Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Where does ransomware such as the recent wannacry variant store the key it uses to encrypt the files on the victim's disk?
Is this hard coded in the program itself? Or does it call into a server to obtain a key? If either of these are the case, the application could be reverse engineered or traffic sniffed to obtain the key and decrypt the files, so why is this not the case? Or does the virus generate a key per infection?
All ransomware implementations are different, but for the most part, the particularly stupid variants that did things like use a hard-coded key, or used easily guessable or reproducible key generation methods have been weeded out and replaced by much stronger variants.
For wannacry specifically, each infection creates a new RSA keypair on the machine being infected. The private key from this pair is then encrypted with a public key shipped in the malware, which is part of a keypair owned by the wannacry author.
The new, infection specific public key is then used to encrypt the AES keys, which are generated using a CSPRNG, and a new AES key is generated for each file encrypted.
Presumably once you pay the ransom, the malware authors will then use their private key (the other half of the keypair to the public key hard-coded into the malware) to decrypt your private key, which the decryptor tool can then use to decrypt the AES keys, and in turn the files.
