It's hilarious that it uses public-key crypto, yet lets the client know the private key. What's even the point, then?
WannaCry in-memory key recovery for Windows XP
11–20 of 95 posts
Re: WannaCry in-memory key recovery for Windows XP
#12Since WannaCry is somewhat neutered at the moment (thanks to the killswitch), and this tool stops working after a reboot, I'd say this tool is somewhat useless, with no intention to insult the man who created it. It's just the circumstances. After a week, almost all victims have rebooted their PCs or the memory has been re-written with other data.
It's not actually neutered because there are variants without a kill switch.
Re: WannaCry in-memory key recovery for Windows XP
#13You've got to admit it's a little funny when an OS's security flaws prevent even targeted malware from working properly.
Heh. Since this only works before a reboot and Windows 10, by design, destructively reboots with no recourse, I could imagine this ironic farce: a) security holes lead to a ransom, b) security holes let you reverse the ransom, but c) forced reboots kill any hope you have of recovering with this kind of hack.
But Windows 10 was for the same reason largely not affected: it was patched and rebooted.
Re: WannaCry in-memory key recovery for Windows XP
#14It's hilarious that it uses public-key crypto, yet lets the client know the private key. What's even the point, then?
[deleted]
Re: WannaCry in-memory key recovery for Windows XP
#15It's hilarious that it uses public-key crypto, yet lets the client know the private key. What's even the point, then?
In the case of ransomware, it just has to work most of the time.
If the WannaCrypt author(s) want to (partly) address this particular tool, they could, for example, just make it reboot on XP after encrypting everything.
Re: WannaCry in-memory key recovery for Windows XP
#16That is nice!
But...
It really hurts my eyes to read "dump_hex" and "normalizedEntropy" in one file.
Is there actually any viable code style guide that one can follow when writing C++ application?
Re: WannaCry in-memory key recovery for Windows XP
#17It's hilarious that it uses public-key crypto, yet lets the client know the private key. What's even the point, then?
I mean a technical user capable of this solution is not very likely to get hit by this in the first place. The hacker probably doesn't care if x% of people defeat the encryption.. as long as x% pay the ransom.
Re: WannaCry in-memory key recovery for Windows XP
#18It's only been tested on Windows XP? surprising they couldn't/didn't set up a 7/8/10 VM to try and replicate the results
You would be welcome to also give it a shot and publish your results
Re: WannaCry in-memory key recovery for Windows XP
#19It's only been tested on Windows XP? surprising they couldn't/didn't set up a 7/8/10 VM to try and replicate the results
It looks like Microsoft's documentation suggests it will only work on older versions of Windows. From the README: > Indeed, for what I've tested, under Windows 10, CryptReleaseContext does cleanup the memory (and so this recovery technique won't work). It can work under Windows XP because, in this version, CryptReleaseContext does not do the cleanup. Moreover, MSDN states this, for this function : "After this functio…
.NET
Re: WannaCry in-memory key recovery for Windows XP
#20Since WannaCry is somewhat neutered at the moment (thanks to the killswitch), and this tool stops working after a reboot, I'd say this tool is somewhat useless, with no intention to insult the man who created it. It's just the circumstances. After a week, almost all victims have rebooted their PCs or the memory has been re-written with other data.
Rebooting doesn't stop the ransomware.