2
$\begingroup$

There is some points that I don't understand yet about ransomwares :

  • the attacker generally put his bitcoin address in the malware, can this address be used to identify and reach him ?
  • on the assumption that the malware use symmetric encryption, can we use reverse engineering to retrieve the key ?
  • on the assumption that the malware use asymmetric encryption, can we use the server which deliver the decryption key after payment to reach the attacker ?
  • as far as I know practically the files themselves aren't encrypted, but another file is created using the secret key then the original file is deleted, so can we use a file recovery program to recover everything ?
Improve this question
$\endgroup$
3
  • $\begingroup$ 1) maybe, but it's non-trivial AFAIK 2) no, uses asymmetric 3) TOR can be used to mitigate that 4) old copies are deleted as are shadow copies, decent ransomware probably would securely wipe the files (there may happen some overwriting anyways because old, deleted files are overwritten when the encrypted copies are created) $\endgroup$
    – SEJPM
    May 13, 2017 at 19:49
  • $\begingroup$ Also check the ransomware Q&As at our site. If I'm not mistaking, some of your sub-questions are already answered. $\endgroup$
    – e-sushi
    May 14, 2017 at 10:47
  • $\begingroup$ Re #3, do they even hand out decryption keys after getting paid? If I were the attacker, I'd just take my money and never contact the victim again. Less chance of getting caught. $\endgroup$
    – Jörg W Mittag
    May 14, 2017 at 23:48

1 Answer 1

Reset to default
6
$\begingroup$

  • Public key cryptography lets the ransomware encrypt files so that only the malware author (who has the private key) can decrypt them or supply the needed per infection key.

  • Payment in Bitcoins is traceable, since all Bitcoin transactions are public. If the attacker transferred their Bitcoins to an exchange directly and converted them to a conventional currency, law enforcement could demand the records and find their identity. Mixing services allow the attacker to mix their coins together with lots of other legitimate coins, hiding where they end up. Mixing services exist and are only getting better.

  • The decryption for Bitcoins service can be hosted as a TOR hidden service. The attacker can set up a server that watches the bitcoin blockchain for bitcoin payments and provides one decryption key per payment. There is no link between the attacker and the servers except for the initial setup (which can be done through tor) and hosting fees (which can be paid in bitcoins).

All of these technologies are proven. It's just a matter of setting everything up and infecting victims. Until the general public learns to do better backups ransomware is here to stay.

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ On the question's last bullet, my try (although this is off-topic): 1) it is possible to owerwrite the original plaintext with the ciphertext; 2) effectively erasing the original plaintext from spinning rust disks is easy; 3) file recovery does not work reliably in general, and typically not after many create/delete cycles on a disk without ample free space. // Apparently, the recent WanaDecrypt0r is made possible by an original weakness in Microsoft code; the NSA exploiting it (rather than reporting it); the leak of the code NSA developed for that; and the greed/nastiness of the perpetrator. $\endgroup$
    – fgrieu ♦
    May 14, 2017 at 16:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.