Using Distributed Computing To Thwart Ransomware

I Don't Believe in Imaginary Property writes "The folks at Kaspersky labs are turning to distributed computing to factor the RSA key used by the GPcode virus to encrypt people's files and hold them for ransom. There are two 1024-bit RSA keys to break, which should require a network of about 15 million modern computers to spend a year per key factoring them. Unfortunately, there appear to be no vulnerabilities in the virus' use of RSA, unlike some previous cases. Perhaps more interestingly, there's some debate over whether people should bother cracking it. After all, what if they were trying to trick us into factoring the key for a root signing authority? Besides, there's a more direct method of breaking the encryption: track down the people who wrote the virus and force them to talk."

Seems rather futile..

Surely all the have to do is start using a new key every so often, and the task becomes pointless?

Re:Seems rather futile..

Surely all you have to do is make frequent back-ups of your critical data and the virus becomes pointless.

Hacker - You must pay me $100 or your files will be forever encrypted by my nigh-unbreakable RSA code.
User - Meh, I just wiped my system of your virus and restored my important files from back-up. Piss off.

Layne

Re:Seems rather futile..

As has been pointed out in the past - the people who are most likely to become infected with a ransomware virus are exactly the same people who are least likely to have backups available.

Re:Seems rather futile..

Good, sometimes there's only one way to learn about why we have backups. After all, they're just as much at risk from hard disk crashes.

Re:Seems rather futile..

So this is another lesson in Computer Security 101: "No one likes Backups, but everyone likes Restore"?

Other way around

Back in my youth, I never made regular backups.
Then I got a virus.
Since then, I make regular backups.

Back in my childhood I did regular backups of my family's computer.
Then we got a virus.
Then we realized that the virus was a time bomb that was already present in dormant form even in the oldest several-months old backups.

Sometimes you have parents that are both computer geeks, and they teach you the important of offline backups. Never the less, shit happens anyway.

Re:Seems rather futile..

I'll assume someone paid the ransom at least once. So what key did they use to decrypt? Do us a favor and post it.

As for it being a trick to crack a root signing key, would they not have to have the private key to encrypt with to start?

... huh?

It works like this:

1. Virus generates a random encryption key and encrypts your data with it. Let's call this K.
2. Virus encrypts the random key with a RSA public key and instructs you to email that, R(K), and your money, to the ransomers.
3. The ransomers use their RSA private key to decrypt the encrypted random encryption key, R(K), into K.
4. You use the random encryption key they sold back to you, K, to rescue your data.

Someone else's decryption key, K', is not useful to you because your data was encrypted with a different random key K. You have an RSA-encrypted copy of your own random key, R(K), because that's what the ransomers need you to send them so they can sell you the decryption key K. We're trying to crack the RSA private key so we can generate K from R(K) without having to pay them money, i.e. sidestep step 3.

I've got a better idea

Encourage people to make backups of their data on disc, tape, or portable harddrives. I know that's a radical idea, but it just might be crazy enough to work.

Don't forget the corollary.

Don't forget the corollary.

Encourage the application writers to make their applications EASY TO BACKUP.

The problem I keep seeing is that TELLING someone to back up their data is easy to do. FINDING ALL of the data is just about impossible.

You'll never know if you got it all until AFTER a problem.

Or even ... how about just including a simple script that will look at how it's installed TODAY and back it up to a location chosen by the user? And then that script will generate a script to install that backup should you need it to. Along with license keys and decoding keys and unlocking keys, etc.

Re:I've got a better idea

I think, personally, that human stupidity is a gold mine, and I'm slowly losing any inhibition and cashing in on it.

Way ahead of you. I went into IT security years ago. It is a gold mine. You can basically sell snakeoil and people will kill each other to buy it from you.

Re:I've got a better idea

So what you're saying is that anyone who lives in any fashion beyond subsistence farming is stupid?

Banking, religion, and politics all have their problems, no doubt. But they're all important and persistent factors in the progress that humanity has made. They've all been involved in bad things, but they've all be involved in lots of good things as well.

A human being is, on their own, capable of many things, both good and bad. Structures, systems, corporations, religions, corporations...they've all allowed us as a civilization to accomplish tasks that no one man could accomplish on his own. Some good and some bad, but all it does is amplify our abilities.

Re:I've got a better idea

You backup to the same computer? I don't even backup to the same state!

Re:I've got a better idea

Psh... backups? I restore my data from a parallel universe, where I didn't get hit by a virus in the first place.

Re:I've got a better idea

> Psh... backups? I restore my data from a parallel universe, where I didn't get hit by a virus in the first place.

K dkd that, but kt turns out they use a slkghtly dkfferent alphabet kn that unkverse.

Re:I've got a better idea

Even further, you *don't* have the known plaintext to break RSA because it's a random symmetric key encrypted with RSA that is used to encrypt the files by the virus. Every modern cipher since DES has been highly resistant to known plaintext attacks. That's a basic requirement for a cipher to be considered non-broken.

track down the people who wrote the virus and for

Where's Jack Bauer when you need him ???

Interbank Data Recovery Services

Fortunately, we had Interbank Data Recovery Services. And Interbank does more than just acquire the decryption key.

That's because Interbank vows to find out who sent you the ransom and hunt them down like animals. Like filthy, dirty animals. That's the Interbank difference. See, I don't care how Interbank's secret police get things done. I just care that they get things done. For us.

Plus, because we'd enrolled in their Premiere Membership program, Interbank also hunted down friends and relatives of the guy who had encrypted our data, dragged them from their beds in the middle of the night, and set fire to their homes.

Damn it

Besides, there's a more direct method of breaking the encryption: track down the people who wrote the virus and force them to talk.

If only I hadn't erased Jack Bauer's cell from my contact list after the last season...

Tag: Goodluckwiththat

The people who did that sit in a country ending in -stan. Countries ending in -stan have real problems and don't care for problems their citizens cause abroad.

You can trust me on that one, I've tried. I've even had so much as the name of the person to prosecute. Nothing came out of it. Despite including our federal police and interpol.

15 million modern computers??

They are best off using a large botnet then. Perhaps modify the extortion virus itself so that it's part of solution rather than part of the problem.

15 million CPU years

15 million CPU years per key? And the attacker can just make up new keys as often as he likes. He could even make a different key for each target if he wanted.

15 million CPU years is a lot to spend when you could just restore from backups.

It is a good devlopment, Don't help them

We should not help people whose data is held at ransom. Finally they will see the folly in using cheapest software, in the cheapest platform with no regard for security. Companies will start taking insurance against data loss. And the insurance premium will be more for insecure closed proprietary crapware like Windows.

As long as security is valued at zero dollars when the IT bean counters are evaluating platforms and vendors crapware will proliferate.

Got to be a link to the extortionist

The screenshot at http://news.cnet.com/8301-10784_3-9965381-7.html?tag=nefd.top [cnet.com] says that the victim pays to download a 'decryptor'. Either the decryptor contacts, in real time, the extortionist (at a server location that can be linked to them), or the private key is included in the decryptor program, and should be able to be sussed out...

Data recovery

So the encryption is sound, but did he just delete the old files after encrypting them or did he scrub the drive too.

Someone try to undelete the files with a disk recovery tool and see what you get. Just because the file is encrypted does not mean that the original was correctly destroyed.

Re:Make them talk?

Simple. Lock them in a cell with a person whose complete pr0n collection is now encrypted. Then go out and come back about an hour later. They talk. They will confess everything, including the assassination of JFK, just as long as they don't have to spend more time with someone whose jackoff material is gone and they're to blame for it.

Talk about motivation!