Hacker News Reader

Comment by Cyph0n | Hacker News Reader

What I don't understand about ransomware in general is how the AES key is stored on the machine. I'm assuming that it's grabbed from the server, used only during encryption, and then scrubbed from RAM/filesystem. Otherwise, it would be possible to recover the key post-encryption. Or am I missing something?

View on HN

I've read a few articles of people managing to get the key out of the ransomware programs, so it some cases it really is just stored on the system and you can find it if you know what you're doing. Those articles were a while-back though, so it's possible they've 'fixed' that issue.

Like others have said, public/private key crypto can be used to achieve this, and fairly easy: The randomware is distributed with a public key, and after generating the AES key and encrypting the system, it then encrypts the AES key using the public key and removes all other copies of the AES key. Thus, nobody with access to the system can decrypt the system now unless they have the matching private key. If you pay to decrypt your system, the program sends off the encrypted AES key, and then they send back the decrypted AES key which they got by using the matching private key. And then from there you use the AES key to decrypt the rest of the system.

That makes sense. Thanks for the explanation.

The encryption uses a public/private keys to encrypt the files using the public key, while keeping the private key stored on the remote servers. The clients PC never has access to the decryption key.

https://en.wikipedia.org/wiki/Public-key_cryptography

Using PK crypto would be horrendously slow, especially if there are a large number of files. Besides, the article notes that this ransomware uses AES-256.

Perhaps the AES key is encrypted with RSA after encryption is complete and kept on the infected machine.

Who cares about the key? It's not like the victim is gonna find it and reverse the cryptography himself.

Hiding the key is unnecessary over engineering.

If the key is accessible, someone could write software to automate breaking your ransomware.

That is generally how one encrypts large files with pk, yea. In fact I vaguely recall some crypto tool I had for personal use many years ago did exactly that for files above some size.

The end result is you see a file encrypted with a symmetric key.

Yes, given a theoretical ransomware which uses AES and RSA I would assume it's operating like this (pseudo-code):

    private_key, public_key = keygen_rsa();
    send_home(computer_id, private_key);
    wipe(private_key);

    for file in files {
        aes_iv = ivgen_aes()
        aes_key = keygen_aes()

        encrypted_file = aes_ccm_encrypt(file, aes_iv, aes_key);
        encrypted_aes_key = rsa_encrypt(aes_key, public_key);
        wipe(aes_key);

        filepos(file, 0);
        write(file, aes_iv);
        write(file, encrypted_aes_key);
        write(file, encrypted_file);
    }

I'd guess something more like (ignoring IVs for now):

    aes_key = keygen_aes()
    crypted_aes_key = rsa_encrypt(MALWARE_PUB_KEY, aes_key)
    for file in files:
        content = read(file)
        encrypted = aes_encrypt(content, aes_key)
        write(file, encrypted)
    wipe(aes_key)
    display(RANSOM_NOTE, crypted_aes_key)

I'd assume all the details needed to decrypt the files EXCEPT for a small key would be stored in the encrypted file headers. The AES key could be encrypted to a given public key and then directly displayed to the victim. This means that the software doesn't really need to know how to send infoto the ransomware writers. Instead the victim would be responsible for contacting them.

Interesting idea! So for example, the user would provide the displayed hex digest as a note along with the payment. The payment verification server could then email the user the decrypted key.

Yeah, or more likely a Bitcoin address and payment amount would be generated based on the attacker's Bitcoin public key and a hash of the encrypted key. Then the victim would pay that address and somehow contact the attacker (email, forum, twitter, whatever). The point is that the attacker could rely on the victim's human ingenuity to make it harder for the authorities to block payments.

>Perhaps the AES key is encrypted with RSA after encryption is complete and kept on the infected machine.

I think this is how PKE is usually done, precisely for the reasons you mention.

Generally they generate a private / public keypair, transmit them to a server, store both somewhere while the encryption process is in progress, then they scrub the local private key.

I do have a follow up question to this. If the ransomware encrypt the files, then it would also need to delete the original files. Unless the original files are overwritten, wouldn't it be possible to recover them? If the files are indeed overwritten, I would presume it would take a really long time, and, if I remember correctly, this wouldn't work on SSDs, unless you fill the SSD completely. Or am I missing something?

All the user's data is stored on the machine, too, and that doesn't help either.

I think they encrypt the files with an AES key, which is then encrypted with a public key received from the botnet herder.

Reply on news.ycombinator.com