I'm familiar how ransomware works and how they encrypt the files.

If the encryption is done by a public key only (which the private is saved at the attacker's server), you cannot decrypt those files unless you receive the private key.

Which common bugs/backdoors the public decryptors found in the ransomware to be able to decrypt the files successfully? (https://www.nomoreransom.org/decryption-tools.html)

I can think about several - for example, if the encryption key is symmetric - one can try and catch it in ransomware's memory before it encrypts the file and use it to decrypt the rest afterward.

  • some keys are published by the ransomware authors
    – schroeder
    Apr 4, 2017 at 15:15
  • the private ones? why? what's in it for them?
    – ArielB
    Apr 4, 2017 at 15:17
  • Google "ransomware keys released" - you will get a whole bunch
    – schroeder
    Apr 4, 2017 at 15:18
  • It's pretty odd that ransomware will use a predefined set of keys to encrypt. the better approach is to actually construct it on the fly, and save the private key aside. i'm guessing they didn't do it because it consists much more work? (managing a different key per successful attack?)
    – ArielB
    Apr 4, 2017 at 15:21
  • Ransomware infections are opportunistic - you don't know who you will infect, or when. If it is a worm, then you really do not know. How would you get the key under your control?
    – schroeder
    Apr 4, 2017 at 15:22


You must log in to answer this question.

Browse other questions tagged .