2

Today I found that there is a website that offers tools for ransomware decryption, but with my current knowledge about encryptions, it makes no sense for me, because a file encrypted with a strong key would take years to decrypt.

I'd expect they to use a command computer that generates and stores key on the fly for each target, or the criminals use only one key to encrypt all computers?

Improve this question
3
  • Some use quite complex encryption mechanisms, for example security.stackexchange.com/q/131358/86652
    – techraf
    May 16, 2017 at 0:54
  • I am still curious about this latest one. The headlines say that lots of people have paid the ransom but I still haven't yet heard of anyone actually decrypting afterwards. It might be a false promise. In the end, this sure show that people need to keep good backups.
    – SDsolar
    May 16, 2017 at 5:10
  • 1
    Did you consider that some of those websites might be malicious aswell and want to compromise your system? Since there are guys that got compromised due to their simple-mindedness these guys might be good targets to play with some more.
    – anon
    May 16, 2017 at 15:09

2 Answers 2

Reset to default
7

You are correct that properly implemented encryption cannot be decrypted without having the password.

Such decrypters as you see on that site don't actually try every possibility to get the password (known as "brute forcing") but they look for other vulnerabilities to decrypt the files of a specific ransomware. Some of these ransomwares are poorly written and allow an expert to look at the code and find a way to decrypt without knowing the password. Some are so badly written the key to decryption can be found in the code itself.

The reason why some ransomware can be decrypted without the password is the same reason why not every encryption program out there is good: creating a program that encrypts securely is quite difficult, as some of these ransomware makers are now finding out.

Improve this answer
2
  • 1
    Most common problems are implementing own crypto instead of using the Windows Crypto API, or using poorly implemented random generators.
    – user2716262
    May 17, 2017 at 19:20
  • Also, sometimes the keys are stored on the ransomware developer servers, and these servers are hacked and the decryption keys are published. Also there is a case when the ransomware developers went out of business and released all the keys. These keys can be implemented in ransomware decrypters.
    – user2716262
    May 17, 2017 at 19:21
2

Some ransomware are not constructed well, some don't use encryption correctly and some deterministically decide what key to use. If a mistake has been made and and it is exploitable, it is possible to work out the key and subsequently decrypt the previously encrypted files.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .