Re:The No More Ransom Project
by firethief on Monday October 31, 2016 @02:16PM
(#12839457)
That only matters for content created after the malware was installed though, assuming the backups' snapshot interval is reasonable. The malware doesn't usually hang around very long, does it? If it's detected while it can still hide, it still has the decryption keys.
[ Parent
| on HN ]
Re:The No More Ransom Project
by serendipitous on Tuesday November 01, 2016 @01:26AM
(#12843621)
> it still has the decryption keys
No, they (usually) work similar to PGP/GPG, i.e. each file is encrypted with a different AES key and the AES key is encrypted with a public RSA key. The original AES key for a particular file is immediately deleted from memory after the file is encrypted and the private RSA key (needed for decrypting the AES key that is stored in the file) only ever gets delivered to the system if the ransom is paid.