More charitable reading is that the encryption key was sent over, and they started restoring with that but using standard OSS tooling.
This is a fundamental misunderstanding of the ransomware business. The whole reason people pay up is because the hackers don't run and leave you hanging; if you pay they will decrypt your data. Trust and convenience are essential to making this work.
Perhaps a few cases of high-profile companies falsly claiming „wow, what a load of shit! we got ransommed and after paying up the hackers disappeared! we had to restore from backup, AND the money is gone“.
What are the hackers gonna do, sue those companies? :-)
Oh yes they can.
Also, assume you have the key - what you do with it? You don't know how the files were encrypted, in which way they were stored afterwards, etc. There are many ways one can encrypt and write data, even with the same key - you obviously need the algorithm, but also there are often parameters (e.g. block sizes), storage formats etc. The easiest way to deliver all that is to provide a program.
Otherwise, what a random "press any key" IT person would do with an encryption key? They probably don't even have any tools that can do encryption on any of the systems. Do they have to write those themselves? Use OSS tools - which ones? With which parameters? What if it doesn't work?
Uh, why? The system is already compromised. They’re already in.
One would hope they'd just run the decryption program on each computer, not connected to the network. Or maybe hire some experts to extract the decryption key.
That would make a lot more sense but I also bet there's a non-zero chance that in a day some dumb media outlet will conflate those tools as "hacker tools" and the headline will be "Hacker tools used in Colonial pipeline hack available freely on Internet. News at 10."
Thinking $5m is a "high" ransom, thinking that there is no way they would send a decryption binary rather than a key.
Why don't you just actually research how these schemes function before commenting? The team that did this has a pretty consistent MO and five million was a massive discount.
To be fair, malicious code has already ran on the affected machines, so if the ransomware authors wanted to do further damage they wouldn't need a malicious decryptor to do that.
So you'd either:
1) not trust the ransomware authors, rebuild everything from scratch (potentially paying the ransom and reverse-engineering the decryptor or running it isolated from the internet) and make sure to not carry over any executable code that could allow potential malware to persist
2) trust the ransomware authors and not rebuild everything, in which case you may as well run their decryptor
It's a simple matter of copy-pasting the key into a box, and the decryption will happen.
Over a slow network link (like a VPN to a remote NAS), I could totally imagine it taking days/weeks/months to scan every file though...
Consider that most victims are small fry who would not know what to do with just a key.
Fair, but anyone who pays me $5M and wants a powershell script gets one, and an air freshener of their choice.
If anything they’re working on speeding up their decrypting tool for the next release :)
I thought the protocol for these attacks was to send the decryption keys, not provide a "decrypting tool."
If some kind of software was provided by the attackers, and Colonial installed it, this could be far from over.
Also, if the company has backups, then why not use them instead? If they're incomplete, then that's the real problem.