Slashdot Log In
Using Distributed Computing To Thwart Ransomware
Posted by
CmdrTaco
on Wed Jun 11, 2008 10:00 AM
from the much-less-satisfying-than-a-shovel-to-the-face dept.
from the much-less-satisfying-than-a-shovel-to-the-face dept.
I Don't Believe in Imaginary Property writes "The folks at Kaspersky labs are turning to distributed computing to factor the RSA key used by the GPcode virus to encrypt people's files and hold them for ransom. There are two 1024-bit RSA keys to break, which should require a network of about 15 million modern computers to spend a year per key factoring them. Unfortunately, there appear to be no vulnerabilities in the virus' use of RSA, unlike some previous cases. Perhaps more interestingly, there's some debate over whether people should bother cracking it. After all, what if they were trying to trick us into factoring the key for a root signing authority? Besides, there's a more direct method of breaking the encryption: track down the people who wrote the virus and force them to talk."
Related Stories
[+]
Extortion Virus Code Cracked 371 comments
Billosaur writes "BBC News is reporting that the password to the dreaded Archiveus virus has been discovered and is now available to anyone who needs it. Archiveus is a 'ransomware' virus, which combines files from the My Documents folder on Windows machines and exchanges them for a single, password-protected file, which it will not unlock unless a password is given. The user would normally be required to pay the extortionist money in order to receive the password, but apparently the virus writer made one small, critical error in coding: placing the password in the code. BTW, the 30-digit password locking the files is mf2lro8sw03ufvnsq034jfowr18f3cszc20vmw."
[+]
Sneaky Blackmailing Virus That Encrypts Data 409 comments
BaCa writes "Kaspersky Lab found a new variant of Gpcode which encrypts files with various extensions using an RSA encryption algorithm with a 1024-bit key. After Gpcode.ak encrypts files on the victim machine, it changes the extension of these files to ._CRYPT and places a text file named !_READ_ME_!.txt in the same folder. In the text file the criminal tells the victims that the file has been encrypted and offers to sell them a decryptor. Is this a look into the future where the majority of malware will function based on extortion?"
Submission: Using Distributed Computing to Thwart Ransomware by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Seems rather futile.. (Score:5, Insightful)
Re:Seems rather futile.. (Score:5, Insightful)
Hacker - You must pay me $100 or your files will be forever encrypted by my nigh-unbreakable RSA code.
User - Meh, I just wiped my system of your virus and restored my important files from back-up. Piss off.
Layne
Parent
Re:Seems rather futile.. (Score:5, Informative)
Parent
Re:Seems rather futile.. (Score:5, Insightful)
Parent
Re:Seems rather futile.. (Score:4, Insightful)
Time Machine on MacOS seems to be just about there, all they need to do is bundle an external HDD or offer a free online component for personal docs.
Parent
Re:Most Likely to Not Use it and to Pay. (Score:4, Funny)
Enterprise-level backup apps are almost always 3rd-party, not "some kind of unreliable M$ thing". Any serious solution also has a means to restore to bare metal, so in effect you need no OS at all to do this.
(and when was the last time anybody kept any current work on a floppy? Cripes - 1992 called and they want their backup devices back).
Parent
Re: (Score:3, Insightful)
Back in my youth, I never made regular backups.
Then I got a virus.
Since then, I make regular backups.
As annoying as it seems, sometimes people need to understand first-hand the need for regular, offline backups. Until they have the experience of data-loss, they just won't appreciate what could happen.
Other way around (Score:5, Interesting)
Then I got a virus.
Since then, I make regular backups.
Then we got a virus.
Then we realized that the virus was a time bomb that was already present in dormant form even in the oldest several-months old backups.
Sometimes you have parents that are both computer geeks, and they teach you the important of offline backups. Never the less, shit happens anyway.
Parent
Re:Seems rather futile.. (Score:5, Funny)
Parent
Re:Seems rather futile.. (Score:5, Informative)
As for it being a trick to crack a root signing key, would they not have to have the private key to encrypt with to start?
