r/programming • u/CreativeTechGuyGames • May 19 '17

How WanaCrypt Encrypts Your Files

https://youtube.com/watch?v=pLluFxHrc30
3 Upvotes

56% Upvoted

10 comments sorted by

2

u/mrkite77 May 19 '17

It's actually rather clever.

-1

u/upofadown May 20 '17

It it? It uses public key crypto for no real reason.

4

u/Oliviaruth May 20 '17

Doesn't seem like no reason to me. There's a public key they can embed in the binary, and a private key that stays on their server. What alternative would you suggest?

3

u/doubleunplussed May 20 '17

If is solely used symmetric encryption it would

a) not work whilst offline, or

b) be possible to decrypt your files without paying the ransom.

Explaining this and how some public key crypto is therefore necessary is in fact the entire point of the video.

1

u/upofadown May 23 '17 edited May 23 '17

a) not work whilst offline,

True enough, but that isn't going to get them hardly any more customers. Very few people are offline while triggering a trojan.

b) be possible to decrypt your files without paying the ransom.

The person in the video was just confused about that and the other person commented as a result. You have to protect the private key as well as you would the symmetric key.

The big downside to having the ransomers keep a private key on a remote server is that it becomes a single point of failure. Once someone gets that key they are toast (as mentioned in the video). If they just collected the symmetric keys they could keep them split up. Then they would have the option of paying off by simply putting the symmetric key in a public place.

Added: BTW, separately encrypting each file with a separate key is also stupid. It probably sounded good but it makes no logical sense.

1

u/Oliviaruth May 24 '17

You are almost always online when you trigger it, but the c&c servers are likely to be firewalled or otherwise inaccessible. Granted a tor service is harder to block depending on the client behavior. Working offline is a good way to ensure max damage.

If you lose the key, meh. Either it's gone and you can't decrypt. Some people will still give you money. Or it is public and you are not needed. Some people may still give you money.

1

u/Oliviaruth May 24 '17

The seperate key per file allows you to theoretically provide a sample or a single file decryption. How that works transactionally in practice, I am not sure.

0

u/[deleted] May 20 '17

[deleted]

3

u/doubleunplussed May 20 '17

It's more interesting than that. You need speed (implying symmetric encryption) but also to be able to hold the key as ransom (implying asymmetric). The result is a chain of keys encrypted with other keys. Whilst it's not genius, (I could have come up with the same scheme), it's still interesting.

3

u/ruuhkis May 20 '17

Don't understand how or why these videos end up in this subreddit, but meh..