Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Using Distributed Computing To Thwart Ransomware

Posted by CmdrTaco on Wed Jun 11, 2008 10:00 AM
from the much-less-satisfying-than-a-shovel-to-the-face dept.
I Don't Believe in Imaginary Property writes "The folks at Kaspersky labs are turning to distributed computing to factor the RSA key used by the GPcode virus to encrypt people's files and hold them for ransom. There are two 1024-bit RSA keys to break, which should require a network of about 15 million modern computers to spend a year per key factoring them. Unfortunately, there appear to be no vulnerabilities in the virus' use of RSA, unlike some previous cases. Perhaps more interestingly, there's some debate over whether people should bother cracking it. After all, what if they were trying to trick us into factoring the key for a root signing authority? Besides, there's a more direct method of breaking the encryption: track down the people who wrote the virus and force them to talk."
+ -
story

Related Stories

[+] Extortion Virus Code Cracked 371 comments
Billosaur writes "BBC News is reporting that the password to the dreaded Archiveus virus has been discovered and is now available to anyone who needs it. Archiveus is a 'ransomware' virus, which combines files from the My Documents folder on Windows machines and exchanges them for a single, password-protected file, which it will not unlock unless a password is given. The user would normally be required to pay the extortionist money in order to receive the password, but apparently the virus writer made one small, critical error in coding: placing the password in the code. BTW, the 30-digit password locking the files is mf2lro8sw03ufvnsq034jfowr18f3cszc20vmw."
[+] Sneaky Blackmailing Virus That Encrypts Data 409 comments
BaCa writes "Kaspersky Lab found a new variant of Gpcode which encrypts files with various extensions using an RSA encryption algorithm with a 1024-bit key. After Gpcode.ak encrypts files on the victim machine, it changes the extension of these files to ._CRYPT and places a text file named !_READ_ME_!.txt in the same folder. In the text file the criminal tells the victims that the file has been encrypted and offers to sell them a decryptor. Is this a look into the future where the majority of malware will function based on extortion?"
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • by FluffyWithTeeth (890188) on Wednesday June 11 2008, @10:02AM (#23747941)
    Surely all the have to do is start using a new key every so often, and the task becomes pointless?
    • by SQLGuru (980662) on Wednesday June 11 2008, @10:09AM (#23748077)
      Surely all you have to do is make frequent back-ups of your critical data and the virus becomes pointless.

      Hacker - You must pay me $100 or your files will be forever encrypted by my nigh-unbreakable RSA code.
      User - Meh, I just wiped my system of your virus and restored my important files from back-up. Piss off.

      Layne
      • by oldspewey (1303305) on Wednesday June 11 2008, @10:16AM (#23748213)
        As has been pointed out in the past - the people who are most likely to become infected with a ransomware virus are exactly the same people who are least likely to have backups available.
        • by Silver Sloth (770927) on Wednesday June 11 2008, @10:19AM (#23748277)
          Good, sometimes there's only one way to learn about why we have backups. After all, they're just as much at risk from hard disk crashes.
          • by AmiMoJo (196126) <mojo@[ ]ld3.net ['wor' in gap]> on Wednesday June 11 2008, @11:21AM (#23749453) Homepage
            While I too get frustrated by incompetent users, I think that attitude is a bit harsh. Computers are supposed to have reached the point of being easy to use by laymen, and automatic backup should be part of that.

            Time Machine on MacOS seems to be just about there, all they need to do is bundle an external HDD or offer a free online component for personal docs.
            • by Penguinisto (415985) on Wednesday June 11 2008, @11:06AM (#23749133) Journal
              Twitter - as someone who helps do backups for (insert huge corp here) there's no other way to say this, but... you're an idiot. For the newer folks among us, I'll happily explain why.



              Enterprise-level backup apps are almost always 3rd-party, not "some kind of unreliable M$ thing". Any serious solution also has a means to restore to bare metal, so in effect you need no OS at all to do this.


              (and when was the last time anybody kept any current work on a floppy? Cripes - 1992 called and they want their backup devices back).

              /P

        • Re: (Score:3, Insightful)

          As has been pointed out in the past - the people who are most likely to become infected with a ransomware virus are exactly the same people who are least likely to have backups available.

          Back in my youth, I never made regular backups.
          Then I got a virus.
          Since then, I make regular backups.


          As annoying as it seems, sometimes people need to understand first-hand the need for regular, offline backups. Until they have the experience of data-loss, they just won't appreciate what could happen.
          • Other way around (Score:5, Interesting)

            by DrYak (748999) on Wednesday June 11 2008, @10:43AM (#23748669) Homepage

            Back in my youth, I never made regular backups.
            Then I got a virus.
            Since then, I make regular backups.
            Back in my childhood I did regular backups of my family's computer.
            Then we got a virus.
            Then we realized that the virus was a time bomb that was already present in dormant form even in the oldest several-months old backups.

            Sometimes you have parents that are both computer geeks, and they teach you the important of offline backups. Never the less, shit happens anyway.

        • by Sique (173459) on Wednesday June 11 2008, @10:52AM (#23748865) Homepage
          So this is another lesson in Computer Security 101: "No one likes Backups, but everyone likes Restore"?
          • by Anonymous Conrad (600139) on Wednesday June 11 2008, @11:09AM (#23749197)

            I'll assume someone paid the ransom at least once. So what key did they use to decrypt? Do us a favor and post it.

            As for it being a trick to crack a root signing key, would they not have to have the private key to encrypt with to start?
            ... huh?

            It works like this:

            1. Virus generates a random encryption key and encrypts your data with it. Let's call this K.
            2. Virus encrypts the random key with a RSA public key and instructs you to email that, R(K), and your money, to the ransomers.
            3. The ransomers use their RSA private key to decrypt the encrypted random encryption key, R(K), into K.
            4. You use the random encryption key they sold back to you, K, to rescue your data.

            Someone else's decryption key, K', is not useful to you because your data was encrypted with a different random key K. You have an RSA-encrypted copy of your own random key, R(K), because that's what the ransomers need you to send them so they can sell you the decryption key K. We're trying to crack the RSA private key so we can generate K from R(K) without having to pay them money, i.e. sidestep step 3.
        • by bigstrat2003 (1058574) * on Wednesday June 11 2008, @11:07AM (#23749151)
          I use Windows because I'm not brain-dead and can keep my machine secure. For those of us who know what we're doing, it doesn't matter what OS we use. For those of us who don't know what we're doing, similarly, it doesn't matter what OS we use: you're only kidding yourself if you think that widespread Linux adoption would result in there not being many/any pwned machines. The user is, and always will be the biggest computer vulnerability.
  • by elrous0 (869638) * on Wednesday June 11 2008, @10:03AM (#23747971)
    Encourage people to make backups of their data on disc, tape, or portable harddrives. I know that's a radical idea, but it just might be crazy enough to work.
    • by khasim (1285) <brandioch.conner@gmail.com> on Wednesday June 11 2008, @10:16AM (#23748229)
      Don't forget the corollary.

      Encourage the application writers to make their applications EASY TO BACKUP.

      The problem I keep seeing is that TELLING someone to back up their data is easy to do. FINDING ALL of the data is just about impossible.

      You'll never know if you got it all until AFTER a problem.

      Or even ... how about just including a simple script that will look at how it's installed TODAY and back it up to a location chosen by the user? And then that script will generate a script to install that backup should you need it to. Along with license keys and decoding keys and unlocking keys, etc.
        • by khasim (1285) <brandioch.conner@gmail.com> on Wednesday June 11 2008, @10:41AM (#23748641)

          Do I just not know some Windows Admin secret magic, or is it true that I really can't back up my applications.
          There is a little magic that you can try, but you are pretty much correct. You cannot EASILY backup your Windows apps.

          For the Registry, you can "export" the entries for that app to a file and, later, you can import that file into the Registry.

          The problem with the Registry is the same as you've noted with the file system. Stuff gets put EVERYWHERE. And there is no way to KNOW that you have EVERYTHING until AFTER you attempt to restore it. AND that doesn't include anything "updated" when you get a patch or point-zero-one release "upgrade".

          Now, the installer can put that stuff everywhere ... and in theory it can remove that stuff when you un-install it ... but it cannot COPY that stuff to a backup directory/device?

