Slashdot Mirror
Using Distributed Computing To Thwart Ransomware
I Don't Believe in Imaginary Property writes "The folks at Kaspersky labs are turning to distributed computing to factor the RSA key used by the GPcode virus to encrypt people's files and hold them for ransom. There are two 1024-bit RSA keys to break, which should require a network of about 15 million modern computers to spend a year per key factoring them. Unfortunately, there appear to be no vulnerabilities in the virus' use of RSA, unlike some previous cases. Perhaps more interestingly, there's some debate over whether people should bother cracking it. After all, what if they were trying to trick us into factoring the key for a root signing authority? Besides, there's a more direct method of breaking the encryption: track down the people who wrote the virus and force them to talk."
Surely all the have to do is start using a new key every so often, and the task becomes pointless?
Encourage people to make backups of their data on disc, tape, or portable harddrives. I know that's a radical idea, but it just might be crazy enough to work.
SJW: Someone who has run out of real oppression, and has to fake it.
They are best off using a large botnet then. Perhaps modify the extortion virus itself so that it's part of solution rather than part of the problem.
As long as security is valued at zero dollars when the IT bean counters are evaluating platforms and vendors crapware will proliferate.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Don't forget the corollary.
... how about just including a simple script that will look at how it's installed TODAY and back it up to a location chosen by the user? And then that script will generate a script to install that backup should you need it to. Along with license keys and decoding keys and unlocking keys, etc.
Encourage the application writers to make their applications EASY TO BACKUP.
The problem I keep seeing is that TELLING someone to back up their data is easy to do. FINDING ALL of the data is just about impossible.
You'll never know if you got it all until AFTER a problem.
Or even
So the encryption is sound, but did he just delete the old files after encrypting them or did he scrub the drive too.
Someone try to undelete the files with a disk recovery tool and see what you get. Just because the file is encrypted does not mean that the original was correctly destroyed.
Im a gamer, not a grammer major. This post is full of spelling and grammer mistakes.
I suppose if the file in question was something like a manuscript for a novel, where the owner can more or less verify it by eye, and (importantly) there isn't that much downside if our opponent sneaks some changes in, that might be worthwhile. But in general...
"Not an actor, but he plays one on TV."
Quite simple and very effective and can be done using standard tools:
1. Encrypt victim's data with random AES key
2. Store key in body of a PGP message for yourself
3. Get victim to send you the PGP message
3. Decrypt PGP message using private PGP key, find AES key
4. Send AES key to victim - for a price...
Seriously, this could probably be hacked together in the matter of a few hours if explained to someone knowledgable. The private key never leaves the bad guys. And if they decide the heat is on and torch the operation and set it up elsewhere you're 100% screwed. Trying to crack this must be the most useless operation ever, they could easily make the keys stronger and thousands of years would pass to crack it. In one word: Nasty.
Live today, because you never know what tomorrow brings