Network News

X My Profile
View More Activity

Ransomware Encrypts Victim Files With 1,024-Bit Key

Now more than ever, it's important that Windows users ensure their machines are safe from hackers. A dangerous new strain of malicious software that holds the victim's computers files for ransom has been unleashed, and Kaspersky Lab is warning that security researchers have yet to crack the encryption key.

The malware in this case is the latest version of Gpcode (Kaspersky calls it Gpcode.ak), a nasty piece of "ransomware" that scrambles all of the victim's data files with an encryption key known only to the attacker(s). Victims are told via a pop-up message that they need to purchase a special decryption program to regain access to their data.

Kaspersky and other anti-virus companies have previously unraveled the secret encryption key for all previous versions of Gpcode, but this time, the malware author apparently has learned from his previous mistakes. Now, the Gpcode author is encrypting victim files with an extremely strong 1,024-bit RSA encryption key.

"We estimate it would take around 15 million modern computers, running for about a year, to crack such a key," writes Aleks Gostev, senior virus analyst at Kaspersky, on the company's blog.

"The author has bided his time, waiting almost two years before creating a new, improved variant of this file encryptor. Gpcode.ak doesn't not repeat the errors found in previous versions of the virus."

Kaspersky said it's not clear yet how the ransomware is being spread. Once a system is infected and the files are encrypted, it leaves the following message in a pop-up alert:

"Your files are encrypted with RSA-1024 algorithm.
To recovery your files you need to buy our decryptor.
To buy decrypting tool contact us at: ********"

I don't see anyone but Kaspersky making a lot of noise about this virus, so my guess is that most of the victims are probably in Eastern Europe and Russia. But if your machine does get infected with Gpcode, Kaspersky wants to hear from you (so does Security Fix, for that matter). They're offering assistance to anyone victimized by this virus. Check out this link for more information.

The company also is trying to generate support for a collaborative effort to break the encryption key; check out the forum here. I wish Kaspersky luck with that, but I don't believe they will succeed. It is extremely fortunate for most users that this type of attack isn't more widespread, as it is likely that most victims will end up paying the ransom if they ever want their data returned.

Update, 4:24 p.m. ET: Fixed my inexcusable 1,028 goof in the headline and text.

By Brian Krebs  |  June 9, 2008; 9:30 AM ET
Categories:  Latest Warnings  
Save & Share:  Send E-mail   Facebook   Twitter   Digg   Yahoo Buzz   StumbleUpon   Technorati   Google Buzz   Previous: Revisiting the Safari Vulnerability on Windows
Next: Redefining Anti-Virus Software

No comments have been posted to this entry.

The comments to this entry are closed.

RSS Feed
Subscribe to The Post

© 2010 The Washington Post Company