Slashdot Mirror
Using Distributed Computing To Thwart Ransomware
I Don't Believe in Imaginary Property writes "The folks at Kaspersky labs are turning to distributed computing to factor the RSA key used by the GPcode virus to encrypt people's files and hold them for ransom. There are two 1024-bit RSA keys to break, which should require a network of about 15 million modern computers to spend a year per key factoring them. Unfortunately, there appear to be no vulnerabilities in the virus' use of RSA, unlike some previous cases. Perhaps more interestingly, there's some debate over whether people should bother cracking it. After all, what if they were trying to trick us into factoring the key for a root signing authority? Besides, there's a more direct method of breaking the encryption: track down the people who wrote the virus and force them to talk."
Surely all the have to do is start using a new key every so often, and the task becomes pointless?
Encourage people to make backups of their data on disc, tape, or portable harddrives. I know that's a radical idea, but it just might be crazy enough to work.
SJW: Someone who has run out of real oppression, and has to fake it.
Where's Jack Bauer when you need him ???
Votez ecolo : Chiez dans l'urne !
If only I hadn't erased Jack Bauer's cell from my contact list after the last season...
My 0.02 cents
How are we going to do that? Everyone knows that things aren't nearly as fun as they used to be... people are even complaining about waterboarding now! what's this world coming to? Shoot, I remember when you could put a man on the rack - no problem.
You are using English. Please learn the difference between loose and lose; they're, there, and their; your and you're.
The people who did that sit in a country ending in -stan. Countries ending in -stan have real problems and don't care for problems their citizens cause abroad.
You can trust me on that one, I've tried. I've even had so much as the name of the person to prosecute. Nothing came out of it. Despite including our federal police and interpol.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
They are best off using a large botnet then. Perhaps modify the extortion virus itself so that it's part of solution rather than part of the problem.
15 million CPU years per key? And the attacker can just make up new keys as often as he likes. He could even make a different key for each target if he wanted.
15 million CPU years is a lot to spend when you could just restore from backups.
The size of the keyspace doubles per bit, 2^1024 is the size of keyspace.. Brute factoring the key is not happening..
... or bribing them! Hah! Foiling their plans of locking peoples files down! Oh, wait...
My 0.02 cents
Fortunately, we had Interbank Data Recovery Services. And Interbank does more than just acquire the decryption key.
That's because Interbank vows to find out who sent you the ransom and hunt them down like animals. Like filthy, dirty animals. That's the Interbank difference. See, I don't care how Interbank's secret police get things done. I just care that they get things done. For us.
Plus, because we'd enrolled in their Premiere Membership program, Interbank also hunted down friends and relatives of the guy who had encrypted our data, dragged them from their beds in the middle of the night, and set fire to their homes.
As long as security is valued at zero dollars when the IT bean counters are evaluating platforms and vendors crapware will proliferate.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Don't forget the corollary.
... how about just including a simple script that will look at how it's installed TODAY and back it up to a location chosen by the user? And then that script will generate a script to install that backup should you need it to. Along with license keys and decoding keys and unlocking keys, etc.
Encourage the application writers to make their applications EASY TO BACKUP.
The problem I keep seeing is that TELLING someone to back up their data is easy to do. FINDING ALL of the data is just about impossible.
You'll never know if you got it all until AFTER a problem.
Or even
The screenshot at http://news.cnet.com/8301-10784_3-9965381-7.html?tag=nefd.top says that the victim pays to download a 'decryptor'. Either the decryptor contacts, in real time, the extortionist (at a server location that can be linked to them), or the private key is included in the decryptor program, and should be able to be sussed out...
So, there are two possibilities here:
Either way, this seems like a pretty strong (if harsh) lesson for end users. If #1, use better software, like your geek friends have been telling you this for years. That doesn't have to mean installing Ubuntu; it could just mean upgrading from IE6 to Firefox (or IE7), or from Outlook Express to Thunderbird (or Gmail). If #2, then haven't you been told about 1,000 times not to do that? Now do you see why?
I truly feel bad for people who get nailed for this, in almost exactly the same way I feel bad for my kids when they touch the stove after I've told them it was hot.
