6

I am struggling to understand how it is possible to decrypt files encrypted by the TeslaCrypt ransomware using the master key their creators provided.

As far as I know, ransomware encrypts files using a symmetric cryptosystem, and then encrypts the key using an asymmetric encryption scheme. How does one decrypt the affected files by having the master key?

6

On a very abstract level: malware on each victim's machine in addition to encrypted AES keys used to encrypt the files, stores an encrypted copy of the private key required to decrypt them. This copy itself is encrypted with the public key of the attacker and can be decrypted with the attacker's private key (called "master key" in the article).

I will try to rephrase Kaspersky's article TeslaCrypt 2.0 disguised as CryptoWall in a more verbose way.

For the sake of simplicity I will skip the fact that each file can be encoded with different AES key. Also actual implementation might differ (particularly more data can be sent to the attacker and some steps are performed on the attacker's side). Anyway the answer aims to explain how the master password-scheme works:


At first victim has only attacker-public-key (embedded in the malware).
Attacker has attacker-private-key.

  1. malware creates a new BTC address with a victim1-BTC-public-key (to send BTC) and a BTC-private-key (to withdraw BTC)
  2. malware uses attacker-public-key and and victim1-BTC-private-key as the input to ECDH which generates an encryption-key-1
  3. malware XORs victim1-BTC-private-key with the encryption-key-1, stores the result as encrypted-victim1-BTC-private-key, forgets encryption-key-1
  4. malware sends the victim1-BTC-private-key to the attacker and deletes it

Victim owns: attacker-public-key, victim1-BTC-public-key, encrypted-victim1-BTC-private-key.
Attacker owns: attacker-private-key, victim1-BTC-private-key.

Next malware starts to encrypt files:

  1. malware generates a key-pair and uses the private key as AES encryption key, so the pair consists of victim1-AES-key (victim1-keypair-private-key) and victim1-keypair-public-key
  2. malware uses the victim1-BTC-public-key and victim1-AES-key as an input to ECDH which generates an encryption-key-2
  3. malware XORs AES-key with the encryption-key-2, stores the result as encrypted-AES-key, forgets encryption-key-2

Victim owns: attacker-public-key, victim1-BTC-public-key, encrypted-victim1-BTC-private-key, victim1-keypair-public-key, encrypted-victim1-AES-key.
Attacker owns: attacker-private-key, BTC-victim1-private-key.


Now victim paid the ransom and attacker releases a key to decrypt the files:

  1. attacker reveals BTC-victim1-private-key
  2. malware uses BTC-victim1-private-key and victim1-keypair-public-key as an input to ECDH which calculates encryption-key-2 (the same as above)
  3. malware XORs encrypted-victim1-AES-key with the encryption-key-2 which gives victim1-AES-key
  4. malware decrypts the file(s) with victim1-AES-key

No other victim can do anything using BTC-victim1-private-key.


Attacker decides to release the master key:

  1. attacker reveals the attacker-private-key
  2. malware uses attacker-private-key and victim1-BTC-public-key as the input to ECDH which generates an encryption-key-1 (the same as above)
  3. malware XORs encrypted-victim1-BTC-private-key with the encryption-key-1, stores the result as victim1-BTC-private-key
  4. malware uses BTC-victim1-private-key and victim1-keypair-public-key as an input to ECDH which calculates encryption-key-2
  5. malware XORs encrypted-victim1-AES-key with the encryption-key-2 which gives victim1-AES-key
  6. malware decrypts the file(s) with victim1-AES-key

In the latter scenario any victim can use the attacker-private-key first to derive the victim*-BTC-private-key then victim*-AES-key.

  • 1
    question, why would attacker release private key? – akostadinov Dec 8 '16 at 14:58
  • @Irhala I'm not sure I understand the question. Because the developer designed it so. – techraf Dec 9 '16 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.