Ransomware

[Leichter, Jerry]

| > The key size would imply PKI; that being true, then the ransom may
| > be for a session key (specific per machine) rather than the master
| > key it is unwrapped with.
| 
| Per the computerworld.com article:
| 
|    "Kaspersky has the public key in hand ? it is included in the
|    Trojan's code ? but not the associated private key necessary to
|    unlock the encrypted files."
| 
| http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9094818
| 
| This would seem to imply they already verified the public key was
| constant in the trojan and didn't differ between machines (or that
| I'm giving Kaspersky's team too much credit with my assumptions).
Returning to the point of the earlier question - why doesn't someone
pay the ransom once and then use the key to decrypt everyone's files:
Assuming, as seems reasonable, that there is a "session" key created
per machine and then encrypted with the public key, what you'd get
for your ransom money is the decryption of that one session key.
Enough to decrypt your files, not useful on any other machine.

There's absolutely no reason the blackmailer should ever reveal the
actual private key to anyone (short of rubber-hose treatment of some
sort).
							-- Jerry

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com