our hands. When they do - well, the manual decoding scripts and Mikiya's tool will have a new format to handle.

[Mikiya]

Thanks for the feedbacks and investigation !

If a new version of my tool is needed because some option change, it's not a big issue, i can patch it Actually, OpenSSL mode is stored in OPENSSL_DIGEST_ALGO variable so it's really easy to change... even if it's not so simple, i should ensure my tool could still handle old files in MD5 mode... (and it's open source if the worst happen )

[dguerri]

If you are reading this in 2021, and you want a pure openssl cli solution, have a look here: https://gist.github.com/dguerri/92d9330 ... ddd4e00f00

It only works with files encrypted with Version 2 of the algorithm.

Hope it helps.

[Mikiya]

Thanks it's a good news ! Well done