Slashdot Mirror
DecryptorMax/CryptInfinite Ransomware Decrypted, No Need To Pay Ransom (softpedia.com)
An anonymous reader writes: Emsisoft has launched a new tool capable of decrypting files compromised by the DecryptorMax (CryptInfinite) ransomware. The tool is quite easy to use, and will generate a decryption key. For best results users should compare an encrypted and decrypted file, but the tool can also get the decryption key by comparing an encrypted PNG with a random PNG downloaded off the Internet.
Apparently, the bad-guy equivalent of script kiddies (or toddlers) put this ransomware out. No program should be able to decrypt a "properly" encrypted file, or set of files, in a few hours. A lot of people dodged a bullet here as Emsisoft puts out great software. Kudos to them for offering this tool
It's the majority not using Linux who are keeping the Linux users safe by being the larger target.
Why would you need a random .png from the Internet? Can't they just keep whatever part they need (header?) as part of the binary?
When the copyright term is "forever minus a day", live every day like it's the last.
Does not help. Linux is making competent people a lot saver, but it will do nothing for incompetent ones, unless they are willing to pay for professional system administration. The difference is that even with professional system administration, Windows remains a problem, while Linux is not. But without it, they are both insecure.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I wondered why the summary has links to articles on Softpedia and Bleeping Computer instead of linking directly to Emsisoft, whose employee wrote the decryption utility. But it seems Emsisoft has dropped the ball, as they have nothing on their home page or their blog or their changelog that mentions this tool. In fact I can't find any reference to this on their site at all, which makes me suspicious about downloading it.
Both of the articles in the summary point to a link on emsi.at instead of emsisoft.com. Domain registration and name servers point to emsi.at being a legitimate host under the control of Emsisoft, but who knows? What a weird way to release a security tool, with zero announcements on your company website and the download hosted at a URL shortener.
May I assume you are one of those folks that believe in the infallibility of Linux? There is already ransomware for Linux, although to the best of my knowledge most of it is in the form of a trojan, and not something that can run by itself or abuses privilege escalation. I use Linux for my daily driver, and thanks to Win 10s privacy shenanigans don't plan to ever go back, but that doesn't mean the shit's perfect. Hell, given the prevalence of linux in the web infrastructure, I could see linux ransomware having a serious boom soon. Corporations can pay a lot higher ransom than your average Joe. As for home linux ransomware, you can bet your sweet ass-meat that SteamOS will be a tempting target. Make individual customers pay up to get their machines working again, and then make Valve pay up to get you to release the rest that refused to pay in order to preserve their reputation.
I don't see how people are still not making proper backups of their data to completely negate the effectiveness of ransomware.
It just seems like it would be common sense to consistently backup data s a good practice.
Is this old news day on /.? 3 articles in a row that have been reported elsewhere days ago.
The ransomware gets its name from the fact that the "DecryptorMax" string is found in multiple places inside its source code.
They distributed the source code with the ransomware? I'll bet that was handy when it came to reverse engineering it.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
How exactly does this ransomware get onto your computer?
Why would you need a random .png from the Internet? Can't they just keep whatever part they need (header?) as part of the binary?
I'd guess: .png file was long enough that any .png file could function as the "clear" for any encrypted .png (or at least that many unrelated pairs could do that.)
- The authors wrote the tool to use enough of the start of an encrypted/clear file pair to generate / sieve the key and deployed that.
- Some used discovered, after the tool was deployed, that the invariant header of a
I'd bet that, if the authors had thought there was a nearly-universally-present file type the ransomware would chose to encrypt, with a large enough header to pull off this trick, they'd have included a canned header and the option to use it in the tool.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way