4 ms·

Could the "one file free decrypt preview" feature be used to sniff out the crypto key required to decrypt all the other files? Or does the virus need to check i

by 0x0 12y ago

Could the "one file free decrypt preview" feature be used to sniff out the crypto key required to decrypt all the other files? Or does the virus need to check in with the backend for every single file for unique keys?

logn 12y ago
> does the virus need to check in with the backend for every single file for unique keys? As it's based on CryptoLocker, all the files would be encrypted with the same key. After CryptoLocker was busted by law enforcement, "Fox-IT and fellow firm FireEye introduced an online service which allows infected users to retrieve their private key by uploading a sample file, and then receive a decryption tool" (https://en.wikipedia.org/wiki/Cryptolocker#Takedown_and_recovery_of_files https://en.wikipedia.org/wiki/Cryptolocker#Takedown_and_reco...) edit: technically the files are encrypted with different keys but those keys are stored on the victim's machine and encrypted with a single key -- http://www.welivesecurity.com/2013/12/19/cryptolocker-2-0-new-version-or-copycat/ http://www.welivesecurity.com/2013/12/19/cryptolocker-2-0-ne...
- HackinOut 12y ago
  I wouldn't be so sure this would help: CryptoLocker was using symmetric encryption (AES) for the files while CryptoWall apparently solely use RSA (which creates problems for the pirate, like slow encryption, thus encrypting only small files (.jpeg, .doc...)?). Only the public key seems to be downloaded when the malware installs. (http://stopmalvertising.com/malware-reports/cryptowall-behind-the-scenes.html http://stopmalvertising.com/malware-reports/cryptowall-behin...) If this is the case, I would surprised if they would download the private key for the one free decrypt feature. If they encrypt only small files they might do the decryption on the remote C&C Server? It's worth investigating anyway.

4 ms·

Could the "one file free decrypt preview" feature be used to sniff out the crypto key required to decrypt all the other files? Or does the virus need to check i

by 0x0 12y ago

logn 12y ago
> does the virus need to check in with the backend for every single file for unique keys? As it's based on CryptoLocker, all the files would be encrypted with the same key. After CryptoLocker was busted by law enforcement, "Fox-IT and fellow firm FireEye introduced an online service which allows infected users to retrieve their private key by uploading a sample file, and then receive a decryption tool" (https://en.wikipedia.org/wiki/Cryptolocker#Takedown_and_recovery_of_files https://en.wikipedia.org/wiki/Cryptolocker#Takedown_and_reco...) edit: technically the files are encrypted with different keys but those keys are stored on the victim's machine and encrypted with a single key -- http://www.welivesecurity.com/2013/12/19/cryptolocker-2-0-new-version-or-copycat/ http://www.welivesecurity.com/2013/12/19/cryptolocker-2-0-ne...
- HackinOut 12y ago
  I wouldn't be so sure this would help: CryptoLocker was using symmetric encryption (AES) for the files while CryptoWall apparently solely use RSA (which creates problems for the pirate, like slow encryption, thus encrypting only small files (.jpeg, .doc...)?). Only the public key seems to be downloaded when the malware installs. (http://stopmalvertising.com/malware-reports/cryptowall-behind-the-scenes.html http://stopmalvertising.com/malware-reports/cryptowall-behin...) If this is the case, I would surprised if they would download the private key for the one free decrypt feature. If they encrypt only small files they might do the decryption on the remote C&C Server? It's worth investigating anyway.