4 ms·
Petya ransomware is known in the infosec community to be specially simple to solve because instead of using an AES cypher it applies XOR to the MBR/GPT and MFT
by dr_zoidberg 11y ago
Petya ransomware is known in the infosec community to be specially simple to solve because instead of using an AES cypher it applies XOR to the MBR/GPT and MFT of the filesystem (cyphering the MFT was the new method here).
If you know what a filesystem begins with and other common filesystem signatures (NTFS FILE records, for example), then you can derive the XOR key used and reconstruct everything without paying the 0.99 bitoins they demand.
Even then, if it just affected the MFT, you can do file carving and recover most of the files (there are always those pesky important files that will rebel and be fragmented or disappear completely). This last part is speculation of mine, I haven't been able to work on a Petya-infected system yet.
- 21 11y agoOne thing future malware might do is to encrypt the drive using the BitLocker API/command line, since BitLocker already knows how to do this reliable and with minimal system impact. Or change the key if it's already encrypted.
- dr_zoidberg 11y agoDon't know if that's possible, I haven't worked in the details of BitLocker, but... It derives the key from a secret that is stored in hardware (a trusted key platform module I think it's called) or somehow related to the user (MS account? password?), so I don't think it'd be posible to encrpyt something through BitLocker that can't be unlocked by the legitimate user. Then again, I'm a bit sloppy on BitLocker mechanisms.