Slashdot Mirror
DecryptorMax/CryptInfinite Ransomware Decrypted, No Need To Pay Ransom (softpedia.com)
An anonymous reader writes: Emsisoft has launched a new tool capable of decrypting files compromised by the DecryptorMax (CryptInfinite) ransomware. The tool is quite easy to use, and will generate a decryption key. For best results users should compare an encrypted and decrypted file, but the tool can also get the decryption key by comparing an encrypted PNG with a random PNG downloaded off the Internet.
It will teach all you Linux using nerds a lesson.
Apparently, the bad-guy equivalent of script kiddies (or toddlers) put this ransomware out. No program should be able to decrypt a "properly" encrypted file, or set of files, in a few hours. A lot of people dodged a bullet here as Emsisoft puts out great software. Kudos to them for offering this tool
Who the heck is getting infected with ransomware in 2015? Use Linux.
Why would you need a random .png from the Internet? Can't they just keep whatever part they need (header?) as part of the binary?
When the copyright term is "forever minus a day", live every day like it's the last.
I wondered why the summary has links to articles on Softpedia and Bleeping Computer instead of linking directly to Emsisoft, whose employee wrote the decryption utility. But it seems Emsisoft has dropped the ball, as they have nothing on their home page or their blog or their changelog that mentions this tool. In fact I can't find any reference to this on their site at all, which makes me suspicious about downloading it.
Both of the articles in the summary point to a link on emsi.at instead of emsisoft.com. Domain registration and name servers point to emsi.at being a legitimate host under the control of Emsisoft, but who knows? What a weird way to release a security tool, with zero announcements on your company website and the download hosted at a URL shortener.
I don't see how people are still not making proper backups of their data to completely negate the effectiveness of ransomware.
It just seems like it would be common sense to consistently backup data s a good practice.
Please help my team at #Greythorn be statistically relevant by taking our five minute anonymous tech market survey: http://bit.ly/tech-ashina -- for every survey completed we will donate a $1 to the Apache Foundation #TheASF #ApacheBrooklyn
Is this old news day on /.? 3 articles in a row that have been reported elsewhere days ago.
The ransomware gets its name from the fact that the "DecryptorMax" string is found in multiple places inside its source code.
They distributed the source code with the ransomware? I'll bet that was handy when it came to reverse engineering it.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
How exactly does this ransomware get onto your computer?
Why would you need a random .png from the Internet? Can't they just keep whatever part they need (header?) as part of the binary?
I'd guess: .png file was long enough that any .png file could function as the "clear" for any encrypted .png (or at least that many unrelated pairs could do that.)
- The authors wrote the tool to use enough of the start of an encrypted/clear file pair to generate / sieve the key and deployed that.
- Some used discovered, after the tool was deployed, that the invariant header of a
I'd bet that, if the authors had thought there was a nearly-universally-present file type the ransomware would chose to encrypt, with a large enough header to pull off this trick, they'd have included a canned header and the option to use it in the tool.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way