That is nice! But... It really hurts my eyes to read "dump_hex" and "normalizedEntropy" in one file. Is there actually any viable code style guide that one can follow when writing C++ application?
WannaCry in-memory key recovery for Windows XP
21–30 of 95 posts
Re: WannaCry in-memory key recovery for Windows XP
#22It's hilarious that it uses public-key crypto, yet lets the client know the private key. What's even the point, then?
Exactly. I would've thought the malware would ask a C&C server to generate a key pair and then only send the public key to the malware. But I guess perhaps that required too much processing power for the server. But then again this can also distributed: let a random victim generate an RSA keypair for another victim.
Re: WannaCry in-memory key recovery for Windows XP
#23The sad fact is that the prevailing response to a potential worm is "shut down the computer" (hence losing the encryption keys held in memory).
Re: WannaCry in-memory key recovery for Windows XP
#24The sad fact is that the prevailing response to a potential worm is "shut down the computer" (hence losing the encryption keys held in memory).
I assume disconnecting the ethernet and/or wireless is too much of a rat's nest for your average office occupants. Better to cut off the appendage to stop the spread I guess.
Re: WannaCry in-memory key recovery for Windows XP
#25It's only been tested on Windows XP? surprising they couldn't/didn't set up a 7/8/10 VM to try and replicate the results
The Twitter says that it has been adapted to work on 7. The readme points out that CryptReleaseContext works better in 10 and thus the recovery doesn't work.
The variant for 7: https://github.com/gentilkiwi/wanakiwi
Re: WannaCry in-memory key recovery for Windows XP
#26It's hilarious that it uses public-key crypto, yet lets the client know the private key. What's even the point, then?
I don't know the exact details of how WannaCry encrypts the files, but ransomware generally works like this: when hitting a new machine, it generates a random key K1 and then encrypts all the user's files with AES (or some other symmetric key encryption) using K1 as the key. It then encrypts K1 itself using some public key Kpub embedded in the ransomware, then stores the encrypted K1 on disk. When the user pays the ransom, they receive the corresponding private key Kpriv that allows them to decrypt K1, which then lets them decrypt all their files.
I think what this tool does is read the unencrypted K1 directly from memory, which means Kpriv is no longer needed.
EDIT: One correction: the user doesn't receive Kpriv, instead they send the encrypted K1 to the ransomware owner who decrypts it and sends back K1.
Re: WannaCry in-memory key recovery for Windows XP
#27It's only been tested on Windows XP? surprising they couldn't/didn't set up a 7/8/10 VM to try and replicate the results
Cut them some slack, this was published a day ago or so. In a case like this, fast publication is more important: both to help people, and so other people can do things like replicating stuff on other OSs while you sleep.
Re: WannaCry in-memory key recovery for Windows XP
#28You've got to admit it's a little funny when an OS's security flaws prevent even targeted malware from working properly.
Heh. Since this only works before a reboot and Windows 10, by design, destructively reboots with no recourse, I could imagine this ironic farce: a) security holes lead to a ransom, b) security holes let you reverse the ransom, but c) forced reboots kill any hope you have of recovering with this kind of hack.
> Windows 10, by design, destructively reboots with no recourse
Eh? Under what circumstance?
Re: WannaCry in-memory key recovery for Windows XP
#29The sad fact is that the prevailing response to a potential worm is "shut down the computer" (hence losing the encryption keys held in memory).
That's still the correct response to a potential worm, shut it down before it can do damage.
Re: WannaCry in-memory key recovery for Windows XP
#30That is nice! But... It really hurts my eyes to read "dump_hex" and "normalizedEntropy" in one file. Is there actually any viable code style guide that one can follow when writing C++ application?
This is fast-published code, probably using code cut-and-pasted from elsewhere. Completely acceptable for cases like this where publishing fast is more important than esthetics.