Ask HN: The most recent REvil ransomware attack may have an easy fix
In their ransom note, they demanded a Bitcoin payment, for which they promised to provide a decryptor tool which would revert the encryption.
Is it just me, or are we seeing a pattern here?
They never requested any identifier, meaning that they most likely have a single encryption key, re-used everywhere. They don't seem to have a database of keys for each victim.
If they are able to provide a "master decryptor tool" which would decrypt files for every one of their victims, this means that the encryption was most likely done with the same key everywhere.
Does anyone have the copy of the original encryptor they used? In theory, we should be able to reverse-engineer it and extract the key which was used for encryption, and develop an open-source and free tool which allows their victims to decrypt their files for free, effectively reversing the damage done?