          And I don't want to hear that that is to prevent "piracy". Just encrypt the stuff with the unlocking key or whatever. That way I can keep a TEXT file of app-name -- key code on my USB drive along with the backups.
        • by pla (258480) on Wednesday June 11 2008, @10:47AM (#23748769) Journal
          Do I just not know some Windows Admin secret magic, or is it true that I really can't back up my applications. I'd like to be able to reinstall Windows and then restore all of my applications.

          Not quite a direct answer, but you might want to consider using mostly "Portable" [portableapps.com] apps (that site has tons of them, but by no means counts as the only source... And of course, better-designed programs work portably without needing a wrapper).

          They have nothing to do with Linux or FOSS (though they do tend to exist as FOSS and have Linux versions available). You copy the program's directory (and, if you changed it, your data directory) to a new machine, and bam, it just works. No installation, no annoying migration tools that fail half the time, no custom compression schemes that only worked back on version 4.8 but they stopped supporting in 5.0 and no longer sell version 4.8, etc.

          With most of them, you can run them from USB thumb-drives (the original meaning in this context of "portable" - Literally, you can take them with you); With many, you can even run them from read-only media such as a CD (though obviously you can't save your data in the same place when doing so).
    • by SatanicPuppy (611928) * <Satanicpuppy@nOSPaM.gmail.com> on Wednesday June 11 2008, @10:44AM (#23748693) Journal
      If we had a backup, wouldn't it be possible to break the encryption using the backed-up data as a crib? Why force the key directly when you know what is in a large chunk of the cyphertext?

      • by evanbd (210358) on Wednesday June 11 2008, @10:57AM (#23748969)
        Known plaintext attacks are a mainstay of cryptanalysis. They tend to be more powerful than other attacks, but they still don't help much. Factoring is the best known technique for RSA, even given known plaintext or chosen plaintext.
        • by DamnStupidElf (649844) <Fingolfin@linuxmail.org> on Wednesday June 11 2008, @11:52AM (#23750063)
          Even further, you *don't* have the known plaintext to break RSA because it's a random symmetric key encrypted with RSA that is used to encrypt the files by the virus. Every modern cipher since DES has been highly resistant to known plaintext attacks. That's a basic requirement for a cipher to be considered non-broken.
      • by Opportunist (166417) on Wednesday June 11 2008, @10:12AM (#23748147)
        I think, personally, that human stupidity is a gold mine, and I'm slowly losing any inhibition and cashing in on it.

        Way ahead of you. I went into IT security years ago. It is a gold mine. You can basically sell snakeoil and people will kill each other to buy it from you.
      • As a result, I am shortly going to be announcing my new "Remain Safely Stupid, (tm)" product line. We harness the power of human stupidity for profit.

        It will be absolutely nothing more than a box filled with paperwork. After filling out said paperwork, the client is guaranteed paper "rights" to be "free" and "protected" with said freedoms and protections guaranteed by the pieces of paper, and through no action or knowledge of his own. The client thus receives all the benefits without any of the actual ri
        • Re: (Score:3, Interesting)

          I think the bankers, the priests and the politicians have already figured out how to turn stupidity into free energy. Witness, for example, the boundlessly stupid as they sign up to fight politicians wars, religionists jihads, to man priests' inquisitions or run on the endless, profitless treadmill of the serf/employee rat race, and witness this set of examples through history. From tithes, to taxes, to "donations" to traffic tickets and drug enforcement, the boundlessly stupid have always eagerly jumped
          • by cowscows (103644) on Wednesday June 11 2008, @11:10AM (#23749239) Journal
            So what you're saying is that anyone who lives in any fashion beyond subsistence farming is stupid?

            Banking, religion, and politics all have their problems, no doubt. But they're all important and persistent factors in the progress that humanity has made. They've all been involved in bad things, but they've all be involved in lots of good things as well.

            A human being is, on their own, capable of many things, both good and bad. Structures, systems, corporations, religions, corporations...they've all allowed us as a civilization to accomplish tasks that no one man could accomplish on his own. Some good and some bad, but all it does is amplify our abilities.

  • Where's Jack Bauer when you need him ???
    • by wagnerrp (1305589) on Wednesday June 11 2008, @10:16AM (#23748219)

      Fortunately, we had Interbank Data Recovery Services. And Interbank does more than just acquire the decryption key.

      That's because Interbank vows to find out who sent you the ransom and hunt them down like animals. Like filthy, dirty animals. That's the Interbank difference. See, I don't care how Interbank's secret police get things done. I just care that they get things done. For us.

      Plus, because we'd enrolled in their Premiere Membership program, Interbank also hunted down friends and relatives of the guy who had encrypted our data, dragged them from their beds in the middle of the night, and set fire to their homes.

  • Damn it (Score:4, Funny)

    by alx5000 (896642) <alx5000.alx5000@net> on Wednesday June 11 2008, @10:05AM (#23747997) Homepage

    Besides, there's a more direct method of breaking the encryption: track down the people who wrote the virus and force them to talk.

    If only I hadn't erased Jack Bauer's cell from my contact list after the last season...

    • Besides, there's a more direct method of breaking the encryption: track down the people who wrote the virus and force them to talk.

      If only I hadn't erased Jack Bauer's cell from my contact list after the last season...

      I had his number in my PC, but somehow I can't access it all of a sudden. I think a virus encrypted it.
  • by JCSoRocks (1142053) on Wednesday June 11 2008, @10:09AM (#23748073)
    How are we going to do that? Everyone knows that things aren't nearly as fun as they used to be... people are even complaining about waterboarding now! what's this world coming to? Shoot, I remember when you could put a man on the rack - no problem.
    • by Opportunist (166417) on Wednesday June 11 2008, @10:14AM (#23748191)
      Simple. Lock them in a cell with a person whose complete pr0n collection is now encrypted. Then go out and come back about an hour later. They talk. They will confess everything, including the assassination of JFK, just as long as they don't have to spend more time with someone whose jackoff material is gone and they're to blame for it.

      Talk about motivation!
  • by Opportunist (166417) on Wednesday June 11 2008, @10:10AM (#23748107)
    The people who did that sit in a country ending in -stan. Countries ending in -stan have real problems and don't care for problems their citizens cause abroad.

    You can trust me on that one, I've tried. I've even had so much as the name of the person to prosecute. Nothing came out of it. Despite including our federal police and interpol.
    • by CodeBuster (516420) on Wednesday June 11 2008, @11:37AM (#23749781)

      You can trust me on that one, I've tried. I've even had so much as the name of the person to prosecute. Nothing came out of it. Despite including our federal police and interpol.
      Nothing came of it because you did not sweeten the pot for local law enforcement, politicians, and judges with large bribes. If one wants justice or even just to get something done in a -stan country then one has to grease the wheels of the local economy or in other words its pay (more than your opponent) to play. This is how much of the world outside of the United States, Britain, and Western Europe functions, it is practically impossible to get things done or at least done quickly if bribes are not involved.
  • by iamacat (583406) on Wednesday June 11 2008, @10:11AM (#23748121)
    They are best off using a large botnet then. Perhaps modify the extortion virus itself so that it's part of solution rather than part of the problem.
  • 15 million CPU years (Score:4, Interesting)

    by robo_mojo (997193) on Wednesday June 11 2008, @10:14AM (#23748175)
    15 million CPU years per key? And the attacker can just make up new keys as often as he likes. He could even make a different key for each target if he wanted.

    15 million CPU years is a lot to spend when you could just restore from backups.
  • by 140Mandak262Jamuna (970587) on Wednesday June 11 2008, @10:16AM (#23748227) Journal
    We should not help people whose data is held at ransom. Finally they will see the folly in using cheapest software, in the cheapest platform with no regard for security. Companies will start taking insurance against data loss. And the insurance premium will be more for insecure closed proprietary crapware like Windows.

    As long as security is valued at zero dollars when the IT bean counters are evaluating platforms and vendors crapware will proliferate.

