Suitable hybrid encryption approach?

Question

I need help for my bachelor thesis. I have a general question regarding hybrid encryption in different ransomware. The hybrid encryption often uses symmetric and asymmetric encryption techniques.

During an infection the symmetric key will be generated on the system. This symmetric key will be encrypted with the public key of the asymmetric key pair. The public key can be hardcoded in the source code of the ransomware. Now I read an article that says this is an bad approach, because if one victim will pay the ransom he can share the private key. That is right, but is it possible that the victim send me his encrypted symmetric key and I will send the decrypted key back?

Have I overlook something?

I hope someone could help me to clarify this understanding problem.

Answer 1

That is right, but is it possible that the victim send me his encrypted symmetric key and I will send the decrypted key back?

I have not personally written any ransonware, nor have I examined how they operation; however if I were to, that is what I would do - once the victim has paid up, they would send a copy of the encrypted symmetric key, decrypt it, and send it back to them (so that the various files could be decrypted and restored).

Since we would never send the private key to the victim, they could not share it (and hence the concern the article you reference would not apply).