0

In this site is was announced that everybody can decrypt the files victim of a ransom attack.

They just don't tell you how it was possible.

  1. It's supposed the files were encrypted with an encryption algorithm that wouldn't be possible to break.

    • Were they able to decrypt the public key using super computers?
    • Has the encryption algorithm used a secret backdoor and it's actually unsafe (as it happened previously with a NIST standard)?
    • Governments already has developed in secret quantum computers and they can decrypt anything?
    • If they were able to decrypt the ransom, does it means that our passwords and credit card number are not longer safe?
  2. The attacker may send you the secret key by payment in bitcoins using the deep web which is an anonymous transaction.

    • Did they caught the attacker and got the secret key?
    • Does it means that the deep web or bitcoins are not as anonymous as we think?
    • Did they make a deal with the attacker?
  • I think they mainly rely on the decrypt tools/keys provided by the attackers once a ransom has been paid. – TheJulyPlot Jul 27 '17 at 6:51
2

Crypto is hard to do correctly and this is no different for adversaries. Sometimes they mess up. Here are a few things that could lead to such an event. They are mostly the same that apply for good intentioned developers as well.

Weak algorithm used to encrypt, for instance DES. This can be brute forced to find the right key.

Weak key generated for encryption. Again, brute force helps here.

Incorrect implementation. Reusing nonces, using predictable IVs, etc. This also includes not wiping the memory where the key was stored. This results in key compromise by simply looking through memory.

There is a great article describing the most common crypto mistakes here: https://littlemaninmyhead.wordpress.com/2017/04/22/top-10-developer-crypto-mistakes/

Some mistakes require more resources to exploit so a supercomputer involvement is not impossible, but unlikely I think.

I do not think anyone made a deal with the attackers, however that is certainly possible. What could have happened is that a few transactions may have been performed with the attacker to get more information about the scheme used, and possibly reveal mistakes that can be exploited. The secret government quantum computer is very unlikely. A lot of times the key is computed by your system.

A backdoor may be relevant. But it is highly unlikely that it was placed there by the government. If t was the case it was probably left there by the attacker, like the killswitch of WannaCry.

Passwords and CC data is not in any more danger than it already was. Ransomware does no harm there. If passwords and CC data are correctly handled, they are safe. Just like, there are no decryptors available for "correctly" written ransomwares.

Bitcoins and other cryptocurrencies are not in danger either. They may have been incorrectly used, revealing the attacker but that is not the protocol's fault.

  • 1
    A good rule of thumb is ciphers and ciphersuites are basically never the problem: It's the systems that implement them, the processes that rely on them, and the people that operate them. – Liam Dennehy Jul 27 '17 at 8:19
  • The concern about credit card were not because of ransom but if they were able to derypt the ransom perhaps they have the technology to decrypt any secure communication. The answer is good, just that I think is still based in conjectures. Isn't an official communicate telling how did they decrypt the files? – Luis Orantes Jul 28 '17 at 1:20
  • @LuisOrantes, The site you linked has decryptors for more than 80 types of ransomware. Each one has its own method. Some attempt to brute-force the key space, some recover the key from memory, while others can decrypt right away because a master key was used. Some methods may be public, you may be able to find a blog post about the exact vulnerability used. – Daniel Szpisjak Jul 28 '17 at 11:43
0

Just in addition to a great answer

In the case of the Likes of WannaCry security researchers where able to reverse engineer the malware and find a url that could unlock the encryption. And in some ransomware that is poorly designed it is possible to find the decryption through reverse engineering it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.