0

Since Cryptoware use the Microsoft encryption libraries, is it possible to disable them? Or do other processes use it in the normal course of operation?

2
  • 2
    Just because some malware use a library, its not the fault of the library/ not the solution to disable it. Prevention starts before get infected. If you go that way that you want to disable the CryptoLib from Microsoft because of a Malware then you must disable nearly every component of Windows because most of them are used in Malware in some kind. (just look at cmd.exe, explorer.exe, the Registry,...)
    – Serverfrog
    May 15, 2017 at 15:52
  • 1
    This is like asking "How do I remove the safety features from my car?" What if you tried to connect to some sensitive website online (i.e. your bank), and because you (somehow) disabled all crypto on your machine, it connects to the banks website with no authentication and a null cipher suite? Is that really a better situation to be in? That wouldn't/couldn't happen for many reasons, but it demonstrates what an utterly impractical "solution" to the perceived problem this is.
    – Ella Rose
    May 15, 2017 at 16:34

1 Answer 1

7

It is not possible to disable them. They are an integral part of the operating system and heavily used by everything from schannel for secure TLS communications to innumerable third-party applications with various cryptographic needs.

In addition, even if this were possible, it wouldn't constitute any more than a minor roadblock as ransomware could be quickly adapted to ship with its own crypto implementation, making the configuration change irrelevant.

5
  • 1
    They definitely can be disabled-- it is common to disable TLS 1.0 and lower for example-- but I doubt this is an effective way to thwart ransomware, and you'd probably blow up a lot of other things that you actually need. Plus if you have malware loose on your O/S, it could just re-enable them anyway.
    – John Wu
    May 16, 2017 at 3:51
  • 5
    @JohnWu That is incorrect. Disabling a TLS version is entirely different, and entirely more trivial than turning off an underlying cryptographic library. In fact, TLS is not even implemented in the base crypto libraries (CAPI and CNG) but a level higher, in schannel.
    – Xander
    May 16, 2017 at 11:41
  • 3
    @JohnWu disabling TLS versions in IIS is a very different thing from disabling core libraries in the OS
    – schroeder
    May 16, 2017 at 14:55
  • My team just went through this in our data center. I promise you if you set group policy to disable lower versions of TLS for inbound traffic, you will also end up disabling a bunch of cipher suites systemwide, not just for inbound (it caused us a lot of problems) unless you go in and re-enable them. Registry keys to enable/disable specific algorithms can be found here.
    – John Wu
    May 16, 2017 at 17:04
  • @JohnWu Right, no one is debating that you can do that. However, that's not what the question is about. The question is about the OSes crypto libraries. Those have nothing to do with TLS.
    – Xander
    May 16, 2017 at 17:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .