Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WannaCry in-memory key recovery for Windows XP

github.com

Post reply on HN
Print view View original

51–60 of 95 posts

Re: WannaCry in-memory key recovery for Windows XP

#51

Post by DaiPlusPlus »

murbard2 wrote: post #47

The attackers seem to have a poor grasp on cryptography. The entire point of RSA is that they don't have to generate the key locally. Just ship your ransomware with the attacker's public key, generate a symmetric key K locally, encrypt the data with K, encrypt K with the public key, offer to decrypt K for a ransom. There seems to be an inverse correlation between smart and evil in human beings which is reassuring, bu…

With your approach the (symmetric) key used to encrypt the files is still unprotected in memory for at least a short period of time.

I'm surprised ransomware doesn't use the TPM to protect their private keys - given that more computers have it now.

Re: WannaCry in-memory key recovery for Windows XP

#52

Post by PhasmaFelis »

nthcolumn wrote: post #37
josteink wrote: post #13

Earlier quoted context omitted.

But Windows 10 was for the same reason largely not affected: it was patched and rebooted.

And Windows XP was not targeted at all by WannaCry.

Windows XP systems were the primary victims of WannaCry.

Re: WannaCry in-memory key recovery for Windows XP

#53

Post by martinko »

DaiPlusPlus wrote: post #51
murbard2 wrote: post #47

The attackers seem to have a poor grasp on cryptography. The entire point of RSA is that they don't have to generate the key locally. Just ship your ransomware with the attacker's public key, generate a symmetric key K locally, encrypt the data with K, encrypt K with the public key, offer to decrypt K for a ransom. There seems to be an inverse correlation between smart and evil in human beings which is reassuring, bu…

With your approach the (symmetric) key used to encrypt the files is still unprotected in memory for at least a short period of time. I'm surprised ransomware doesn't use the TPM to protect their private keys - given that more computers have it now.

No. Encryption is done with the public key only. No knowledge of the private key is required. The private key is only used for decryption and can be delivered to the victim after payment is made.

Re: WannaCry in-memory key recovery for Windows XP

#54

Post by DaiPlusPlus »

martinko wrote: post #53
DaiPlusPlus wrote: post #51

Earlier quoted context omitted.

With your approach the (symmetric) key used to encrypt the files is still unprotected in memory for at least a short period of time. I'm surprised ransomware doesn't use the TPM to protect their private keys - given that more computers have it now.

No. Encryption is done with the public key only. No knowledge of the private key is required. The private key is only used for decryption and can be delivered to the victim after payment is made.

> Encryption is done with the public key only.

The post said encryption is performed with a new symmetric key K, and then K is encrypted with the attacker's asymmetric public key.

Remember asymmetric encryption doesn't scale for large amounts of data - which is why systems like TLS and full-disk-encryption still use symmetric keys - the asymmetric cryptoschemes are only really used during handshaking and for the exchange of symmetric keys.

Re: WannaCry in-memory key recovery for Windows XP

#55

Post by ahomescu1 »

murbard2 wrote: post #47

The attackers seem to have a poor grasp on cryptography. The entire point of RSA is that they don't have to generate the key locally. Just ship your ransomware with the attacker's public key, generate a symmetric key K locally, encrypt the data with K, encrypt K with the public key, offer to decrypt K for a ransom. There seems to be an inverse correlation between smart and evil in human beings which is reassuring, bu…

> Just ship your ransomware with the attacker's public key, generate a symmetric key K locally, encrypt the data with K, encrypt K with the public key, offer to decrypt K for a ransom.

It seems that what they're doing is generating a local Kpub/Kpriv pair, encrypting Kpriv itself and then offering to decrypt it. The files are encrypted with Kpub (approximately, see comments below for details). This has the advantage that they can encrypt all they want without knowing Kpriv, which only needs to live in memory long enough to get encrypted.

Re: WannaCry in-memory key recovery for Windows XP

#57

Post by tcbawo »

DaiPlusPlus wrote: post #54
martinko wrote: post #53

Earlier quoted context omitted.

No. Encryption is done with the public key only. No knowledge of the private key is required. The private key is only used for decryption and can be delivered to the victim after payment is made.

> Encryption is done with the public key only. The post said encryption is performed with a new symmetric key K, and then K is encrypted with the attacker's asymmetric public key. Remember asymmetric encryption doesn't scale for large amounts of data - which is why systems like TLS and full-disk-encryption still use symmetric keys - the asymmetric cryptoschemes are only really used during handshaking and for the exch…

Probably obvious, but they would not want to send a private key which could be used to help other victims. If they generated a symmetric key locally and encrypted it with their provided public key, they could decrypt the symmetric key for you in exchange for payment.

Re: WannaCry in-memory key recovery for Windows XP

#58

Post by ahomescu1 »

equivrel wrote: post #35
ahomescu1 wrote: post #26

Earlier quoted context omitted.

I don't know the exact details of how WannaCry encrypts the files, but ransomware generally works like this: when hitting a new machine, it generates a random key K1 and then encrypts all the user's files with AES (or some other symmetric key encryption) using K1 as the key. It then encrypts K1 itself using some public key Kpub embedded in the ransomware, then stores the encrypted K1 on disk. When the user pays the r…

This doesn't appear to be how WannaCry works: as ridiculous as it sounds, it looks like WannaCry actually generates a private key on the infected machine. If you look in search_primes.cpp (from line 251) in the linked repo, you'll see that the tool is literally searching the memory for prime numbers that divide the public modulus. EDIT: CiPHPerCoder appears to have figured how the key management works.

Right, I see that now. Adding an additional layer of RSA and per-file keys is an interesting twist. Generating a public/private key pair instead of a symmetric key seems to let them encrypt as many files as they want without keeping the private key in memory (which they relied on Windows to erase).

Re: WannaCry in-memory key recovery for Windows XP

#59

Post by pmoleri »

tcbawo wrote: post #57
DaiPlusPlus wrote: post #54

Earlier quoted context omitted.

> Encryption is done with the public key only. The post said encryption is performed with a new symmetric key K, and then K is encrypted with the attacker's asymmetric public key. Remember asymmetric encryption doesn't scale for large amounts of data - which is why systems like TLS and full-disk-encryption still use symmetric keys - the asymmetric cryptoschemes are only really used during handshaking and for the exch…

Probably obvious, but they would not want to send a private key which could be used to help other victims. If they generated a symmetric key locally and encrypted it with their provided public key, they could decrypt the symmetric key for you in exchange for payment.

So, to check if I understood.

The generated key is encrypted and the user has access to it. So, you send the encrypted key and pay the randsome to get the unecrypted private key. Is that so?

Re: WannaCry in-memory key recovery for Windows XP

#60

Post by pjc50 »

rzzzt wrote: post #42
pjc50 wrote: post #28

Earlier quoted context omitted.

> Windows 10, by design, destructively reboots with no recourse Eh? Under what circumstance?

It sort-of-hibernates if fast startup is enabled: https://msdn.microsoft.com/en-us/library/windows/hardware/jj...

That looks on-demand to me, I'm struggling to see the relevance?
Post reply on HN