Dewey, what part of this looks like authorities should be involved?
You must be new here.
If you haven't been down-modded lately, you aren't trying.
Sacred cows make the best hamburger.
So the encryption is sound, but did he just delete the old files after encrypting them or did he scrub the drive too.
Someone try to undelete the files with a disk recovery tool and see what you get. Just because the file is encrypted does not mean that the original was correctly destroyed.
Im a gamer, not a grammer major. This post is full of spelling and grammer mistakes.
I suppose if the file in question was something like a manuscript for a novel, where the owner can more or less verify it by eye, and (importantly) there isn't that much downside if our opponent sneaks some changes in, that might be worthwhile. But in general...
"Not an actor, but he plays one on TV."
Is it targeted manually, or is it a specifically directed attack? If it's out in the wild being spread [cough] virally, rather than being inserted into specific targets, then what happens when a mobster's double book accounting system gets infected. Some people have mentioned ruthless CEO's - but if this infected the wrong system, these folks could have someone after them with no restraint, deep pockets, and the resources and experience to root them out. Do I smell a TV movie in the offing?
If this is the least bit surprising to you, all I can say is that you are not very up to date with cryptography. Security against a so-called "known plaintext attack" is an absolutely stock standard criteria for ciphers these days. For the last few decades no serious cipher has been substantially weaker against known plaintexts than against random plaintexts.
For the Registry, you can "export" the entries for that app to a file and, later, you can import that file into the Registry.
The problem with the Registry is the same as you've noted with the file system. Stuff gets put EVERYWHERE. And there is no way to KNOW that you have EVERYTHING until AFTER you attempt to restore it. AND that doesn't include anything "updated" when you get a patch or point-zero-one release "upgrade".
Now, the installer can put that stuff everywhere
And I don't want to hear that that is to prevent "piracy". Just encrypt the stuff with the unlocking key or whatever. That way I can keep a TEXT file of app-name -- key code on my USB drive along with the backups.
Then I got a virus.
Since then, I make regular backups. Back in my childhood I did regular backups of my family's computer.
Then we got a virus.
Then we realized that the virus was a time bomb that was already present in dormant form even in the oldest several-months old backups.
Sometimes you have parents that are both computer geeks, and they teach you the important of offline backups. Never the less, shit happens anyway.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
The article mentioned that despite the IP addresses of the email are from China, the fact is the people behind the GPcode campaign are Russian. That makes me wonder that how many computers in China has been turned into Russian zombies. That may well explain the reason why most attacks against U.S. Government networks are originated in China.
"The New Age. The New Beginning."
Why waste time factoring RSA?? The RSA simply wraps an RC4 key.
RC4 brute force is far easier. There are several known problems with RC4 which may possibly work to our advantage in cracking the data as well..
I said no... but I missed and it came out yes.
Oh, I do: as long as it's not the government doing the compelling.
Just once it'd be fun to hear that the local mafia don's PC got infected because his wife wanted cute smileys, and that the local prosecutor is frustrated by the lack of direct evidence linking the don to what they found down by the river.
Dewey, what part of this looks like authorities should be involved?
Enterprise-level backup apps are almost always 3rd-party, not "some kind of unreliable M$ thing". Any serious solution also has a means to restore to bare metal, so in effect you need no OS at all to do this.
(and when was the last time anybody kept any current work on a floppy? Cripes - 1992 called and they want their backup devices back).
Quo usque tandem abutere, Nimbus, patientia nostra?
Actually, RSA is vulnerable to chosen plaintext. That is one of the reasons why a signature system encrypts the hash of the document instead of the document itself.
In this case it is a randomly generated symmetric key that is encrypted so known plaintext won't help. I wonder if the white hats have looked closely at the key generation code. There is a good chance that there isn't much entropy in the keys and the keyspace can be narrowed down enough to make guessing the symmetric key feasible.
Given the choice between fifteen million CPU years spent breaking keys and about ten minutes of breaking fingers, it seems pretty clear which one is more efficient.
Track them down and kill them.
You should probably get the private key from them first.
It took me a bit of work, but I think I got it. Can someone double check my work? This is the key that I came up with:
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0