1

I was recently wondering about how to circumvent malware such as the infamous Cryptolocker a while back and was wondering about the efficacy of having a set of files with known content in a known location and then, in the event of a ransomware malware infection, using these files to uncover the cryptographic key used to encrypt the files.

For instance in the case of Cryptolocker, it was known fairly early on that the cryptographic function which encrypted the files was RSA, and thus brute force attempts at recovering the key could be made.

Of course, this isn't an ideal approach as it requires a large amount of computation, but with GPGPU programming alongside parallel CPU architectures (or even distributed computing) and disabling any timed-deletion of files by the Malware is this approach completely unfeasible?

  • @user10008 Okay, thanks for clarifying that for me! – Thomas Russell Sep 18 '14 at 12:44
  • Keeping antivirus software active and up to date should prevent you from getting such an infection in the first place in most cases. However, I realize this does not completely answer the question, so I posted it as a comment instead of an answer. – Jonathan Sep 18 '14 at 17:48
  • Additionally, even if the set of files had chosen content, that wouldn't help, since there are no known chosen-plaintext attacks on RSA. – user49075 Sep 18 '14 at 18:29
5

Yes it is completely unfeasible. Your suggestion bases on you knowing the contents of a particular file. You want to use this and the encrypted file to decrypt the other files. There would be two ways to approach this. One would be to use weaknesses of the encryption algorithm in a known plaintext attack, the second, which you are addressing in your last paragraph, would be trying every key in a brute-force attack. However, both approaches can be rendered practically impossible. Brute force is hopeless with a large enough keyspace, and known plaintext attacks don't work on sophisticated algorithms like RSA. So when your ransomware is "well" implemented, it can indeed lock up your data in a way nobody except the ransomware writer can decrypt it.

Btw, knowing the encryption algorithm for any system is not supposed to weaken it. In fact, public (agreed-upon) algoritms are considered stronger as they can be reviewed by researchers around the globe. Its unlikely you can afford similar reviews for your secret algorithm.

Best ransomware protection are offline backups. Online backups (drive always connected to computer, automatically mounted NAS, etc.) won't help as they are likely to be be accessed by the ransomware. Only exception are online services like Dropbox which store file history.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.