Security firms team to take down rudimentary ransomware

Script kiddies are doing a terrible job of encryption

8 Reg comments Got Tips?

Two new ransomware efforts have been destroyed by meddling white hats.

"PowerWare" and "Bart" have been dismembered and laughed at by good-guy hackers who found flaws that allow user machines infected by current forms of the threats to decrypt their files for free.

Palo Alto's Tyler Halfpop, Jacob Soo and Josh Grunzweig, together with a separate team of AVG engineer Jakub Kroustek and PkCrack's Peter Conrad, hung the latest hunting trophies on the wall of the the ransomware hall of shame over the last week.

Those walls have been filling ever since decrypting ransomware became something of a sport among the anti-malware community.

Halfpop, Soo, and Grunzwieg described their victim, PowerWare, revealing that while it was popping hospitals, it was lamb dressed as lion and imitated the fiercer Locky ransomware but sported much weaker encryption and, fatally, hardcoded keys.

Their decryption tool will liberate its prisoners.

Kroustek and Conrad enjoyed mimicking Bart, explaining that the password-zipping ransomware can be made to look meek using AVG's slick decryptor that will release files by comparing unencrypted files to the encrypted original.

Anti-malware writers have flayed scores of ransomware variants, with collaboration among firms helping to lay waste to sloppy crims.

The decryption is possible thanks to poor coding and implementation of encryption schemes, not through breaking ciphers itself.

The latest versions of CTB Locker, Cryptowall, and Locky ransomware to date appear to stand unbroken, forcing victims to restore backups, pay the ransoms, or resort to rm -rf. ®


Biting the hand that feeds IT © 1998–2020