0

I'm familiar how ransomware works and how they encrypt the files.

If the encryption is done by a public key only (which the private is saved at the attacker's server), you cannot decrypt those files unless you receive the private key.

Which common bugs/backdoors the public decryptors found in the ransomware to be able to decrypt the files successfully? (https://www.nomoreransom.org/decryption-tools.html)

I can think about several - for example, if the encryption key is symmetric - one can try and catch it in ransomware's memory before it encrypts the file and use it to decrypt the rest afterward.

  • some keys are published by the ransomware authors – schroeder Apr 4 '17 at 15:15
  • the private ones? why? what's in it for them? – ArielB Apr 4 '17 at 15:17
  • Google "ransomware keys released" - you will get a whole bunch – schroeder Apr 4 '17 at 15:18
  • It's pretty odd that ransomware will use a predefined set of keys to encrypt. the better approach is to actually construct it on the fly, and save the private key aside. i'm guessing they didn't do it because it consists much more work? (managing a different key per successful attack?) – ArielB Apr 4 '17 at 15:21
  • Ransomware infections are opportunistic - you don't know who you will infect, or when. If it is a worm, then you really do not know. How would you get the key under your control? – schroeder Apr 4 '17 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.