I have been thinking about ransomware and as I see it the password seems like it should be a problem for the attacker. I can see it going down one of two ways.

Either the password is included in the program and set prior to the attack in which case the password can be retrieved by the victim.

Or the password is sent back to one of the attacker's servers and the password in that case might be found in a log on the victim's computer or network equipment on the way and also making the attacker traceable.

In both cases the attacker risks that the victim can get the password without paying. Do they have another way of getting the password that is more secure or do they not care if some victims get away?


The attacker can use a form of public key cryptography. For each victim, the attacker creates a public/private key pair. The victim's files are encrypted using the public key, but need the private key to decrypt them again.

The private key is only disclosed to the victim once the ransom is paid.

  • AFAIK a good ransomware is supposed to spread automatically, could you clarify how an attacker achieves that every victim's files are encrypted with an unique key pair? Or am I missing something obvious? EDIT: got it now, Rory's comment helped. Thanks. – bayo Aug 10 '15 at 12:29
  • 2
    Easily automated @bayo15. And the key pair creation happens on the attacker's machine - not the victim's. – Rory Alsop Aug 10 '15 at 12:30
  • 1
    I would think it also possible for attacker to have a single private/public key, with program encrypting symmetrically with locally generated random key which is then sent (encrypted with attacker's public key) to the attacker. – Cthulhu Aug 10 '15 at 12:34
  • @Cthulhu - how would the attacker prevent a user who purchased the key from sharing it with others? – Neil Smithline Aug 10 '15 at 14:03
  • 4
    @NeilSmithline They would only receive decrypted symmetric key used on their files. – Cthulhu Aug 10 '15 at 14:08

The ransomware creates a random password, sends it to the attacker, ciphers your files and forgets it. By the time you notice your files are encrypted, the password is no longer in your computer (it may be recoverable if you happen to spot the virus while it is still encrypting your files, as it will be in memory).

I have also seen ransomware that encrypt the password to the attacker's public key and then asks the user to include that ciphered password (which he can't decode) in an email requesting the files back (the password, actually).

And finally, there are mixed approaches where the password is sent to the attacker, but also included (encrypted to a public key) within each ciphered file (just in case they lost control of the C&C server, probably).

Not to mention the cases where your computer is compromised and able to be controlled remotely (eg. you left Remote Desktop open with a weak password), and the attacker launches the encryption process semi-manually, in which case he has the most flexibility and could set whatever they want.

  • 1
    That would make it oh so easy to trace the attacker with a honey pot. – Aron Aug 10 '15 at 18:02
  • @Aron - or trace back to one of the attacker's disposable bots, of which he has many. – Johnny Aug 11 '15 at 3:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.