There seems to be an inverse correlation between smart and evil in human beings which is reassuring, but only mildly.
Indeed, this isn't the first time ransomware with bad crypto has lead to a win for the good guys:
http://blog.cassidiancybersecurity.com/post/2014/02/Bitcrypt...
http://0xec.blogspot.com/2016/04/reversing-petya-ransomware-...
Having this public doesn't really defend against it any way. And if someone were to perform this act, it would be easy enough to figure out what was going on.
We should be moving to better solutions regardless, like append-only backups.
Any bad guys with sufficient ambition and intelligence are going to get as far as they're going to get, and if you're afraid of talking in public because a "bad guy" might overhear you and become smarter, you really are living on the wrong side of matters.
You're saying like "We should not teach programming publicly since bad guy may misuse the knowledge."
It seems that what they're doing is generating a local Kpub/Kpriv pair, encrypting Kpriv itself and then offering to decrypt it. The files are encrypted with Kpub (approximately, see comments below for details). This has the advantage that they can encrypt all they want without knowing Kpriv, which only needs to live in memory long enough to get encrypted.
I'm surprised ransomware doesn't use the TPM to protect their private keys - given that more computers have it now.
The post said encryption is performed with a new symmetric key K, and then K is encrypted with the attacker's asymmetric public key.
Remember asymmetric encryption doesn't scale for large amounts of data - which is why systems like TLS and full-disk-encryption still use symmetric keys - the asymmetric cryptoschemes are only really used during handshaking and for the exchange of symmetric keys.
The generated key is encrypted and the user has access to it. So, you send the encrypted key and pay the randsome to get the unecrypted private key. Is that so?
>... get The unencrypted secret symmetric (session/encryption) key
So ransomware ships with public key PubK, generates symmetric key K, encrypts user files - plaintext message M to get encrypted files, cipher text C:
K=128 random bits, generated on target system
C=aes(K, M)
Then the key K is encrypted with the public key PubK, yielding encrypted key, Ks. Finally K is deleted from memory/overwritten.
Ks can be decrypted by private key PrivK - known only to the author of the ransomware.
Now, the victim sends Ks and payment to the author/attacker.
The attacker decrypts Ks using PrivK, and gets K, which is sent back to the victim - who can presumably supply K to the ransomware. Ransomware then uses K to decrypt C, yielding M - the unencrypted files.
So if these were poor teenagers who mostly copy pasted code and built the rest on the fly then as long as (opportunity cost < ransom > (chance of getting caught * penalty)) then it was "smart".
That's what is good and bad these days; powerful tools empower motivated people.
> There seems to be an inverse correlation between smart and evil
Hopefully you're right.
What would work is hardcoding a large number of public keys in the binary. Then upon paying the ransom the attacker could give the private key to the victim.
But the drawback is that with this approach the same symmetric key would be used to encrypt all files leaving it longer in memory. If 1 symmetric key is used per file it would mean that the ransomware would need to be queried for every file.
Using a locally generated asymmetric key encryption key AKEK to encrypt the files means that:
- The AKEK Pubkey can be kept in memory and the AKEK private key be sent immediately to the control center.
- A different symmetric key can be used to encrypt every file and the control center can be queried only once to retrieve the AKEK private key
On an unrelated note, I wonder if people thought about doing a DDOS on the onion service ... ?
Wouldn't this, if successful, just prevent victims from paying to decrypt their files?
Sure, it would stop the attackers from getting any bitcoin, but the victims' data would still be encrypted.
That key won't work for other victims.
There seems to be an inverse correlation between smart and evil in human beings which is reassuring, but only mildly.