5

I have been thinking about ransomware and as I see it the password seems like it should be a problem for the attacker. I can see it going down one of two ways.

Either the password is included in the program and set prior to the attack in which case the password can be retrieved by the victim.

Or the password is sent back to one of the attacker's servers and the password in that case might be found in a log on the victim's computer or network equipment on the way and also making the attacker traceable.

In both cases the attacker risks that the victim can get the password without paying. Do they have another way of getting the password that is more secure or do they not care if some victims get away?

2 Answers 2

16

The attacker can use a form of public key cryptography. For each victim, the attacker creates a public/private key pair. The victim's files are encrypted using the public key, but need the private key to decrypt them again.

The private key is only disclosed to the victim once the ransom is paid.

8
  • AFAIK a good ransomware is supposed to spread automatically, could you clarify how an attacker achieves that every victim's files are encrypted with an unique key pair? Or am I missing something obvious? EDIT: got it now, Rory's comment helped. Thanks.
    – bayo
    Aug 10, 2015 at 12:29
  • 2
    Easily automated @bayo15. And the key pair creation happens on the attacker's machine - not the victim's.
    – Rory Alsop
    Aug 10, 2015 at 12:30
  • 1
    I would think it also possible for attacker to have a single private/public key, with program encrypting symmetrically with locally generated random key which is then sent (encrypted with attacker's public key) to the attacker.
    – Cthulhu
    Aug 10, 2015 at 12:34
  • @Cthulhu - how would the attacker prevent a user who purchased the key from sharing it with others? Aug 10, 2015 at 14:03
  • 4
    @NeilSmithline They would only receive decrypted symmetric key used on their files.
    – Cthulhu
    Aug 10, 2015 at 14:08
2

The ransomware creates a random password, sends it to the attacker, ciphers your files and forgets it. By the time you notice your files are encrypted, the password is no longer in your computer (it may be recoverable if you happen to spot the virus while it is still encrypting your files, as it will be in memory).

I have also seen ransomware that encrypt the password to the attacker's public key and then asks the user to include that ciphered password (which he can't decode) in an email requesting the files back (the password, actually).

And finally, there are mixed approaches where the password is sent to the attacker, but also included (encrypted to a public key) within each ciphered file (just in case they lost control of the C&C server, probably).

Not to mention the cases where your computer is compromised and able to be controlled remotely (eg. you left Remote Desktop open with a weak password), and the attacker launches the encryption process semi-manually, in which case he has the most flexibility and could set whatever they want.

2
  • 1
    That would make it oh so easy to trace the attacker with a honey pot.
    – Aron
    Aug 10, 2015 at 18:02
  • @Aron - or trace back to one of the attacker's disposable bots, of which he has many.
    – Johnny
    Aug 11, 2015 at 3:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .