4

I am wondering how ransomware encryption works.

I know ransomware encrypts all files with AES-256 for speed but where does RSA come in? Apparently, RSA is slow to encrypt files so it uses AES-256 first and then RSA? Can someone explain that to me?

Also, does the RSA key come from the criminals' C&C's server which locks the AES key? IF this is the case, shouldn't the AES key be recoverable?

Can someone give me a full rundown on how ransomware usually works in encrypting files?

Improve this question

3 Answers 3

Reset to default
5

It really depends on developer of the ransomware. Ransomware itself is just malware requesting payment to get removed from your computer. To influence the victim to pay techiques such as preventing or making an particular task more difficult.

The unlock code will be just an cryptography public/private key. So, the victim will only have the public key and owner will have the private key which will be provided on payment of the victim to release the malware from the machine. You don't need to run a website for the private key as whatever prompt the user for payment will just expose the public key. So, the owner can will have private key to go with that public key.

Wiki - Public-key cryptography

Wiki - Ransomware

Improve this answer
3

Hybrid encryption.

They use a Hybrid Cryptosystem. The general idea is this:

  • Generate random AES key.
  • Use that AES key for bulk encryption.
  • Encrypt AES key with built-in public RSA-key.
  • Delete AES key from disk.
  • Display RSA-encrypted AES-key to user in ransom note.

Here's a nice blog post with an in depth look:

Improve this answer
6
  • Little new to encryption process but Im assuming this malware uses a built-in Windows feature to generate the AES key and encrypt the files. Thing is, it is known to leave a recoverable trace so somehow ransomware makers stepped up their game by using their own encryption. When you say "Delete AES key from disk", are you saying that the AES key is duplicated because why delete the AES key from the disk if its already RSA encrypted with a public key?
    – Sam
    Jan 26, 2016 at 9:45
  • Well, as long as you're actively using it to encrypt, you have to store it at least in RAM. (And those guys made the mistake of also writing it to disk.)
    – StackzOfZtuff
    Jan 26, 2016 at 11:42
  • Ahh that makes sense! But you wouldnt encrypt the AES key with RSA in RAM since anything stored in RAM can disappear which means the AES key will also disappear too?
    – Sam
    Jan 26, 2016 at 21:31
  • @Sam you can only encrypt the key after you're done using it. I don't know the reasoning for writing it to disk at all but I assume cross boot resumabilty of incomplete encryption, yes.
    – StackzOfZtuff
    Jan 27, 2016 at 5:23
  • Lets say an attacker encrypts the files using the AES key in memory (and does not hit the disk) and then uses an RSA public key sent from the C&C to the victim to encrypt the AES key. Doesnt the malware have to send back the encrypted AES key so they know what the password to the AES key is? Or does the malware also get the AES key from the C&C
    – Sam
    Jan 28, 2016 at 8:14
0

The most important thing to keep in mind about ransomware is that the purpose of the creators is to have the victim pay the ransom. From this point of view it is important to note the fact that there are at least three categories of ransomware:

  1. Typical ransomware, which encrypts files and if victims pay, they receive keys or decryption tools and can recover the files;
  2. Ransomware that encrypts, destroys or replaces files and even if victims pay, they will never receive their data back (a study from 2016 estimates that 20% of those who pays, don't get their data back);
  3. Lockers, which do not encrypt files, but prevent people from using their computers by denying access to the desktop, windows explorer, task manager, and other apps, unless they pay a ransom.

Regarding file encryption, which is performed by many variants of ransomware, they typically use a combination of symmetric-key encryption, which is fast(e.g. AES, DES) and asymmetric-key encryption (e.g. RSA).

The symmetric key is usually generated dynamically, and it exists in the memory of the ransomware executable during the encryption process. The asymmetric public key is used to encrypt the symmetric key, and the result is communicated to the creators of the ransomware generally by following the steps in the ransom-related file.

A lot of ransomware use the CryptoAPI library from Windows, but there are also variants which embed the encryption algorithms in the malware code (there are many implementations of these algorithms in different development languages, publicly available).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .