Security firm asks for help cracking ransomware key
New blackmailing Trojan encrypts files using high-grade 1024-bit RSA key
Computerworld - A security company on Friday asked for help cracking an encryption key central to an extortion scheme that demands money from users whose PCs have been infected by malware.
Kaspersky Lab, a Moscow-based antivirus firm, put out the call for assistance after it discovered a new variant of Gpcode, a Trojan horse that has been used in isolated "ransomware" attacks for the past two years.
In ransomware attacks, hackers plant malware that encrypts files and then displays a message demanding money to unlock the data. In the case of the newest Gpcode, 143 different file types are encrypted, including .bak, .doc, .jpg and .pdf. The encrypted files are marked by the addition of "_CRYPT" in their file names, and the original unencrypted files are deleted. As a camouflaging move, Gpcode also tries to erase itself.
Finally, the ransom note appears on-screen. "Your files are encrypted with RSA-1024 algorithm," it begins. "To recovery [sic] your files you need to buy our decryptor. To buy decrypting tool contact us at: email@example.com."
Last Thursday, a Kaspersky analyst identified as "VitalyK" said that although the company had analyzed samples of Gpcode, it wasn't able to decrypt the files the malware encoded. "We can't currently decrypt files encrypted by Gpcode.ak," said VitalyK in an entry to the company's research blog. "The RSA encryption implemented in the malware uses a very strong, 1024-bit key."
According to Kaspersky's write-up, the key is created by Windows' built-in cryptographic component, Microsoft Enhanced Cryptographic Provider. Kaspersky has the public key in hand — it is included in the Trojan's code — but not the associated private key necessary to unlock the encrypted files.
Two days later, another Kaspersky researcher asked for help. "Along with antivirus companies around the world, we're faced with the task of cracking the RSA 1024-bit key," said Aleks Gostev, a senior virus analyst. "This is a huge cryptographic challenge. We estimate it would take around 15 million modern computers, running for about a year, to crack such a key." Gostev provided the public key in his posting.
"So we're calling on you: cryptographers, governmental and scientific institutions, antivirus companies, independent researchers," said Gostev. "Join with us to stop Gpcode."
One rival researcher, however, took exception to the call to arms. In a message posted to Kaspersky's support forum, Vesselin Bontchev, a Bulgarian researcher who works for Frisk Software, an Icelandic antivirus company, called it a stunt.
"What is proposed here is an unrealistic, useless waste of time that will fail," said Bontchev, who also charged that Kaspersky's estimate of the computing time it would take to break the key was optimistic. "The only use of this project is for generating free publicity for Kaspersky Labs."
- Troubleshooting Common Issues in VoIP Learn more about Voice over Internet Protocol (VoIP), including common VoIP metrics used, best practices in VoIP management and tips and tricks for...
- 2013 Network Management Software (NMS) Buyers Guide This white paper contains an independent comparison study of six different network management solutions and provides guidance on how you can choose the...
- Rightsizing Your Network Performance Management Solution: 4 Case Studies This white paper discusses challenges encountered as organizations search for the most cost-effective network performance management solution.
- Global Growing Pains: Tapping into B2B Integration Services to Overcome Global Expansion Challenges A recent survey by IDG Research explored both the challenges and pain points companies face when growing globally, as well as the capabilities...
- E-Signature RFP Checklist Webcast If your organization is looking to adopt e-signatures, you may be overwhelmed by the number of providers that offer seemingly similar solutions. How...
- Cloud and Collaboration: Driving Your Business Value Mission Critical Cloud from Peer 1 Hosting is enterprise-grade. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!