4 ms·

What's the shelf-life of one of these ransomware fix utilities? I'd be inclined to assume that if they operate by exploiting a flaw in the ransomware, the ranso

What's the shelf-life of one of these ransomware fix utilities? I'd be inclined to assume that if they operate by exploiting a flaw in the ransomware, the ransomware author can simply "fix" the bug and the utility no longer works.

taylorbuley 11y ago
As a security reporter I perceived a large technical gap between the developer of warez and most users, who tend to pay a one time or ongoing license for use of some tool. While a developer of illicit tools may adjust in a future release, typically the user does not have capabilities to patch their own tooling.
- bediger4000 11y ago
  Interesting assertion. What have you seen to make you think this? Also, does it apply to the PHP/Perl world of malware, the kind that gets installed on cracked, old and weak WordPress sites? There's 20 variations of "Web Shell by oRb" floating around, for example, and many, many versions of Perl IRC bots, for example.
tux3 11y ago
Here the crypto used by the ransomware seems to be thoroughly and systematically broken, so while it's certainly possible that a stronger variant will appear, I have my doubts on the author's capacity to do much "better" any time soon. I'm far from being a cryptographer, but at a glance it looks so weak I have to wonder if it's deliberate.
- kobayashi 11y ago
  >at a glance it looks so weak I have to wonder if it's deliberate. Any suppositions as to why it would be deliberate?
  - djsumdog 11y ago
    Maybe the person who posted the exploit/solution was the person who created the ransomware? That way they get BTC from people who pay and donations from people who wait? /krazyconspiracy :-P
    - atemerev 11y ago
      If I was an aspiring ransomware writer, I'd extract _a lot_ of useful ideas from this thread. :P
  - petetnt 11y ago
    Maybe not deliberate, but most likely optimizing encrypting speed over stronger encryption. Better for hit and runs I guess.
  - tux3 11y ago
    Well, I can't say that it's deliberate, but it's definitely some "interesting" choices. A reasonable Salsa20/20 implementation on a modest processor encrypts on the order of 400MiB/s [0][1]. So that the author went to the trouble of halving the number of rounds and changing the word-size when there are perfectly good and plenty fast off-the-shelf Salsa implementations strikes me as rather strange. Surely this is not the bottleneck on most employee's machines. And then there's the apparently tiny keyspace used. You could argue that this makes the key more "user-friendly" (!), but just a hex representation of a random 256bit key would seem much more natural, and the poor targets are hardly in a position to complain. [0] https://www.cryptopp.com/benchmarks.html https://www.cryptopp.com/benchmarks.html [1] https://cr.yp.to/snuffle.html https://cr.yp.to/snuffle.html
    - contravariant 11y ago
      Maybe they wanted to keep CPU usage low? Although disk usage would be noticeable as well (usually).
    - sleepychu 11y ago
      Actually customer service is very important to these operations. They have to create trust that paying will relieve your machine of their infliction.
- rdtsc 11y ago
  Presumably they have enough financial resources at the moment, they don't have to do it themselves. They can pay someone to do it.
  - stcredzero 11y ago
    Most anyone able to charge market rates might be more motivated to reveal they've been contracted to do this than to actually do that. Someone who has a hard time getting market rates might not be as qualified to fix the software as they think they are.
    - rdtsc 11y ago
      There are places in the world were good computer / science education doesn't necessarily mean being able to demand "market rates" comparable to the West. I can see some programmer n Russia or Romania being tempted by a side-deal like this. Especially if presented with a Western "market rate".
      - Caprinicus 11y ago
        Many programmers in Russia and some eastern european countries probably wouldn't even see that as a "side deal"
        rdtsc 11y ago
        I haven't been back there in many years now, and tried to give the benefit of the doubt ;-)
- Godel_unicode 11y ago
  People who are cryptographers have a tough time writing secure implementations the first time around, is it really surprising that amateurs do?
tomjen3 11y ago
In many cases (don't know about this one) they come after the network has been shot down.
JamesUtah07 11y ago
I'm curious as to also why they just don't go for full Salsa20 and do 32-bit words instead, seems like a logical quick fix upgrade that might break the decryption.
- baby 11y ago
  Maybe some machine they are targeting (hospitals?) only work with 16-bit words.

