Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Encryption Operating Systems Software Windows Worms

Sneaky Blackmailing Virus That Encrypts Data 409

Posted by timothy from the ouch-and-double-ouch dept.
BaCa writes "Kaspersky Lab found a new variant of Gpcode which encrypts files with various extensions using an RSA encryption algorithm with a 1024-bit key. After Gpcode.ak encrypts files on the victim machine, it changes the extension of these files to ._CRYPT and places a text file named !_READ_ME_!.txt in the same folder. In the text file the criminal tells the victims that the file has been encrypted and offers to sell them a decryptor. Is this a look into the future where the majority of malware will function based on extortion?"
This discussion has been archived. No new comments can be posted.

Sneaky Blackmailing Virus That Encrypts Data More

Sneaky Blackmailing Virus That Encrypts Data

Comments Filter:

  • But were they smart, or stupid? (Score:5, Interesting)

    by pclminion ( 145572 ) on Thursday June 05, 2008 @04:59PM (#23675029)
    Question is, does the encryptor rewrite the data in-place, or just encrypt to a new file then delete the original? If the latter, the data is still recoverable with a simple undelete utility.

    • Re:But were they smart, or stupid? (Score:4, Insightful)

      by Anonymous Coward on Thursday June 05, 2008 @05:06PM (#23675131)
      ... or from handy backups...

      besides... do you really expect to get your data back after a hack like that? you're system is hosed, any correspondence with the malware author is only going to lead to more loss.

      you got pwnd, restore from backup, call the FBI if you're a good corporate citizen and have nothing to hide. Otherwise, get a Mac.

      • Re:But were they smart, or stupid? (Score:5, Insightful)

        by severoon ( 536737 ) on Thursday June 05, 2008 @05:52PM (#23675779) Journal

        I would happily contact the criminal and send them $1 after working with my bank and law enforcement to set up an account trace to see where the money goes and who ends up with it.

      • you got pwnd, restore from backup, call the FBI if you're a good corporate citizen and have nothing to hide. Otherwise, get a Mac.

        Getting a Mac will help for a while, but as more people switch to Macs malcontents will target OS X. And while it's more secure it's not totally secure, nothing is.

        Falcon

        Oh, and I'm not an MS fanbous, my desktop PC's OS is Linux and the laptop I'm typing this on is a MacBook Pro.

    • Re: (Score:2, Insightful)

      by moderatorrater ( 1095745 )
      Even if it's not, how are the criminals supposed to get their money? Worst case scenario, if this becomes widespread, people will start doing backups more often. The question at the end of the summary, like all slashdot questions, is dumb and doesn't promote discussion at all.

    • Re: (Score:3, Informative)

      by nine-times ( 778537 )

      Does it matter? I have backups.

      Really, this doesn't scare me very much. Can these people stop making money on spam, please, and let them try their hand at blackmail? Because it's fine-- a lot of people won't pay, and others will get the FBI to trace the money to the criminals behind it. They'll probably get caught, but either way they won't get me. Like any sane person, I have a firewall, don't open random attachments, and keep backups.

      • Re:But were they smart, or stupid? (Score:5, Insightful)

        by Anonymous Coward on Thursday June 05, 2008 @05:14PM (#23675263)

        Does it matter? I have backups.

        And how often do you roll through your backups? Will you notice the encrypted files in time, or will you end up backing up the worthless files instead?

        I have plenty of important files which I don't look at very often. It might take months before I realize they are corrupted -- and by that time, I've overwritten the last valid backup with the encrypted stuff.

        • Then we should paste a caption on you that says "Backups: Your doin it wrong."

          • Re:But were they smart, or stupid? (Score:4, Informative)

            by Crazy Taco ( 1083423 ) on Thursday June 05, 2008 @05:33PM (#23675545)

            Unless you have space for infinite backups, his method is write. At some point, you'll run out of space and have to delete old backups to make room for the new ones.

            • Re:But were they smart, or stupid? (Score:5, Informative)

              by SanityInAnarchy ( 655584 ) <ninja@slaphack.com> on Thursday June 05, 2008 @05:39PM (#23675635) Journal
              Given properly rolling backups, you don't just keep dailies for the past month. You keep dailies for a week, and weeklies for a month, and monthlies for however long you have space for.

              And given that most people work in files which are essentially text or the moral equivalent (Word docs, etc), it's likely that you do, in fact, have enough space for a very, very large number of backups.

        • Re:But were they smart, or stupid? (Score:5, Informative)

          by kesuki ( 321456 ) on Thursday June 05, 2008 @05:37PM (#23675591) Journal
          "And how often do you roll through your backups? "

          try 'never i use 1 time recordable optical media'

          i realize some people use 'rewritable' media for backups, and have this 'roll over' issue, but the only part of my backup that does rollover is the redundant external HDD for 'critical' data that i don't trust entirely to a DVD media, even is i only buy grade 1 media...

          I don't have a small data set either, I have over 1 TB of stuff on optical discs, but surprisingly only about 30 gigs that is important enough to go to a redundant hdd.

        • Re: (Score:3, Informative)

          by Carnildo ( 712617 )

          And how often do you roll through your backups? Will you notice the encrypted files in time, or will you end up backing up the worthless files instead?

          I don't know about most people, but my backups bear a strong resemblance to a versioned filesystem: it doesn't matter if the encrypted files wind up on the backup, because I can always roll back to a version before they were encrypted.

        • Re:But were they smart, or stupid? (Score:4, Interesting)

          by Cajun Hell ( 725246 ) on Thursday June 05, 2008 @06:00PM (#23675843) Homepage Journal
          It displays a message when it does it, presumably so that the virus-runner will know that they need to pay someone to decrypt their file. That makes it pretty un-scary: it tells you when to restore. Of course, since your machine is compromised, maybe the "restore" really just overwrites your tape.

          It might take months before I realize they are corrupted

          In which case the virus writer never gets payed, since his yahoo email account is probably long disabled by then.

          There's no point in delaying extortion. The kind of people who decide to run malware, are the same kind of people who don't have any backups, so they're ready to collect from, immediately.

        • Re:But were they smart, or stupid? (Score:5, Informative)

          by LurkerXXX ( 667952 ) on Thursday June 05, 2008 @06:00PM (#23675847)
          An important part of the backup process is to occasionally test the backups to make sure that they can be restored properly. corrupted backups suck, but do happen. I test my personal ones pretty regularly. I test my work ones on a set schedule. You should too.

          • Re: (Score:3, Insightful)

            by mlts ( 1038732 ) *
            This is an excellent idea. I know Retrospect allows for one to test not just the whole backup set, but whatever is new on the set to detect bad data on recent info.

            Backups require a chain of items to work correctly come restore time. You have to have something to read the backup media if its stored on CDs, DVDs, or tapes. You have to have the correct software and version of software. You also have to be able to get a dead machine in some state to be able to be restored, either by booting an OS or BartPE

      • Reminds me of... (Score:4, Interesting)

        by vivin ( 671928 ) <vivin,paliath&gmail,com> on Thursday June 05, 2008 @05:41PM (#23675643) Homepage Journal
        ...the Casino Virus [youtube.com]. Perhaps because of the similar concept of "holding data hostage".

        The virus takes your FAT and stores it in RAM. Then lets you play a slot-machine game. If you win, you get your data back. If you lose, you lose your data. Some other combination of characters (in the slot machine) gives you the virus-writer's phone number.
      • I thought of a virus along this line, but slightly different. What it would do is encrypt the data, decrypt on the fly until it is time to demand payment. All backups would have been encrypted too, if you have the correct hooks into the OS. I never tried it, since the dark side has a strong pull.

    • Re:But were they smart, or stupid? (Score:5, Insightful)

      by DigitAl56K ( 805623 ) on Thursday June 05, 2008 @06:20PM (#23676073)

      If the latter, the data is still recoverable with a simple undelete utility.
      No it isn't.

      Okay, it might be. Imagine it repeating the process on many files, each time a new file is written it may fill the space of the last deleted one. This also depends on the file system, OS strategy, file sizes, etc.

      Using an undelete utility means you risk recovering many corrupt files. That may be better than nothing or sending money to a malware author, which as much as I hate to say it may legitimately be classed as "funding terrorism".
  • I wonder if there will be tools / services that would be able to hammer at (or otherwise crack) the 1024-bit encryption and find the key.

    Does anyone know how bad this might be from a computational-power standpoint?

    • Re:Anti-Malware Response (Score:5, Informative)

      by pclminion ( 145572 ) on Thursday June 05, 2008 @05:02PM (#23675077)

      Uh, if 1024-bit RSA was broken, the world of encryption security would collapse (at least for the short term). Could it happen? Sure, it's possible. Will it happen in time to save your pr0n collection? Highly unlikely.

      For one thing, compromise of RSA encryption would render SSL useless.

      • Re:Anti-Malware Response (Score:5, Informative)

        by AmiMoJo ( 196126 ) on Thursday June 05, 2008 @05:36PM (#23675583) Homepage Journal
        The last version was eventually "cracked", because the virus used the same key for all the encrypted files so once someone paid up they could distribute the key.

      • 1024-bit RSA is NOT considered secure anymore (Score:5, Informative)

        by this great guy ( 922511 ) on Thursday June 05, 2008 @06:22PM (#23676087)

        As it was pointed out by another poster, no 1024-bit RSA is not sufficiently strong. Recent papers have demonstrated that factoring a 1024-bit key is now within practical reach. See for example this PhD dissertation from a student whose advisor was Shamir (the S in RSA FYI), which estimates that cracking a 1024-bit key would cost a few million US dollars [mit.edu].

        Sure, at this point only a small number of organizations have a few million dollars to spare on cracking RSA, but this is beyond the point. The flaw is sufficiently serious that security standards are now recommending 2048-bit RSA keys minimum.

        What I am talking about are relatively recent developments, it is not very well-known that 2048-bit is the minimum recommended length. This is why 1024-bit keys are still wildly used everywhere. My bank (www.wellsfargo.com) uses a 1024-bit key...

    • I think the big question is - does the virus carry it's own key around, or does it "phone home" to get a specific key for the infected machine?
      In the first key someone will most likely find the key in the virus code, in the second case it's BAD. Sure the NSA can break a 1024 RSA key if they have to, but I haven't heard of a "simple" commercial tool to do it.

      • Re: (Score:2)

        by Loether ( 769074 )

        Sure the NSA can break a 1024 RSA key if they have to
        Do you have a citation for that?

        I don't see why the laws governing the ability to break such a key would change for the NSA. A 1024 bit key is MUCH more than twice as hard to crack as a 660 bit key. Maybe someone can help me with the math? something like 2^(1024 - 660) times harder to crack?
        • You forget though, the NSA has a large budget and access to super computers. What might take us years to crack may only take months or less for a few huge clusters of computers or some super computers to break. Plus, as everything the NSA does is "a matter of national security" they can request a super computer to do that.

    • I wonder if there will be tools / services that would be able to hammer at (or otherwise crack) the 1024-bit encryption and find the key.

      Wouldn't one person be able to pay of the extortion, and then give out the key to everyone else?

    • Re: (Score:2)

      by Goaway ( 82658 )

      Does anyone know how bad this might be from a computational-power standpoint?
      Not happening.

  • LET'S HOPE SO (Score:5, Insightful)

    by blair1q ( 305137 ) on Thursday June 05, 2008 @05:01PM (#23675051) Journal
    Seriously. In order for extortion to work, money has to change hands. Money can be traced, easily (don't believe what they say about Western Union). This is a great way to track down and capture the people who are spreading the virus. And the people whose files are encrypted could as easily have seen those files deleted, or worse. So it's no difference to them, except that they now have a hand in putting a crook behind bars.

    The virus tossers are actually making their situation worse by turning to extortion. But they weren't all that bright to start with.

