If you have already encrypted files, are they still vulnerable to being encrypted a second time by a program like Cryptolocker, or would this protect them?
3
-
2There are encryption algorithms which improve security by encrypting multiple times, like 3DES for example which encrypts three times with DES using a different key each time. It can't be reversed without knowing all three keys.– PhilippSep 2, 2014 at 12:57
-
7Sure. You can put a letter in an envelope in another envelope.– fr00tyl00pSep 2, 2014 at 12:57
-
1The main purpose of ransomware is to make your files unusable. Encrypting your files beforehand will just make the ransomware encrypt them again, and they would still be unusable. The ransomware doesn't care about the contents of the files most of the time.– HugoMar 25, 2016 at 14:35
Add a comment
|
4 Answers
Yes they are still vulnerable. Encryption just transforms a sequence of bits into another sequence of bits (and assuming the encryption is good it will be computationally infeasible to reverse this process without knowledge of some secret). There's no reason why encryption can't be performed again on an already encrypted sequence of bits.
It's possible certain ransomware implementations might look for specific files that are likely to be of high value, and encrypting these files might make them more difficult to recognise. However, I would not depend on this as my primary control against the threat of ransomware.
-
2I agree, encrypting your files would make them more likely to be ransomware targets than to protect them.– GdDSep 2, 2014 at 12:08
As thexacre says, each encryption algorithm maps one set of bits to another. To give a live example, consider the following hashes:
md5(Good morning America) = 4c8112d7d9b81847c17d053182633472
sha1(4c8112d7d9b81847c17d053182633472) = eb5da658e171a2a8fbb07c702939bd3d273de049
If you were to crack eb5da658e171a2a8fbb07c702939bd3d273de049, you'd get 4c8112d7d9b81847c17d053182633472 back as the result. If you cracked that, you'd get "Good morning America" back as a result.
This example isn't a pair of encryption schemes, but it does show two different functions that map one set of bits to another, being used in succession with no problem – the same thing which would happen with ransomware encrypting your encrypted file. This process is, essentially, function composition:
my-encryption: X → Y
ransomware: Y → Z
ransomware ∘ my-encrpytion: X → Z
(In case it's not obvious, X is the original file, Y is your encrypted file, and Z is the file that the ransomware is holding hostage.)
Your encryption scheme knows how to figure out Y → X (when combined with whatever secret is required), and the ransomware knows how to figure out Z → Y, but nobody knows how to figure out Z → X.
-
14Using hashes for the example feels slightly misleading. The question is about encryption, not hashing, and hashing multiple times comes with its own set of associated problems.– YouSep 2, 2014 at 23:07
-
4True, a hash function isn't an encryption scheme (I mentioned that in the answer), but it's much easier to display the results of a hash. Both will map bits to bits, though.– Brian SSep 2, 2014 at 23:10
Encrypting an already encrypted file, is like putting a safe inside another safe. But then crypotlocker will then have your encrypted file inside its safe. So, sorry this will not protect you.
There is a service here: https://www.decryptcryptolocker.com/ That you can use for retrieval should you have files that are encrypted with cryptolocker.
And to guard against this attack it is best to use an antivirus software such as Kaspersky or NOD32 they are by no means bullet proof but should guard you somewhat.
-
Thank you for the explanation and the additional comments - I don't have a ransomware problem at the moment, but I am really just interested in ways to help prevent the problem (aside from the obvious viral protection measures). Do you know anything about how that decryption service works? I thought the Cryptolocker encryption was supposed to be virtually impossible to decrypt, or is it just a matter of time?– AAMSep 5, 2014 at 10:50
-
I can only guess what method they use. I would say that they have the private keys which they gathered in some way.– WayneSep 5, 2014 at 15:02
Encrypting your files might not stop them from being encrypted once more. However it does stop ransomware from uploading anything useful, rendering at least some of their threats useless.
