4

So I am wondering how Ransomware files work.

I know Ransomware encrypts all files with AES-256 for speed but where does RSA come in? Apparently RSA is slow to encrypt files so it uses AES-256 first and then RSA? Can someone explain that to me?

Also, does the RSA key come from the criminals C&C's server which locks the AES key? IF this is the case, shouldnt the AES key be recoverable?

If its possible for anyone to give me a full rundown on how Ransomware usually works in encrypting files, that would be nice.

Thanks

5

It really depends on developer of the ransomware. Ransomware itself is just malware requesting payment to get removed from your computer. To influence the victim to pay techiques such as preventing or making an particular task more difficult.

The unlock code will be just an cryptography public/private key. So, the victim will only have the public key and owner will have the private key which will be provided on payment of the victim to release the malware from the machine. You don't need to run a website for the private key as whatever prompt the user for payment will just expose the public key. So, the owner can will have private key to go with that public key.

Wiki - Public-key cryptography

Wiki - Ransomware

2

Hybrid encryption.

They use a Hybrid Cryptosystem. The general idea is this:

  • Generate random AES key.
  • Use that AES key for bulk encryption.
  • Encrypt AES key with built-in public RSA-key.
  • Delete AES key from disk.
  • Display RSA-encrypted AES-key to user in ransom note.

Here's a nice blog post with an in depth look:

  • Little new to encryption process but Im assuming this malware uses a built-in Windows feature to generate the AES key and encrypt the files. Thing is, it is known to leave a recoverable trace so somehow ransomware makers stepped up their game by using their own encryption. When you say "Delete AES key from disk", are you saying that the AES key is duplicated because why delete the AES key from the disk if its already RSA encrypted with a public key? – Sam Jan 26 '16 at 9:45
  • Well, as long as you're actively using it to encrypt, you have to store it at least in RAM. (And those guys made the mistake of also writing it to disk.) – StackzOfZtuff Jan 26 '16 at 11:42
  • Ahh that makes sense! But you wouldnt encrypt the AES key with RSA in RAM since anything stored in RAM can disappear which means the AES key will also disappear too? – Sam Jan 26 '16 at 21:31
  • @Sam you can only encrypt the key after you're done using it. I don't know the reasoning for writing it to disk at all but I assume cross boot resumabilty of incomplete encryption, yes. – StackzOfZtuff Jan 27 '16 at 5:23
  • Lets say an attacker encrypts the files using the AES key in memory (and does not hit the disk) and then uses an RSA public key sent from the C&C to the victim to encrypt the AES key. Doesnt the malware have to send back the encrypted AES key so they know what the password to the AES key is? Or does the malware also get the AES key from the C&C – Sam Jan 28 '16 at 8:14
0

The most important thing to keep in mind about ransomware is that the purpose of the creators is to have the victim pay the ransom. From this point of view it is important to note the fact that there are at least three categories of ransomware:

  1. Typical ransomware, which encrypts files and if victims pay, they receive keys or decryption tools and can recover the files;
  2. Ransomware that encrypts, destroys or replaces files and even if victims pay, they will never receive their data back (a study from 2016 estimates that 20% of those who pays, don't get their data back);
  3. Lockers, which do not encrypt files, but prevent people from using their computers by denying access to the desktop, windows explorer, task manager, and other apps, unless they pay a ransom.

Regarding file encryption, which is performed by many variants of ransomware, they typically use a combination of symmetric-key encryption, which is fast(e.g. AES, DES) and asymmetric-key encryption (e.g. RSA).

The symmetric key is usually generated dynamically, and it exists in the memory of the ransomware executable during the encryption process. The asymmetric public key is used to encrypt the symmetric key, and the result is communicated to the creators of the ransomware generally by following the steps in the ransom-related file.

A lot of ransomware use the CryptoAPI library from Windows, but there are also variants which embed the encryption algorithms in the malware code (there are many implementations of these algorithms in different development languages, publicly available).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.