Oh no, you're thinking, yet another cookie pop-up. Well, sorry, it's the law. We measure how many people read us, and ensure you see relevant ads, by storing cookies on your device. If you're cool with that, hit “Accept all Cookies”. For more info and to customize your settings, hit “Customize Settings”.

Review and manage your consent

Here's an overview of our use of cookies, similar technologies and how to manage them. You can also change your choices at any time, by hitting the “Your Consent Options” link on the site's footer.

Manage Cookie Preferences
  • These cookies are strictly necessary so that you can navigate the site as normal and use all features. Without these cookies we cannot provide you with the service that you expect.

  • These cookies are used to make advertising messages more relevant to you. They perform functions like preventing the same ad from continuously reappearing, ensuring that ads are properly displayed for advertisers, and in some cases selecting advertisements that are based on your interests.

  • These cookies collect information in aggregate form to help us understand how our websites are being used. They allow us to count visits and traffic sources so that we can measure and improve the performance of our sites. If people say no to these cookies, we do not know how many people have visited and we cannot monitor performance.

See also our Cookie policy and Privacy policy.

This article is more than 1 year old

TorrentLocker unpicked: Crypto coding shocker defeats extortionists

Lousy XOR opens door into which victims can shove a foot

Crooks have borked the encryption behind the TorrentLocker ransomware, meaning victims can avoid paying the extortionists and unlock their data for free.

TorrentLocker was regarded as the demonic spawn of CryptoLocker and CryptoWall which made killings last year by encrypting valuable data owned by individuals and organisations.

Research trio Taneli Kaivola, Patrik Nisén and Antti Nuopponen of Finnish consultancy Nixu said victims could break the ransomware if they had a plaintext backup of any of their now encrypted files.

"In practice this means that if you have both the original and the encrypted version of a single file that is over 2MB in size, the entire keystream can be recovered which makes it possible to recover all your files encrypted by TorrentLocker," the trio write.

"As the encryption was done by combining the keystream with the plaintext file using the XOR operation, we were able to recover the keystream used to encrypt those files by simply applying XOR between the encrypted file and the plaintext file.

"We tested this with several samples of the affected files we had and realised that the malware program uses the same keystream to encrypt all the files within the same infection. This was a cryptographic mistake on the malware author's part, as you should never use the keystream more than once."

TorrentLocker appended 264 bytes of junk data to encrypted files and only locked down the first 2Mb of the files.

The researchers suspected the 2Mb limit was a deliberate strategy to make TorrentLocker faster, which the malware's developers may not have known would also weaken its security.

The mystery 264 bytes was unique for each infection meaning the researchers could write a tool to recognise the encryption keystream and decrypt the affected files.

TorrentLocker's irate authors would likely issue a fixed version of the ransomware so readers should ensure their important files were backed up on offline media.

Most failed ransomware did so due to poor encryption implementations rather than the use of weak crypto schemes.

The most successful ransomware used strong, well-implemented encryption schemes and ensured the success of their business model by rewarding victims who paid ransoms with decryption keys. ®

Similar topics

TIP US OFF

Send us news


Other stories you might like