Efficacy of self-made ransomware protection

Question

I was recently wondering about how to circumvent malware such as the infamous Cryptolocker a while back and was wondering about the efficacy of having a set of files with known content in a known location and then, in the event of a ransomware malware infection, using these files to uncover the cryptographic key used to encrypt the files.

For instance in the case of Cryptolocker, it was known fairly early on that the cryptographic function which encrypted the files was RSA, and thus brute force attempts at recovering the key could be made.

Of course, this isn't an ideal approach as it requires a large amount of computation, but with GPGPU programming alongside parallel CPU architectures (or even distributed computing) and disabling any timed-deletion of files by the Malware is this approach completely unfeasible?

Answer 1

Yes it is completely unfeasible. Your suggestion bases on you knowing the contents of a particular file. You want to use this and the encrypted file to decrypt the other files. There would be two ways to approach this. One would be to use weaknesses of the encryption algorithm in a known plaintext attack, the second, which you are addressing in your last paragraph, would be trying every key in a brute-force attack. However, both approaches can be rendered practically impossible. Brute force is hopeless with a large enough keyspace, and known plaintext attacks don't work on sophisticated algorithms like RSA. So when your ransomware is "well" implemented, it can indeed lock up your data in a way nobody except the ransomware writer can decrypt it.

Btw, knowing the encryption algorithm for any system is not supposed to weaken it. In fact, public (agreed-upon) algoritms are considered stronger as they can be reviewed by researchers around the globe. Its unlikely you can afford similar reviews for your secret algorithm.

Best ransomware protection are offline backups. Online backups (drive always connected to computer, automatically mounted NAS, etc.) won't help as they are likely to be be accessed by the ransomware. Only exception are online services like Dropbox which store file history.