Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WannaCry in-memory key recovery for Windows XP

github.com

Post reply on HN
Print view View original

61–70 of 95 posts

Re: WannaCry in-memory key recovery for Windows XP

#61

Post by jamiek88 »

kybernetikos wrote: post #32
soared wrote: post #17

Earlier quoted context omitted.

I mean a technical user capable of this solution is not very likely to get hit by this in the first place. The hacker probably doesn't care if x% of people defeat the encryption.. as long as x% pay the ransom.

Given the infrastructure and health victims that have been hit, I certainly hope that some serious people are looking into this. Given the relatively small sums of money we've seen flowing into the bitcoin addresses, if I were the perpetrator, I would not think I'd got a particularly good deal - exchanging 40k or so for interest from a number of heavy hitting actors just doesn't seem worth it.

It probably does to a pair of 16 year olds in eastern Europe.

The problem with these tools being made and leaked is it lowers the bar of technical expertise needed to run a scheme like this.

If it still took massive knowledge and experience the likelihood is that person could earn more legitimately thus there is a smaller pool of potential attackers.

Re: WannaCry in-memory key recovery for Windows XP

#63

Post by dpark »

lorenzhs wrote: post #56
PhasmaFelis wrote: post #52

Earlier quoted context omitted.

Windows XP systems were the primary victims of WannaCry.

That is untrue: https://twitter.com/craiu/status/865562842149392384

This assumes that Kaspersky software usage is consistent across Windows versions, which seems vanishingly unlikely since most XP systems are in China or in Corp environments.

Re: WannaCry in-memory key recovery for Windows XP

#64

Post by userbinator »

murbard2 wrote: post #47

The attackers seem to have a poor grasp on cryptography. The entire point of RSA is that they don't have to generate the key locally. Just ship your ransomware with the attacker's public key, generate a symmetric key K locally, encrypt the data with K, encrypt K with the public key, offer to decrypt K for a ransom. There seems to be an inverse correlation between smart and evil in human beings which is reassuring, bu…

I'm going to point at the elephant in the room and say that, there are probably quite a few reading this post and screaming in their mind, don't help them!!

There seems to be an inverse correlation between smart and evil in human beings which is reassuring, but only mildly.

Indeed, this isn't the first time ransomware with bad crypto has lead to a win for the good guys:

http://blog.cassidiancybersecurity.com/post/2014/02/Bitcrypt...

http://0xec.blogspot.com/2016/04/reversing-petya-ransomware-...

Re: WannaCry in-memory key recovery for Windows XP

#66

Post by chii »

limeblack wrote: post #65

Does anyone know what would have happened if my laptop was encrypted with wannacry and my laptop hard drive was basically full?

my blind guess would be that they'd delete the original file, which frees up some space, and write the encrypted version in its place (which, if the encrypted version is somehow bigger, would fail, or get truncated).

It's unlikely that the malware would stop encrypting.

Re: WannaCry in-memory key recovery for Windows XP

#67

Post by chinhodado »

equivrel wrote: post #38
uep wrote: post #36

Earlier quoted context omitted.

If someone were to pay up and receive the attacker's private key, what's to stop them from distributing it to others?

That's exactly the trick: the attacker doesn't send you their private key, they decrypt (using their private key) the other private key that the ransomware generated on your machine, which is what was used to encrypt the per-file AES keys.

To clarify, the files are encrypted with a symmetric key, which even though is "private", is not part of a public-private key pair in asymmetric crypto.

Re: WannaCry in-memory key recovery for Windows XP

#68

Post by Senderman »

userbinator wrote: post #64
murbard2 wrote: post #47

The attackers seem to have a poor grasp on cryptography. The entire point of RSA is that they don't have to generate the key locally. Just ship your ransomware with the attacker's public key, generate a symmetric key K locally, encrypt the data with K, encrypt K with the public key, offer to decrypt K for a ransom. There seems to be an inverse correlation between smart and evil in human beings which is reassuring, bu…

I'm going to point at the elephant in the room and say that, there are probably quite a few reading this post and screaming in their mind, don't help them!! There seems to be an inverse correlation between smart and evil in human beings which is reassuring, but only mildly. Indeed, this isn't the first time ransomware with bad crypto has lead to a win for the good guys: http://blog.cassidiancybersecurity.com/post/201…

Not to interfere with any internal screaming, but I think (hope?) most would agree that a secondary elephant in the room is that suppressing knowledge so as not to help the "bad guys" tends to be the worse evil.

Re: WannaCry in-memory key recovery for Windows XP

#69

Post by mikeash »

kaoD wrote: post #48
mikeash wrote: post #44

Earlier quoted context omitted.

It depends on how granular your clock is, too. If you seed with a number of seconds then it's pretty easy to brute-force that. If you seed with nanoseconds it'll be a lot harder.

> If you seed with nanoseconds it'll be a lot harder. Not really. Or rather, a lot of zero is zero.

Can you elaborate? I'm assuming the nanosecond-precision lock seeding the RNG is based on wall clock time or system uptime, so as long as the clock is actually that precise (and why not, when the base clock signal in the CPU is ticking a couple of times each nanosecond) you'll get that many digits.

Re: WannaCry in-memory key recovery for Windows XP

#70

Post by kaybe »

pjc50 wrote: post #60
rzzzt wrote: post #42

Earlier quoted context omitted.

It sort-of-hibernates if fast startup is enabled: https://msdn.microsoft.com/en-us/library/windows/hardware/jj...

That looks on-demand to me, I'm struggling to see the relevance?

It's by default which I learned when Linux complained it couldn't mount the Windows partition at startup.
Post reply on HN