Disclaimer: I have very very little experience with ransomware/encryption, so I'm sorry if I ask something stupid.
Ransomware attacks are all over the news, especially this year. And this got me wondering of a very typical situation in the real world:
- User X has many files on his PC
- He backs them up from time to time (he heard it's a good idea), but he's lazy and does it very rarely
- He gets infected with ransomware and all 10,000 of his important files are encrypted (10,000 is just an example here)
- However, the good news is that he backed up 1,000 of his files on an external hard-drive
So here's an idea for recovering the other 9,000 files: What if we have a software that compares the 1,000 encrypted files (from his infected computer) with the same 1,000 original files (from the backup) and tries to deduce the encryption key that way?
1,000 files should give you enough data to allow millions of comparison points and space for pattern searching, such that this becomes much much faster/efficient than a typical brute-force approach (e.g. 6 hours of compute-time instead of a typical 10 thousand years).
Once we find the encryption key (from the 1,000 to 1,000 comparisons), we can use it to decrypt the other 9,000 files and we don't have to pay the ransom.
So my questions are:
- Is something like this feasible/possible? Would it work? From what I've seen/heard (I was never infected with ransomware myself), the ransom message you get usually tells you what encryption method was used, how large the key is etc.
- Is this something that can work only with certain encryption algorithms and not with others?
If I were to guess, I'd say that the answer is NO for 2 reasons:
- if it were possible, someone much smarter than me would've thought about it and done it already
- finding such patterns and doing the comparisons implies being aware of weaknesses in the encryption system, which in turn implies a vulnerable encryption system. This means it will NOT be used in such attacks in the first place.
What are your thoughts on all this? (please remember the disclaimer at the top)