Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

AV firm seeks help cracking ransomware key

Backup your data. Crypto Trojans are back.

Article comments

A security company has asked for help cracking an encryption key that is central to an extortion scheme which demands money from users whose PCs have been infected by malware.

Kaspersky Lab, a Moscow-based antivirus firm, put out the call last week for assistance after it discovered a new variant of Gpcode, a Trojan horse that has been used in isolated "ransomware" attacks for the past two years.

In ransomware attacks, hackers plant malware that encrypts files and then displays a message demanding money to unlock the data. In the case of the newest Gpcode, 143 different file types are encrypted, including .bak, .doc, .jpg and .pdf. The encrypted files are marked by the addition of "_CRYPT" in their file names, and the original unencrypted files are deleted. As a camouflaging move, Gpcode also tries to erase itself.

Finally, the ransom note appears on-screen. "Your files are encrypted with RSA-1024 algorithm," it begins. "To recovery [sic] your files you need to buy our decryptor. To buy decrypting tool contact us at: xxxxx@yahoo.com."

Last Thursday, a Kaspersky analyst identified as "VitalyK" said that although the company had analysed samples of Gpcode, it wasn't able to decrypt the files the malware encoded. "We can't currently decrypt files encrypted by Gpcode.ak," said VitalyK in an entry to the company's research blog. "The RSA encryption implemented in the malware uses a very strong, 1024-bit key."

According to Kaspersky's write-up, the key is created by Windows' built-in cryptographic component, Microsoft Enhanced Cryptographic Provider. Kaspersky has the public key in hand - it is included in the Trojan's code - but not the associated private key necessary to unlock the encrypted files.

Two days later, another Kaspersky researcher asked for help. "Along with antivirus companies around the world, we're faced with the task of cracking the RSA 1024-bit key," said Aleks Gostev, a senior virus analyst. "This is a huge cryptographic challenge. We estimate it would take around 15 million modern computers, running for about a year, to crack such a key." Gostev provided the public key in his posting.

"So we're calling on you: cryptographers, governmental and scientific institutions, antivirus companies, independent researchers," said Gostev. "Join with us to stop Gpcode."

One rival researcher, however, took exception to the call to arms. In a message posted to Kaspersky's support forum, Vesselin Bontchev, a Bulgarian researcher who works for Frisk Software, an Icelandic antivirus company, called it a stunt.

"What is proposed here is an unrealistic, useless waste of time that will fail," said Bontchev, who also charged that Kaspersky's estimate of the computing time it would take to break the key was optimistic. "The only use of this project is for generating free publicity for Kaspersky Labs."

A Kaspersky employee identified as "Codelancer" replied, thanking Bontchev for his opinion, but then closed the thread. Kaspersky Labs' US-based public relations representative wasn't available Sunday for additional comment.

The company has had success in the past breaking Gpcode's encryption keys, however. Two years ago, when the ransomware Trojan first appeared, Kaspersky's researchers were able to crack the 660-bit key, but only because the malware's maker had made mistakes implementing the encryption algorithm. Gpcode also reappeared last summer, locking the encrypted files with what its maker claimed was a 4096-bit RSA key.

Kaspersky told users that backing up their data is the surest way to sidestep ransomware scams. "That way, if you do fall victim to Gpcode and your files get encrypted, at least you won't have lost any valuable information," said a third Kaspersky analyst, David Emm.



Share:

More from Techworld

More relevant IT news

Comments



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *