3 ms·
I'd guess something more like (ignoring IVs for now): aes_key = keygen_aes() crypted_aes_key = rsa_encrypt(MALWARE_PUB_KEY, aes_key) for file in fi
by aftbit 10y ago
I'd guess something more like (ignoring IVs for now):
aes_key = keygen_aes()
crypted_aes_key = rsa_encrypt(MALWARE_PUB_KEY, aes_key)
for file in files:
content = read(file)
encrypted = aes_encrypt(content, aes_key)
write(file, encrypted)
wipe(aes_key)
display(RANSOM_NOTE, crypted_aes_key)
I'd assume all the details needed to decrypt the files EXCEPT for a small key would be stored in the encrypted file headers. The AES key could be encrypted to a given public key and then directly displayed to the victim. This means that the software doesn't really need to know how to send infoto the ransomware writers. Instead the victim would be responsible for contacting them.
- Cyph0n 10y agoInteresting idea! So for example, the user would provide the displayed hex digest as a note along with the payment. The payment verification server could then email the user the decrypted key.
- aftbit 10y agoYeah, or more likely a Bitcoin address and payment amount would be generated based on the attacker's Bitcoin public key and a hash of the encrypted key. Then the victim would pay that address and somehow contact the attacker (email, forum, twitter, whatever). The point is that the attacker could rely on the victim's human ingenuity to make it harder for the authorities to block payments.