Timeline for What should you do if you catch encryption ransomware mid-operation?
Current License: CC BY-SA 3.0
20 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 23, 2017 at 12:40 | history | edited | CommunityBot |
replaced http://stackoverflow.com/ with https://stackoverflow.com/
|
|
| Mar 17, 2017 at 13:21 | history | edited | CommunityBot |
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
|
|
| Dec 26, 2016 at 4:57 | history | edited | Jedi | CC BY-SA 3.0 |
added 1 character in body
|
| Apr 20, 2016 at 18:13 | comment | added | David Gish | @Luc Public key encryption is slow, but data is not encrypted with it -- it's only used to protect the session key for a symmetric algorithm such as AES. Once the session key is decrypted, encryption proceeds at speed. | |
| Apr 20, 2016 at 12:27 | comment | added | Trevor Boyd Smith | This answer assumes you already know what process(es) is doing the encryption... which now that I check the question... is a valid assumption. <outside the scope of this question>However most ransomware I think is smart enough to use <10% CPU or only go active when it detects the computer not being in use. So finding these "smarter" types of ransomeware processes may take an expert user a significant amount of time 0.5 to 3 hours (maybe longer)... which may allow the process to complete and make the ransom valid.</outside the scope of this question> | |
| Apr 19, 2016 at 11:59 | comment | added | EM0 |
each of those keys would either have to be transmitted, or stored in a database which is encrypted with a (symmetric) master key Why would the master key have to be symmetric? That's exactly what the public key would be used for.
|
|
| Apr 18, 2016 at 21:19 | history | edited | Luc | CC BY-SA 3.0 |
added 347 characters in body
|
| Apr 18, 2016 at 13:19 | comment | added | Luc | @AntonBanchev I see. I'd almost install it in a virtual machine, just to see if it's slow enough to call the police and have their forensics team show up before it's done encrypting all files! Jokes aside, I am curious about its performance. I'll also update the post. | |
| Apr 18, 2016 at 13:17 | comment | added | Tomáš Zato | @Luc You can only lose all files if the ransomware kept them all in memory while encrypting, which is not likely. Or maybe if it employed some crazy random file change pattern - not sure how exactly would it look. Or if you noticed too late - but in that case you can just boot again and try to get the key or pay the ransom. | |
| Apr 18, 2016 at 13:13 | comment | added | Luc | @TomášZato That is actually a good point. Not sure how to solve that... if you pull the power, you might get none of the files back; if you look for process suspending and dump the memory, you could probably get everything back. However if you do the latter and it doesn't work, you indeed lost a bunch of files. Difficult to say which is better. | |
| Apr 18, 2016 at 13:11 | comment | added | Tomáš Zato | @Luc I didn't say it's impossible. But it's, not fast, and time is what's at stake here imho. You kill the power you lose one file. You fiddle with process explorer or search where did you install that handy utility and you lose 1000 files. | |
| Apr 18, 2016 at 13:09 | comment | added | Luc |
@TomášZato Step 1: duckduckgo.com/?q=suspend+process+windows+7&t=ffsb Step 2: superuser.com/q/426351/121343 -- On most Linux systems it's included in the system monitor (also in htop you can send a STOP signal via the "GUI"), and on servers it's a quick google to find that it's kill -STOP processid.
|
|
| Apr 18, 2016 at 12:22 | comment | added | Anton Banchev | @Luc it seems like it depends on which malware we are talking about, if you check this document bromium.com/sites/default/files/bromium-report-ransomware.pdf you can see that different implementations use different algorithms, CryptoWall seems to use RSA which is asymmetric. The others are using symmetric algorithms (or at least they used to at the time of writing). | |
| Apr 18, 2016 at 12:16 | comment | added | Tomáš Zato | I don't see an option to suspend a process in windows 7. And on linux, it probably needs some crazy bash command - depends on distribution of course. | |
| Apr 18, 2016 at 12:07 | history | edited | Luc | CC BY-SA 3.0 |
added 2055 characters in body
|
| Apr 18, 2016 at 11:45 | comment | added | Luc | @AntonBanchev (To your first comment:) I very much doubt that. I know a public/private key might very well be used in the process (hybrid crypto), but encrypting lots of data with public key encryption is extremely slow. It's so uncommon to do, I can hardly find any RSA benchmarks that are comparative to AES. Out of maybe 20 hits, this is the only real answer, and it doesn't disclose raw numbers or methods, it just says it's 1000 times slower: stackoverflow.com/a/118488 | |
| Apr 18, 2016 at 9:45 | comment | added | Marc.2377 | I scrolled down to write exactly this same answer. Suspending a process is trivial on modern operating systems. Unfortunately I also have to agree with @AntonBanchev. | |
| Apr 18, 2016 at 9:14 | comment | added | Anton Banchev | The process I described is also the reason why one decryption key doesn't work anywhere else other than the machine it was intended for. | |
| Apr 18, 2016 at 9:01 | comment | added | Fiksdal | Wow. I think this answer needs more attention. | |
| Apr 18, 2016 at 0:12 | history | answered | Luc | CC BY-SA 3.0 |