Hacker News Reader

Comment by nathan_f77 | Hacker News Reader

> if there's an unlocking mechanism it's possible someone can crack it.

Not at all. This is run-of-the-mill encryption. You pay the bitcoins, your computer receives the decryption key. There is no possible way to crack it, otherwise the entire internet would be broken. (i.e. TLS)

View on HN

I don't follow - are you referring to this specific malware (which tbh I don't know much about) or ransomware in general? There have been plenty of ransomware cracks and decryptors released - programmers aren't perfect.

https://noransom.kaspersky.com/

Oh, just ransomware in general. I was under the impression that most of the big ones just did simple encryption, and hold the decryption key ransom on an external server. It would defeat the purpose if they kept the decryption key on the local machine, because yeah, then you could just release a tool like the ones you mentioned.

Except there've been multiple cases of ransomware where the encryption was improperly implemented and trivially cracked.

Similar to the entire internet, while the tools to securely encrypt things exist, incompetence can cause people to roll their own, or roll things out improperly.

Encryption is difficult to get right. Multiple ransomwares have failed because they screwed it up and it was possible to decrypt without paying. It's also time consuming. It takes a long time to encrypt every file on a hard drive and antivirus will scan for that kind of behavior.

Whereas throwing together a program that corrupts every file on the hard drive is not too difficult.

First the kill switch, now this: https://github.com/aguinet/wannakey

You were wrong.

Oh yeah I saw that, but this was also interesting:

> This is not really a mistake from the ransomware authors, as they properly use the Windows Crypto API. Indeed, for what I've tested, under Windows 10, CryptReleaseContext does cleanup the memory (and so this recovery technique won't work)

(From https://news.ycombinator.com/item?id=14377328)

So it's yet another security bug in Windows that lets people recover those keys.

Reply on news.ycombinator.com