<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>On Nov 21, 2013, at 9:08 PM, Greg Broiles wrote:</div><blockquote type="cite"><div dir="ltr">According to Steve Gibson at <a href="https://www.grc.com/sn/sn-427.txt">https://www.grc.com/sn/sn-427.txt</a>, when CryptoLocker contacts the central server(s), the servers generate a unique (per victim) 2048-bit RSA keypair; the public key is sent from the server to the infected machine. The infected machine generates a random 256 bit AES key, which is then encrypted with the public key and sent to the server, and used locally to encrypt the ransomed files. The key stored in the infected machine's registry is the public half of the RSA key. <br>
</div></blockquote></div>This does mean that if you manage to catch the program while it's running, you can (in principle; the practice may be quite difficult) extract the AES key, which is all you need - the RSA keypair is purely secondary. There are reports that the program will encrypt newly-created files on an infected machine, at least sometimes. If this is true, the program must have some way of asking for the AES key, even if the ransom hasn't been paid. That would be a major vulnerability.<div><br></div><div><div> -- Jerry</div></div><div><br></div></body></html>