  • Is this the future? (Score:5, Funny)

    by Anonymous Coward on Thursday June 05, 2008 @05:01PM (#23675055)

    Is this a look into the future where the majority of malware will function based on extortion?

    I don't know! Stop asking me those questions all the time. Is it obligatory to end every blurb with a question, or what?

  • They think they're pretty clever. (Score:5, Insightful)

    by Anonymous Coward on Thursday June 05, 2008 @05:02PM (#23675081)
    The fundamental problems with hairbrained schemes like these is that the money has to change hands somehow, and there's a fundamental trust issue. First, if money gets transferred to you then you are susceptible to being caught.

    The trust issue is that there is fundamentally no reason for the person receiving the money to follow through and send you the private keys to decrypt the data. If it was a known person, they'd be arrested, and since they're unknown there is no "reputational" factor that would make people more likely to pay based on the experience of others.

    Just another moron criminal scheme from some douchebag who thinks he's found a get rich scheme. Just like other "genius" criminals, the fact is that the professionals in the field are smarter than the criminals.

  • This has been done before (Score:5, Informative)

    by mrbill1234 ( 715607 ) on Thursday June 05, 2008 @05:03PM (#23675085)
    This same thing happened in the late 80's (or maybe early 90's). Some hackers mailed a 5.25 inch floppy with some "free" software on it to thousands of people around the world. When you installed the software, it would hijack your PC and encrypt various files and you had to pay a ransom to get it back. There was a EULA and everything with the disk (which of course nobody read) which made it clear what would happen if you installed the disk. Perhaps someone can remember what it was called.
  • At least know the owners of bot controlled machines will have a clue that their machines are bot controlled. And maybe we'll see fewer bot controlled machines.

    One can only hope.
  • If you back up regularly (and if you don't, what the hell are you thinking -- hard drives last forever?) then this is a non-issue. Yawn.

  • All your dataz (Score:5, Funny)

    by Anonymous Coward on Thursday June 05, 2008 @05:08PM (#23675153)
    Joe User: Someone set us up the encryption. We get no data. Readme file turn on.
    Jack Hacker: How are you gentlemen? All your data are belong to us.

  • Gonna be ok (Score:5, Funny)

    by Joebert ( 946227 ) on Thursday June 05, 2008 @05:21PM (#23675365) Homepage
    I'm not going to worry about this.
    I'm sure the fine folks of our Government are watching everything that happens on my computer & will promptly decrypt my files for me using their built-in back doors.

  • I got infected by this virus (Score:5, Funny)

    by Anonymous Coward on Thursday June 05, 2008 @05:21PM (#23675367)
    My computer was infected by this virus... luckily all my files were already encrypted so all it did was make plain-text versions of everything and leave me a file asking for a donation
  • Maybe it will not surprise you to know that Geek Squad is behind this scam. They will never try to collect extortion money as their real target revenue is the 65 dollar check-up fee they will get when consumers bring their computers in to find out what has gone wrong. Of course, the fee is higher if you don't have extended warranty, or if you installed your own antivirus software.

    Of course I could be wrong.... but it's a thought
  • Viruses up to date have been using conventional encryption, with the obvious problem that the key is found in the virus. If only general population improves their computer literacy in proportion to malware writers, headlines such as this one will become the thing of the past.

    I am however disappointed that the author used only 1024 bit key length, which is no longer recognized as unconditionally secure. Hopefully he or she at least generated a secure random seed for the key pair.
  • This sounds like a straightforward implementation of cryptoviral extortion [cryptovirology.com]. Hopefully, the authors made some stupid mistake (like using the same key everywhere, or encrypting the data directly instead of doing it indirectly through a symmetric crypto key).

