Questions tagged [ransomware]

Ransomware is a lethal kind of Malware that Encrypts your harddrive(s) and holds them hostage, providing the decryption key if you pay the hostage-taker(s) money (well-known variants are the FBI Virus and the Police Virus).

Filter by
Sorted by
Tagged with
1 vote
1 answer
92 views

Encryption scheme with variable and provable key-length

I'm currently studying the possibility of a novel ransomware technique, where an adversary instead of forcing the victim to pay a ransom, forces them to brute force a key of given length and thus ...
limeeattack's user avatar
0 votes
2 answers
597 views

Hash Comparison to Detect Ransomware File Encryption

As detailed in a separate question, I thought I had a way to detect the type of ransomware that encrypts files silently, and then decrypts them on the fly, so as to prevent the user from realizing ...
Ray Woodcock's user avatar
0 votes
1 answer
102 views

Suitable hybrid encryption approach?

I need help for my bachelor thesis. I have a general question regarding hybrid encryption in different ransomware. The hybrid encryption often uses symmetric and asymmetric encryption techniques. ...
kselight's user avatar
1 vote
2 answers
527 views

Why can't ransomware practically use RSA to encrypt all files?

I understand that a few ransomware have used an RSA public key to encrypt all files belonging to the victim. This is a bullet-proof system in terms of its security because the private key is always ...
learnerX's user avatar
  • 687
0 votes
1 answer
572 views

Could a quantum computer recover files from ransomware if the attacker doubly encrypted them with RSA-4096?

How would a quantum computer decrypt a file (or find the keys to such a file) if it were encrypted with standard RSA 4096 encryption, but encrypted two times with different keys? The keys are known by ...
Jake L.'s user avatar
2 votes
1 answer
221 views

why ransomwares are still problematic?

There is some points that I don't understand yet about ransomwares : the attacker generally put his bitcoin address in the malware, can this address be used to identify and reach him ? on the ...
Reda LM's user avatar
  • 133
-2 votes
2 answers
1k views

Breaking Ransomware encryption

Recent news reports show that the UK's NHS (Nation Health Service) has suffered a major ransomware attack which is also affecting other parts of the world especially Spain and Russia, the effect is to ...
Naz's user avatar
  • 125
1 vote
1 answer
69 views

Paid decryption scheme and possible attack surface

This is how ransomware can work as far as I understand: Most ransomware works with symmetric encryption on individual files. For each file the script generates a new key. A list is then generated ...
joop s's user avatar
  • 93
2 votes
2 answers
103 views

Could a collection of data be engineered to encrypt predictably using standard encryption algorithms?

Thinking about the rather new problem of Cryptolocker and other crypto-randomware, huge amounts of damage are being caused by malicious actors simply using modern encryption algorithms to encrypt a ...
TheEnvironmentalist's user avatar
0 votes
1 answer
621 views

How to detect what crypto-method is used by Filecoder.Q?

I have 2 different images, one original, and one locked by a malware detected by eset as "Win32/Filecoder.Q". How to detect the encryption method that is used and the key, that is not using any ...
Daniel's user avatar
  • 9
3 votes
2 answers
551 views

Is it possible to decrypt cryptowall-encrypted files? [duplicate]

I am writing regarding a certain ransomware program called cryptowall (prop 4.0). I have lost many documents to this, and as it so happens, I have a few file duplicates before and after they were ...
geok's user avatar
  • 31
2 votes
1 answer
817 views

Understanding ransomware – What makes plain-text-attacks or brute-forcing so hard?

Say I have four files. Two are completely unencrypted, while the other two are the exact same files other than that they have been encrypted with (apparently) the same public key (via a ransomware ...
Excille's user avatar
  • 29
0 votes
1 answer
493 views

Help with RSA-2048 crypto ransom virus [closed]

The RSA-2048 Crypto Ransom Virus has devastated me, I tried the backup method, the previous version, the Shadow Explorer, it deleted all my restore points, Its took out 5 HDs and my USB pen that ...
autotech101's user avatar
1 vote
1 answer
730 views

Knowing pre-encryption data, can we find the private key CryptoWall used?

I'm just repurposing a question already asked about Cryptolocker for CryptoWall: "If we know exact contents of some of the files prior to them being encrypted, would it be feasible to use those ...
MikeM's user avatar
  • 19
8 votes
1 answer
757 views

Timing attack on RSA as used by CryptoLocker?

So far I have researched timing attacks on RSA, We all know the ransomware named CryptoLocker uses RSA 2048 bit encryption. Now, is it possible to break the encryption using a timing attack. I have ...
user3319959's user avatar
8 votes
1 answer
2k views

Knowing pre-encryption data, can we find the private key CryptoLocker used?

One of our users seems to have been hit by CryptoLocker. As a result, he has a hard drive full of encrypted files. The ransom-ware claims to have used public key encryption on the files. If we know ...
poke's user avatar
  • 183