1

Is it possible to prevent a file from being encrypted, or at least being easily decrypted in case of encryption?

For instance; with the Crypto Locker malware attacking users, could you set up a honeypot with a file to somehow reveal the key needed to decrypt the rest of the files?

Or could you construct a file (or pad an existing file), such that encryption is either unfeasible or impossible.

I'm already aware of Known-plaintext attacks, but the article says that ciphers such as AES is not vulnerable to it.

Note: This is not a specific problem I have, merely a fun idea I can't get out of my head.

5

You could try to put the file on a filesystem which is mounted as read-only. That would at least thwart any attack which uses the normal attack path via file access over the operating system. However, when the malware doesn't use the normal filesystem and does instead attack the raw hard drive devices, this will not help you.

The best way to restore a file which was destroyed by a malware attack is to restore it from an off-machine backup. When you have any valuable data, you should really have a proper backup and recovery strategy.

  • This is a good answer too. It attacks the problem from a practical standpoint, rather than the theoretical approach I took. – Justin Lardinois Dec 11 '14 at 23:14
2

Any data can be encrypted; there's nothing you can do to make arbitrary data unencryptable.*

As for "a honeypot with a file to somehow reveal the key needed to decrypt the rest of the files," that's what's called a chosen-plaintext attack. Some encryption methods are susceptible to it, but for that reason they're not generally used in the real world.

*CryptoLocker uses RSA. If your plaintext is all zeroes, then your RSA ciphertext will be all zeroes, regardless of your key. I suppose you could consider that an unencryptable file, but of course that fact isn't very useful.

  • 1
    No, "a honeypot ... the files" is "what's called a" chosen-plaintext attack. – user49075 Dec 11 '14 at 9:29
  • That's correct. I've edited the answer. – Justin Lardinois Dec 11 '14 at 9:33
  • 1
    Is cryptolocker really dumb enough to apply textbook RSA to the actual file contents? I consider that very unlikely. RSA is typically used with padding and typically used as hybrid encryption where it only encrypts a key for a symmetric cipher and not the file itself. – CodesInChaos Dec 11 '14 at 13:00
  • I don't know the details, but I assume that CryptoLocker would use padding; that's pretty much standard for a well-written RSA implementation. As for hybrid use, yes, that's true that RSA is used that way when used for communication, but CryptoLocker is a different use case entirely. I imagine it uses RSA because then the private key is never stored on the infected machine (unless you pay the ransom, of course). – Justin Lardinois Dec 11 '14 at 16:17
  • With a versionfs or unionfs you always have the original file, no matter what the attacker tries. – ott-- Jul 12 '15 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.