3 ms·

I thought those viruses encrypted using a secret key. How could he crack it?

technion 8y ago
The common way these are "cracked" is that the C&C server - which observes payments and hands over keys - is itself compromised. There are a lot of news articles I read about people "cracking ransomware encryption" and, aside from some early versions that had basic crypto bugs, I'm extremely suspicious of anyone claiming to do so. There are a number of companies I'm aware simply pay the ransom, then charge a huge markup to claim they "cracked the encryption", so it's better for their business to support the view there are elite hackers somehow breaking RSA every time ransomware uses it.
- solotronics 8y ago
  That's not something I thought of before. Really interesting. I wonder if this business model is legal in the US?
tgsovlerkhgsel 8y ago
Getting encryption right is hard, even if you're using a good algorithm. Somewhat competent people get it wrong all the time, and the people writing ransomware are often... less competent than that. Using a static symmetric key for all victims, generating individual keys in an insecure way, 256-bit RSA keys (not sure if this one has happened with ransomware, has happened with legit software), reusing the stream of a stream cipher, using formerly-believed-to-be-secure ciphers like RC4, ... It's not that hard to get the encryption right, but there's plenty room for failure, especially if you aren't an expert.
PeterisP 8y ago
Encryption is all about thoroughness and due diligence, which aren't a priority for malware developers. When doing any real implementation, there are many minor, innocuous things that can be (ab)used to break your secrecy. It's like a test where you do 999 things right and get one thing wrong, then you fail.
SmellyGeekBoy 8y ago
The key is often held somewhere in memory, it's just a case of finding it. At least that's my understanding of how these have been cracked in the past.

The common way these are "cracked" is that the C&C server - which observes payments and hands over keys - is itself compromised. There are a lot of news articles I read about people "cracking ransomware encryption" and, aside from some early versions that had basic crypto bugs, I'm extremely suspicious of anyone claiming to do so. There are a number of companies I'm aware simply pay the ransom, then charge a huge markup to claim they "cracked the encryption", so it's better for their business to support the view there are elite hackers somehow breaking RSA every time ransomware uses it.

solotronics 8y ago
That's not something I thought of before. Really interesting. I wonder if this business model is legal in the US?

tgsovlerkhgsel 8y ago

Getting encryption right is hard, even if you're using a good algorithm. Somewhat competent people get it wrong all the time, and the people writing ransomware are often... less competent than that. Using a static symmetric key for all victims, generating individual keys in an insecure way, 256-bit RSA keys (not sure if this one has happened with ransomware, has happened with legit software), reusing the stream of a stream cipher, using formerly-believed-to-be-secure ciphers like RC4, ... It's not that hard to get the encryption right, but there's plenty room for failure, especially if you aren't an expert.

PeterisP 8y ago

Encryption is all about thoroughness and due diligence, which aren't a priority for malware developers. When doing any real implementation, there are many minor, innocuous things that can be (ab)used to break your secrecy. It's like a test where you do 999 things right and get one thing wrong, then you fail.

SmellyGeekBoy 8y ago

The key is often held somewhere in memory, it's just a case of finding it. At least that's my understanding of how these have been cracked in the past.