WannaCry in-memory key recovery for Windows XP
1–10 of 95 posts
Re: WannaCry in-memory key recovery for Windows XP
#2Looks interesting, anyone tried these steps? Did it work for you?
Re: WannaCry in-memory key recovery for Windows XP
#3It's only been tested on Windows XP? surprising they couldn't/didn't set up a 7/8/10 VM to try and replicate the results
Re: WannaCry in-memory key recovery for Windows XP
#4You've got to admit it's a little funny when an OS's security flaws prevent even targeted malware from working properly.
Re: WannaCry in-memory key recovery for Windows XP
#5It's only been tested on Windows XP? surprising they couldn't/didn't set up a 7/8/10 VM to try and replicate the results
It looks like Microsoft's documentation suggests it will only work on older versions of Windows. From the README:
> Indeed, for what I've tested, under Windows 10, CryptReleaseContext does cleanup the memory (and so this recovery technique won't work). It can work under Windows XP because, in this version, CryptReleaseContext does not do the cleanup. Moreover, MSDN states this, for this function : "After this function is called, the released CSP handle is no longer valid. This function does not destroy key containers or key pairs.". So, it seems that there are no clean and cross-platform ways under Windows to clean this memory.
I'd be curious where the change happened between XP and 10.
Re: WannaCry in-memory key recovery for Windows XP
#6It's only been tested on Windows XP? surprising they couldn't/didn't set up a 7/8/10 VM to try and replicate the results
From the TFA:
This is not really a mistake from the ransomware authors, as they properly use the Windows Crypto API. Indeed, for what I've tested, under Windows 10, CryptReleaseContext does cleanup the memory (and so this recovery technique won't work). It can work under Windows XP because, in this version, CryptReleaseContext does not do the cleanup. Moreover, MSDN states this, for this function : "After this function is called, the released CSP handle is no longer valid. This function does not destroy key containers or key pairs.". So, it seems that there are no clean and cross-platform ways under Windows to clean this memory.
If you are lucky (that is the associated memory hasn't been reallocated and erased), these prime numbers might still be in memory.
That's what this software tries to achieve.
Re: WannaCry in-memory key recovery for Windows XP
#7It's only been tested on Windows XP? surprising they couldn't/didn't set up a 7/8/10 VM to try and replicate the results
The Twitter says that it has been adapted to work on 7.
The readme points out that CryptReleaseContext works better in 10 and thus the recovery doesn't work.
Re: WannaCry in-memory key recovery for Windows XP
#8You've got to admit it's a little funny when an OS's security flaws prevent even targeted malware from working properly.
Heh. Since this only works before a reboot and Windows 10, by design, destructively reboots with no recourse, I could imagine this ironic farce:
a) security holes lead to a ransom, b) security holes let you reverse the ransom, but c) forced reboots kill any hope you have of recovering with this kind of hack.
Re: WannaCry in-memory key recovery for Windows XP
#9You've got to admit it's a little funny when an OS's security flaws prevent even targeted malware from working properly.
[deleted]
Re: WannaCry in-memory key recovery for Windows XP
#10Since WannaCry is somewhat neutered at the moment (thanks to the killswitch), and this tool stops working after a reboot, I'd say this tool is somewhat useless, with no intention to insult the man who created it. It's just the circumstances. After a week, almost all victims have rebooted their PCs or the memory has been re-written with other data.