Is ransomware that threatens with publication and verifiably deletes upon payment possible?

Question

Inspired by the article The future of Ransomware and its description of possible ransomware with verifiable key delivery, I wonder if the idea can be taken further into ransomware that credibly threatens publication unless a payment is made, yet verifiably destroys the data if it receives payment.

Let us first make some (probably not entirely reasonable) assumptions:

1. The attacker can maintain control, despite attempts of the security community, of sufficient network resources to exfiltrate data from infected computers with internet connection at a rate of, say, 10 Gbit/s globally (i.e. the bandwidth from all victims combined), and resources to store all data downloaded over that connection.
2. The attacker possesses a decent heuristic for detecting blackmail-worthy files. The idea is just to avoid almost all of the downloaded data being worthless junk like Windows swap files. (Though it would probably be impossible to avoid the security community deliberately feeding junk designed to trigger the heuristic.)

Would it be possible for a sufficiently motivated attacker to develop ransomware using modern CPU "secure enclave" technologies and e.g. Ethereum that encrypts files and transmits them to the attacker, but in such a way that the attacker can only choose to either decrypt the files or to receive payment, but not both?

For example, is it possible for the attacker to verifiably create an enclave that he runs on his backend computers that either allows releasing funds transferred to an account securely created inside it or to decrypt the files, have that enclave attest itself to the ransomware, and to publish the code running in that enclave so that others can verify that functionality?

Answer 1

I don't think it's possible to prove that you DON'T know a piece of information.

This is relevant to your question because in order to guarantee that he won't publish your files after payment is received, the attacker would have to prove that he no longer has the decryption key for your data.

Since there was a moment in time where the attacker did have access to that key (when he encrypted the data on your hard drive), he'd have to credibly prove that he couldn't have made a copy of the key.

There's several moments where he could have done that: First, while exfiltrating your data to his backend, he could have used a covert channel to send a copy of the encryption key from your machine to somewhere else.

Second, he could embed a bit of code into the decryption routine that runs after you pay which would send the decryption key out to him either right then, or at some later time.

Third, he could install a man in the middle between you and his secure enclave, and intercept the traffic between your machine and his enclave. Since his "man in the middle" was actually friendly (to him), he could provide it with the encryption key used to encrypt the traffic between you and his endpoint, and you'd never know, because it wouldn't be part of the code you could audit.

Fourth, even if he gave you proof that the code running in his security enclave was the one he gave you to audit, you'd a) actually have to audit the code, to make sure it didn't somehow leak the key or your data, and b) as long as he sat at the other end of a network connection, how could you ever be sure that what he had on his side actually was a secure enclave with the security guarantees you needed, and not just something masquerading as one? You're probably thinking digital signatures, and I'm thinking "complex system, probably faulty".

Answer 2

I don't see any way how this could be possible. When you have a copy of data, there is no way to prove that no other copy of that data exists, because you can not prove a negative. Trying to prove a negative in this case would mean to account for every single storage medium ever built and proving that it is either owned by someone who is not the attacker or doesn't contain this information right now. And that would not only be unfeasible, but would also require to deanonymize the attacker.

Your strategy depends on the criminal to claim "yes, I have a copy of your data, but I can not access that data until a week from now on, and then that data will be deleted". Maybe there is a 3rd party service which provides this functionality and which you can trust. But if the criminal had the technical ability to exfoliate your data and give it to that service, they could also have made a copy in a different place. There is no way for them to disprove that, because while you can prove knowledge of information, you can not prove lack of knowledge. If you think otherwise, please prove that you do not know my stackexchange password (the fact that you didn't log into my account yet proves nothing - you are obviously waiting for the right moment).

This is a general problem of blackmail with information. It gives the blackmailer power over the victim as long as the information is valuable, because it is never possible to prove that every copy of a piece of information was destroyed. The victim would have to trust the blackmailer. But the blackmailer has already acted unethically towards the victim, so there is no reason to trust them. So the only valid "business" model for this kind of crime is continuous exploitation.