taylorbuley 11y ago

As a security reporter I perceived a large technical gap between the developer of warez and most users, who tend to pay a one time or ongoing license for use of some tool. While a developer of illicit tools may adjust in a future release, typically the user does not have capabilities to patch their own tooling.

bediger4000 11y ago
Interesting assertion. What have you seen to make you think this? Also, does it apply to the PHP/Perl world of malware, the kind that gets installed on cracked, old and weak WordPress sites? There's 20 variations of "Web Shell by oRb" floating around, for example, and many, many versions of Perl IRC bots, for example.

tux3 11y ago

Here the crypto used by the ransomware seems to be thoroughly and systematically broken, so while it's certainly possible that a stronger variant will appear, I have my doubts on the author's capacity to do much "better" any time soon. I'm far from being a cryptographer, but at a glance it looks so weak I have to wonder if it's deliberate.

kobayashi 11y ago
>at a glance it looks so weak I have to wonder if it's deliberate. Any suppositions as to why it would be deliberate?
- djsumdog 11y ago
  Maybe the person who posted the exploit/solution was the person who created the ransomware? That way they get BTC from people who pay and donations from people who wait? /krazyconspiracy :-P
  - atemerev 11y ago
    If I was an aspiring ransomware writer, I'd extract _a lot_ of useful ideas from this thread. :P
- petetnt 11y ago
  Maybe not deliberate, but most likely optimizing encrypting speed over stronger encryption. Better for hit and runs I guess.
- tux3 11y ago
  Well, I can't say that it's deliberate, but it's definitely some "interesting" choices. A reasonable Salsa20/20 implementation on a modest processor encrypts on the order of 400MiB/s [0][1]. So that the author went to the trouble of halving the number of rounds and changing the word-size when there are perfectly good and plenty fast off-the-shelf Salsa implementations strikes me as rather strange. Surely this is not the bottleneck on most employee's machines. And then there's the apparently tiny keyspace used. You could argue that this makes the key more "user-friendly" (!), but just a hex representation of a random 256bit key would seem much more natural, and the poor targets are hardly in a position to complain. [0] https://www.cryptopp.com/benchmarks.html https://www.cryptopp.com/benchmarks.html [1] https://cr.yp.to/snuffle.html https://cr.yp.to/snuffle.html
  - contravariant 11y ago
    Maybe they wanted to keep CPU usage low? Although disk usage would be noticeable as well (usually).
  - sleepychu 11y ago
    Actually customer service is very important to these operations. They have to create trust that paying will relieve your machine of their infliction.
rdtsc 11y ago
Presumably they have enough financial resources at the moment, they don't have to do it themselves. They can pay someone to do it.
- stcredzero 11y ago
  Most anyone able to charge market rates might be more motivated to reveal they've been contracted to do this than to actually do that. Someone who has a hard time getting market rates might not be as qualified to fix the software as they think they are.
  - rdtsc 11y ago
    There are places in the world were good computer / science education doesn't necessarily mean being able to demand "market rates" comparable to the West. I can see some programmer n Russia or Romania being tempted by a side-deal like this. Especially if presented with a Western "market rate".
    - Caprinicus 11y ago
      Many programmers in Russia and some eastern european countries probably wouldn't even see that as a "side deal"
      - rdtsc 11y ago
        I haven't been back there in many years now, and tried to give the benefit of the doubt ;-)
Godel_unicode 11y ago
People who are cryptographers have a tough time writing secure implementations the first time around, is it really surprising that amateurs do?

tomjen3 11y ago

In many cases (don't know about this one) they come after the network has been shot down.

JamesUtah07 11y ago

I'm curious as to also why they just don't go for full Salsa20 and do 32-bit words instead, seems like a logical quick fix upgrade that might break the decryption.

baby 11y ago
Maybe some machine they are targeting (hospitals?) only work with 16-bit words.