    Still, the basic strategy remains viable, so the best opposing strategy would be to harden systems. Unix permissions won't help you here, since you usually have rights to write or alter permissions to stuff in your home directory. Backups would work (bu

  • Yeah, sure, *that'll* work.. (Score:5, Insightful)

    by Duncan Blackthorne ( 1095849 ) on Thursday June 05, 2008 @05:25PM (#23675425)
    *ransom note received composed of random letters clipped from newspaper*

    "We have encrypted your illegally copied music files. Put $5000 in unmarked bills in a plain brown paper sack and mail it to: RIAA Washington, D.C. no later than midnight tonight or you'll never listen to your music again"

    ..but seriously, folks, this starts to sound like some sort of wierd 419 scam. They're not going to decypt your files even if you pay them, and I'll bet you a whole DOLLAR that if you're stupid enough to contact them, they accept only CREDIT CARDS as payment. Chances are that the data isn't even really encrypted, it's just plain overwritten and GONE, copied over with gobbledegook random data, and you'll just get your identity stolen on top of never getting your files back. On the other hand they think they're being really clever, I'm sure, and the ones that think they're clever are usually the ones that get caught quickly and go to jail for a long, long time.

  • Oh, this is going to be rich. These guys have read too much William Gibson. Unless the whole thing is a Joe-job trying to get some innocent (ish) third party in trouble, these folks are going to find it pretty damn hard to collect any money without being traced, and this is more than commonly illegal.
  • They can reverse engineer it, find out how it generates the encryption keys and reverse the algorithm - and crank out a utility that does it automatically. (Assuming it doesn't just write randomized data into the _CRYPT file and sucker you into sending them $ in hope of recovering what you lost, but at least then they would know the file is unrecoverable)

  • If you look at the screen prints from the article, the stupid author decided to use a "@yahoo.com" e-mail address. Call me crazy but Yahoo is probably already monitoring that e-mail box after the AV vendors let them know--long before any $$$ changes hands.

    Unfortunately, 2 years from now, some poor soul will get bit by this... By then the Yahoo e-mail address will be long-dead, and the key might still be known only to the author...

  • data ransom != blackmail (Score:5, Informative)

    by Deanalator ( 806515 ) <pierce403@gmail.com> on Thursday June 05, 2008 @05:47PM (#23675719) Homepage
    This is data ransom, not blackmail.

  • Actually it's called Ransomware (Score:5, Informative)

    by ewhenn ( 647989 ) on Thursday June 05, 2008 @06:12PM (#23675991)
    http://en.wikipedia.org/wiki/Ransomware_(malware) [wikipedia.org]

    The crypting your files and extort has been around since 1989 http://en.wikipedia.org/wiki/PC_Cyborg_Trojan [wikipedia.org]

  • No, the future is either... (Score:3, Informative)

    by istartedi ( 132515 ) on Thursday June 05, 2008 @11:39PM (#23678571) Journal

    ...easy-to-use backups, and/or the government tracking down the payments and busting the guy who receives it.

    Of course, if you are just backing up to the hard drive, the virus will make sure to trash your backups. Better back up to a non re-writeable CD. Most people's unique data isn't that large. If it is, you should be doing nightly offsite backups anyway.

  • old news - see Onehalf (Score:3, Interesting)

    by hany ( 3601 ) on Friday June 06, 2008 @02:23AM (#23679237) Homepage

    Anyone heard about Onehalf [wikipedia.org]? We're talking something like 1992-94 IIRC. :)

    If my memory serves me right even further, the virus is from Kosice, Slovakia. It spread quite quickly (even though there was essentialy no Internet at that time in Slovakia) but later on, I believe ESET [eset.com] produced a utility to detect it and clean it up. Nice thing was, that it did not need to boot from clean boot floppy in order to do the clean-up (which was quite unussual at that time).

    Funny thing then was, that few month later, as we though that Onehalf is - thanks to that utility - dead and old news, story came from USA that Onehalf reached there and that after a lot of trouble Norton was able to detect it. But not clean it. What a joke. If we've had email, we would happily mass-mail that ESET's anti-Onehalf utility to every one.

    Maybe further info: ESET's One Half entry [www.eset.eu].

Slashdot Top Deals

Don't get suckered in by the comments -- they can be terribly misleading. Debug only code. -- Dave Storer

Close