Why is so much ransomware breakable?

Question

The site: https://www.nomoreransom.org/ offers many decrypter tools for ransomware.

But why?

It shouldn't be so hard to use the Windows Crypto API (e.g. just google "create AES Key in Windows") to create AES Keys, encrypt them with a locally generated public RSA Key and encrypt the corresponding private RSA Key with a Public RSA Key that the attacker controls. (The method of Wanacry.)

If the victim pays the ransom, they have to send the encrypted private RSA key to the attackers, and hopefully get the decrypted private RSA key back.

Why do these people try to reinvent the wheel and in the process make mistakes that allow the development of decrypter tools?

Answer 1

Disclosure: I work for one of vendors participating in NoMoreRansom.

Most modern ransomware indeed implements proper cryptography. Earlier versions were using rand() for key generation, seeding the random generators with variants of time() - this is why it was important for successful decryption to know when exactly the infection happened; ideally down to minutes. Those could be decrypted with brute force. But most modern ransomware indeed uses either Windows Crypto API, or bundled crypto libraries.

However, no matter how correctly ransomware is implemented, there is always a weak point - to facilitate decryption, the key(s) have to be stored somewhere. This location could be traced by security companies, who would work together with law enforcement to take it over. Access to the server gives the security company the ability to decrypt the ransomware victims files. This is for example the case with GangCrab ransomware.

Answer 2

It is just a cost/gain question. Ransomware developers generally do not want to build a security tool with all the involved reviewing. They just want the less expensive tool that will allow them to get more money than it cost. Of course, they are probably breakable, but who cares? Provided some of the first victims have paid what they were asked, the attacker gets much more money than they spent. Furthermore, the longer you use one, the higher the risk to be caught if a governmental security agency manages to come into play.

It is more or less what many real-life thieves do when they manage to enter in a random house: take the most valuable things in the shortest possible time and go away.

Things are different both in the real life and IT world for targetted attacks. If you want to attack a bank or a jewelry shop, the gain is expected to be high enough to spend a lot of preparation time. The same when a governmental service attacks a strategic target, they will use higher quality tools. But it is seldom used for random targets.

Answer 3

The obvious answer is that no criminal would want to interact so directly with their victim.

"send the encrypted private RSA key to the attackers"

requires a consistent point of contact.

In the current model, all the communication is one-way and fungible:

• malware displays a screen instructing the victim to deposit bitcoins (no direct contact)
• criminals monitor deposits and send email with key (communication is automated and one-way from any disposable intermediary)

The current model works so well, it is one of the top threats worldwide. There are always ways to improve a system, but if it isn't broken, what's the benefit?

Answer 4

Frankly, it's pretty tricky to pull off good file encryption and decryption, even with a library that's supposed to do it for you. I tried to modify a cryptor (meant to obfuscate viruses to hide their signatures from antivirus programs) that used a very basic bitshift technique originally, and it didn't work well because most antivirus programs would literally brute force the binary and could realize that it was actually a virus! I wanted to replace the bitshift "encryption", if you could even call it that, with AES encryption via a C# library that I had used successfully in the past for strings, but I could never make it work. Another problem is that the more complicated your encryption algorith is, the longer it takes to sweep the entire disk, and then decrypt at the end when/if they pay. It's also more likely to fail in the middle and result in an incomplete job.

What I saw once on my grandma's computer, back before ransomware really took off and got better, was a ransomware program that supposedly encrypted her files and wanted about $200 to decrypt them. All it did in reality was add the extension ".crypted" to the end of every single file so windows didn't know what program to use to open any of them! Once I figured that out, all that was necessary to do was use the task manager to locate and delete the original ransomware file, then write a batch script to recursively check every file on the system for the .crypted extension and remove it if present. Problem solved within an hour, no money paid to hackers at all! But if they had used AES, this technique wouldn't have worked at all, and deleting the virus file would probably destroy any hope you ever had of cracking the military grade encryption.

The difference is that the guy who used the first technique of renaming the file extension so windows couldn't open any files probably already had hundreds of infections by the time the guy using military grade encryption even finished his virus, and the 5% of people who are smart enough to fix the first one are probably also smart enough to not be infected by the second one. The other 95% of people who couldn't figure out any way to fix either virus other than just paying the ransom, probably paid it the first time (to the guy with the easily breakable ransomware) and then immediately set up a full backup solution to prevent it from ever happening again. If they later got infected by the military grade ransomware, they already learned their lesson once and just restored from the backup. Hopefully even people who haven't been infected yet start to set up backups, so they never even have to pay the ransom once.

From this scenario, you can see how the guy with the easily breakable ransomware can release it first, it acts faster and is more reliable and easier to reverse even if the antivirus program manages to delete the virus before decryption, and because of that, he will make more money than the person who spends tons of time setting up a fully bulletproof ransomware virus, but is later to the market after people have started to wise up and back up their important files.