  • by uab21 (951482) on Wednesday June 11 2008, @10:16AM (#23748237)
    The screenshot at http://news.cnet.com/8301-10784_3-9965381-7.html?tag=nefd.top [cnet.com] says that the victim pays to download a 'decryptor'. Either the decryptor contacts, in real time, the extortionist (at a server location that can be linked to them), or the private key is included in the decryptor program, and should be able to be sussed out...
    • by steveb3210 (962811) * on Wednesday June 11 2008, @10:19AM (#23748281)
      The explanation I found on the site isn't quite this simple. The data is encrypted with a randomly-generated symmertic key that is protected with RSA.. You send the bad guys the file with the key in it, they decrpyt it and write a program to decrypt everything..
      • by Kjella (173770) on Wednesday June 11 2008, @10:43AM (#23748673) Homepage
        Quite simple and very effective and can be done using standard tools:

        1. Encrypt victim's data with random AES key
        2. Store key in body of a PGP message for yourself
        3. Get victim to send you the PGP message
        3. Decrypt PGP message using private PGP key, find AES key
        4. Send AES key to victim - for a price...

        Seriously, this could probably be hacked together in the matter of a few hours if explained to someone knowledgable. The private key never leaves the bad guys. And if they decide the heat is on and torch the operation and set it up elsewhere you're 100% screwed. Trying to crack this must be the most useless operation ever, they could easily make the keys stronger and thousands of years would pass to crack it. In one word: Nasty.
  • Leave it be. (Score:3, Insightful)

    by Just Some Guy (3352) <kirk+slashdot@strauser.com> on Wednesday June 11 2008, @10:18AM (#23748259) Homepage Journal

    So, there are two possibilities here:

    1. People are running crappy software that got hacked, or
    2. People did something dumb like running an .exe that someone mailed them.

    Either way, this seems like a pretty strong (if harsh) lesson for end users. If #1, use better software, like your geek friends have been telling you this for years. That doesn't have to mean installing Ubuntu; it could just mean upgrading from IE6 to Firefox (or IE7), or from Outlook Express to Thunderbird (or Gmail). If #2, then haven't you been told about 1,000 times not to do that? Now do you see why?

    I truly feel bad for people who get nailed for this, in almost exactly the same way I feel bad for my kids when they touch the stove after I've told them it was hot.

  • Data recovery (Score:5, Insightful)

    by KevMar (471257) on Wednesday June 11 2008, @10:25AM (#23748363) Homepage Journal
    So the encryption is sound, but did he just delete the old files after encrypting them or did he scrub the drive too.

    Someone try to undelete the files with a disk recovery tool and see what you get. Just because the file is encrypted does not mean that the original was correctly destroyed.
  • by mkcmkc (197982) on Wednesday June 11 2008, @10:29AM (#23748437)
    What seems to be missing here, is the realization that if someone has encrypted your files without your permission (supposedly for ransom), there is no reason to trust them to restore the files correctly, and very good reasons not to trust them.

    I suppose if the file in question was something like a manuscript for a novel, where the owner can more or less verify it by eye, and (importantly) there isn't that much downside if our opponent sneaks some changes in, that might be worthwhile. But in general...

  • RC4 is easier... (Score:3, Interesting)

    by Panaflex (13191) <convivialdingo@yah[ ]com ['oo.' in gap]> on Wednesday June 11 2008, @10:47AM (#23748773)
    Why waste time factoring RSA?? The RSA simply wraps an RC4 key.

    RC4 brute force is far easier. There are several known problems with RC4 which may possibly work to our advantage in cracking the data as well..
    • Re: (Score:3, Informative)

      But you don't have to check them all. You can start at the root of the number and go down, skipping even numbers and then some.
      • Re: (Score:3, Interesting)

        That would solve it in only 2^511 operations. In actuality, factoring of large numbers is far more efficient than that. The techniques are complex, but they're quite good. That's why a 1024 bit RSA key is considered somewhat small (2048 or 4096 are the norm) but for symmetric key ciphers (where you do have to try all 2^n possible keys) use key sizes of 256 bits or less.
    • That depends on whether you think it is acceptable to compel someone to reveal something like that.

      Oh, I do: as long as it's not the government doing the compelling.

      Just once it'd be fun to hear that the local mafia don's PC got infected because his wife wanted cute smileys, and that the local prosecutor is frustrated by the lack of direct evidence linking the don to what they found down by the river.