It works like this:
1. Virus generates a random encryption key and encrypts your data with it. Let's call this K.
2. Virus encrypts the random key with a RSA public key and instructs you to email that, R(K), and your money, to the ransomers.
3. The ransomers use their RSA private key to decrypt the encrypted random encryption key, R(K), into K.
4. You use the random encryption key they sold back to you, K, to rescue your data.
Someone else's decryption key, K', is not useful to you because your data was encrypted with a different random key K. You have an RSA-encrypted copy of your own random key, R(K), because that's what the ransomers need you to send them so they can sell you the decryption key K. We're trying to crack the RSA private key so we can generate K from R(K) without having to pay them money, i.e. sidestep step 3.
Parent
Re:Seems rather futile.. (Score:4, Insightful)
Parent
I've got a better idea (Score:5, Insightful)
Don't forget the corollary. (Score:5, Insightful)
Encourage the application writers to make their applications EASY TO BACKUP.
The problem I keep seeing is that TELLING someone to back up their data is easy to do. FINDING ALL of the data is just about impossible.
You'll never know if you got it all until AFTER a problem.
Or even
Parent
There is a LITTLE magic involved. (Score:4, Informative)
For the Registry, you can "export" the entries for that app to a file and, later, you can import that file into the Registry.
The problem with the Registry is the same as you've noted with the file system. Stuff gets put EVERYWHERE. And there is no way to KNOW that you have EVERYTHING until AFTER you attempt to restore it. AND that doesn't include anything "updated" when you get a patch or point-zero-one release "upgrade".
Now, the installer can put that stuff everywhere
And I don't want to hear that that is to prevent "piracy". Just encrypt the stuff with the unlocking key or whatever. That way I can keep a TEXT file of app-name -- key code on my USB drive along with the backups.
Parent
Re:Don't forget the corollary. (Score:4, Insightful)
Not quite a direct answer, but you might want to consider using mostly "Portable" [portableapps.com] apps (that site has tons of them, but by no means counts as the only source... And of course, better-designed programs work portably without needing a wrapper).
They have nothing to do with Linux or FOSS (though they do tend to exist as FOSS and have Linux versions available). You copy the program's directory (and, if you changed it, your data directory) to a new machine, and bam, it just works. No installation, no annoying migration tools that fail half the time, no custom compression schemes that only worked back on version 4.8 but they stopped supporting in 5.0 and no longer sell version 4.8, etc.
With most of them, you can run them from USB thumb-drives (the original meaning in this context of "portable" - Literally, you can take them with you); With many, you can even run them from read-only media such as a CD (though obviously you can't save your data in the same place when doing so).
Parent
Re:I've got a better idea (Score:4, Interesting)
Parent
Re:I've got a better idea (Score:4, Informative)
Parent
Re:I've got a better idea (Score:5, Informative)
Parent
Re:I've got a better idea (Score:5, Funny)
Way ahead of you. I went into IT security years ago. It is a gold mine. You can basically sell snakeoil and people will kill each other to buy it from you.
Parent
Re:I've got a better idea (Score:4, Funny)
Parent
Re: (Score:3, Funny)
It will be absolutely nothing more than a box filled with paperwork. After filling out said paperwork, the client is guaranteed paper "rights" to be "free" and "protected" with said freedoms and protections guaranteed by the pieces of paper, and through no action or knowledge of his own. The client thus receives all the benefits without any of the actual ri
Re: (Score:3, Interesting)
Re:I've got a better idea (Score:5, Insightful)
Banking, religion, and politics all have their problems, no doubt. But they're all important and persistent factors in the progress that humanity has made. They've all been involved in bad things, but they've all be involved in lots of good things as well.
A human being is, on their own, capable of many things, both good and bad. Structures, systems, corporations, religions, corporations...they've all allowed us as a civilization to accomplish tasks that no one man could accomplish on his own. Some good and some bad, but all it does is amplify our abilities.
Parent
Re:I've got a better idea (Score:5, Funny)
Parent
Re:I've got a better idea (Score:4, Funny)
Parent
Re:I've got a better idea (Score:5, Funny)
Parent
Re: (Score:3, Funny)
Re:I've got a better idea (Score:5, Funny)
> Psh... backups? I restore my data from a parallel universe, where I didn't get hit by a virus in the first place.
