I've read a few articles of people managing to get the key out of the ransomware programs, so it some cases it really is just stored on the system and you can f

I've read a few articles of people managing to get the key out of the ransomware programs, so it some cases it really is just stored on the system and you can find it if you know what you're doing. Those articles were a while-back though, so it's possible they've 'fixed' that issue. Like others have said, public/private key crypto can be used to achieve this, and fairly easy: The randomware is distributed with a public key, and after generating the AES key and encrypting the system, it then encrypts the AES key using the public key and removes all other copies of the AES key. Thus, nobody with access to the system can decrypt the system now unless they have the matching private key. If you pay to decrypt your system, the program sends off the encrypted AES key, and then they send back the decrypted AES key which they got by using the matching private key. And then from there you use the AES key to decrypt the rest of the system.