Timeline for What should you do if you catch encryption ransomware mid-operation?
Current License: CC BY-SA 3.0
22 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 5, 2018 at 3:42 | comment | added | forest | Hibernation flushes the filesystem. This will destroy any "backups" of the file pre-encryption as they are kept in memory. If you suspend the malware instead, you can still dump the filesystem cache. | |
| Oct 28, 2016 at 9:45 | comment | added | Fiksdal | It looks like I somehow have changed my vote to a downvote on this, it must have been a misclick on the phone or something could you make some trivial edit? | |
| Sep 23, 2016 at 1:31 | comment | added | Aria | Have you ever tried doing the above? | |
| Sep 22, 2016 at 21:24 | history | bounty ended | Fiksdal | ||
| S Aug 14, 2016 at 15:13 | history | suggested | You'reAGitForNotUsingGit | CC BY-SA 3.0 |
fixed some grammar
|
| Aug 14, 2016 at 15:12 | review | Suggested edits | |||
| S Aug 14, 2016 at 15:13 | |||||
| Apr 20, 2016 at 4:30 | vote | accept | Fiksdal | ||
| Apr 19, 2016 at 21:39 | comment | added | Maja Piechotka | As additional precaution - copy the disk image o another computer and operate on it. This will help if any read only operation turn out to be not as read only as you imagined. | |
| Apr 19, 2016 at 18:56 | comment | added | user | @Joshua Yes, assuming that the same key is used for every file. Otherwise, you may very well get a useful key, but that key will only be useful for the one (or a very small number of) files that were being encrypted at that point. I'm reluctant to give malware authors too many ideas, but if I can think of ways to defeat such a scheme even while allowing for dumping RAM to disk (hibernation) then it can't be that hard. (Though CodesInChaos already did, and my earlier comment may qualify...) | |
| Apr 19, 2016 at 18:11 | comment | added | Joshua | @MichaelKjörling: The symmetric key is probably still in RAM at this point. Full asymmetric encryption is too slow. | |
| Apr 19, 2016 at 10:31 | comment | added | Dan Is Fiddling By Firelight | @Ángel there's a huge difference between what you described in your answer (pulling keys from a running copy out of a ram image) and what you stated in your comment. Matching victims with one of the handful of c&c servers that've been taken down is far easier (and something a tech savvy victim could do on his own); in the common case where the keys haven't been recovered from the author and the crypto has been done right even an NSA sized cluster won't be able to factor a key out. | |
| Apr 19, 2016 at 1:50 | comment | added | Ángel | @DanNeely It's not expensive at all, they offer that even for home licenses (albeit with lower priority, I think). I think it's an extra rather than a hidden feature billed with the original licensing fee. YMMV, not all AV vendors offer this, and they may change their conditions. | |
| Apr 19, 2016 at 1:44 | comment | added | Ángel | @DanNeely It is real. Some AV vendors do provide such ransomware decryption service to its customers. Typically, they would ask for a few encrypted files with some known plaintext, the ransom mesage, perhaps even the binary if they were not able to detect the ransomware variant. With that, they create a vaccine that decrypts your files. Of course, they are not always able to figure out the encryption key, but they have better chances than an individual (they will probably have analysed the malware already, and have a big factoring hardware). | |
| Apr 18, 2016 at 23:53 | comment | added | Dan Is Fiddling By Firelight | Is c) a pure hypothetical, or are there paid AV programs that actually do so? I've always just gone with a free AV tool of some sort; but that level of potential disaster recovery is enough to make me contemplate a paid subscription. (As long as it's not limited to Enterprisy products that cost much more than a typical ransom amount anyway.) | |
| Apr 18, 2016 at 18:12 | review | Suggested edits | |||
| Apr 18, 2016 at 19:45 | |||||
| Apr 18, 2016 at 14:08 | comment | added | CodesInChaos | A well written ransomware could use a new key for each file and erase the previous key after it finished encrypting each file. But I don't think they have evolved to that level yet. | |
| Apr 18, 2016 at 9:58 | comment | added | Ángel | @Fiksdal no. I do not recommend paying, but even if you expected to do so, hibernating and taking a disk image (with all the not-yet-encrypted files in addition to the forensic artifacts) would be a wise move before letting it continue its destructive action. | |
| Apr 18, 2016 at 9:18 | vote | accept | Fiksdal | ||
| Apr 20, 2016 at 3:09 | |||||
| Apr 18, 2016 at 9:04 | vote | accept | Fiksdal | ||
| Apr 18, 2016 at 9:04 | |||||
| Apr 18, 2016 at 9:02 | vote | accept | Fiksdal | ||
| Apr 18, 2016 at 9:02 | |||||
| Apr 18, 2016 at 8:31 | comment | added | user | Hibernating to get a copy of the key is a good idea, but it only really helps if the key used for encryption is also useful for decryption. If the ransomware is written to generate a new symmetric key for each file, and encrypt those with a public key (the way for example PGP/GnuPG works), then the private key needed to decrypt the file-specific keys might no longer be in memory; it may have been handed off to a remote server already. That said, it seems unlikely that this could hurt (any more than what the user would already be going through), and it just might help. | |
| Apr 17, 2016 at 23:12 | history | answered | Ángel | CC BY-SA 3.0 |