K dkd that, but kt turns out they use a slkghtly dkfferent alphabet kn that unkverse.
Parent
track down the people who wrote the virus and for (Score:4, Funny)
Interbank Data Recovery Services (Score:5, Funny)
Fortunately, we had Interbank Data Recovery Services. And Interbank does more than just acquire the decryption key.
That's because Interbank vows to find out who sent you the ransom and hunt them down like animals. Like filthy, dirty animals. That's the Interbank difference. See, I don't care how Interbank's secret police get things done. I just care that they get things done. For us.
Plus, because we'd enrolled in their Premiere Membership program, Interbank also hunted down friends and relatives of the guy who had encrypted our data, dragged them from their beds in the middle of the night, and set fire to their homes.
Parent
Damn it (Score:4, Funny)
If only I hadn't erased Jack Bauer's cell from my contact list after the last season...
Re: (Score:3, Funny)
If only I hadn't erased Jack Bauer's cell from my contact list after the last season...
Make them talk? (Score:3, Funny)
Re:Make them talk? (Score:5, Funny)
Talk about motivation!
Parent
Tag: Goodluckwiththat (Score:5, Interesting)
You can trust me on that one, I've tried. I've even had so much as the name of the person to prosecute. Nothing came out of it. Despite including our federal police and interpol.
Re:Tag: Goodluckwiththat (Score:4, Informative)
Parent
15 million modern computers?? (Score:4, Insightful)
15 million CPU years (Score:4, Interesting)
15 million CPU years is a lot to spend when you could just restore from backups.
It is a good devlopment, Don't help them (Score:5, Insightful)
As long as security is valued at zero dollars when the IT bean counters are evaluating platforms and vendors crapware will proliferate.
Got to be a link to the extortionist (Score:4, Interesting)
Re:Got to be a link to the extortionist (Score:4, Informative)
Parent
Re:Got to be a link to the extortionist (Score:4, Insightful)
1. Encrypt victim's data with random AES key
2. Store key in body of a PGP message for yourself
3. Get victim to send you the PGP message
3. Decrypt PGP message using private PGP key, find AES key
4. Send AES key to victim - for a price...
Seriously, this could probably be hacked together in the matter of a few hours if explained to someone knowledgable. The private key never leaves the bad guys. And if they decide the heat is on and torch the operation and set it up elsewhere you're 100% screwed. Trying to crack this must be the most useless operation ever, they could easily make the keys stronger and thousands of years would pass to crack it. In one word: Nasty.
Parent
Leave it be. (Score:3, Insightful)
So, there are two possibilities here:
Either way, this seems like a pretty strong (if harsh) lesson for end users. If #1, use better software, like your geek friends have been telling you this for years. That doesn't have to mean installing Ubuntu; it could just mean upgrading from IE6 to Firefox (or IE7), or from Outlook Express to Thunderbird (or Gmail). If #2, then haven't you been told about 1,000 times not to do that? Now do you see why?
I truly feel bad for people who get nailed for this, in almost exactly the same way I feel bad for my kids when they touch the stove after I've told them it was hot.
Data recovery (Score:5, Insightful)
Someone try to undelete the files with a disk recovery tool and see what you get. Just because the file is encrypted does not mean that the original was correctly destroyed.
No trust, ergo, no reason to decrypt (Score:4, Insightful)
I suppose if the file in question was something like a manuscript for a novel, where the owner can more or less verify it by eye, and (importantly) there isn't that much downside if our opponent sneaks some changes in, that might be worthwhile. But in general...
RC4 is easier... (Score:3, Interesting)
RC4 brute force is far easier. There are several known problems with RC4 which may possibly work to our advantage in cracking the data as well..
Re: (Score:3, Informative)
Re: (Score:3, Interesting)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Oh, I do: as long as it's not the government doing the compelling.
Just once it'd be fun to hear that the local mafia don's PC got infected because his wife wanted cute smileys, and that the local prosecutor is frustrated by the lack of direct evidence linking the don to what they found down by the river.