Though so-called ransomeware has been around since 2004, this
year has seen the first instances which used sophisticated
encryption technology to hold data prisoner, according to
anti-virus firm Kaspersky.
"January 2006 was the first time that a blackmail virus,
Gpcode.ac, used a sophisticated encryption algorithm," said
Alexander Gostev, senior virus analyst at Kaspersky in that
company's latest quarterly report.
Ransomeware attacks take control of a company's data and encrypt
it. The password to the encryption is only released if money is
paid to the hackers carrying out the attack. Companies which back
up their data regularly cannot be held to ransom since they have
independent access to their data.
Previous attempts to hold companies to ransom used some fairly
basic encryption, quickly resulting in an encryption war between
the perpetrators and the security firms.
"The author used the RSA algorithm to create a 56-bit key, and
cracking it didn't pose any problems for antivirus companies," said
Gostev. "It seems that the speed at which the problem was solved
caused the virus writer to rethink his/her approach. In June, the
Russian segment of the internet was attacked by a new version of
Gpcode, but this time a 260-bit key was used. However, this longer
key didn't cause problems for our analysts, who were able to crack
it in less than 5 minutes. This was the start of a face-off between
the two sides – who would be more persistent, who would have better
knowledge of cryptography, and who would have access to the most
computing power?"
Gostev said in his report that the company was eventually able
to break a 330-bit key, and then a 660-bit key, though he will not
say how. "On 7th June 2006, Gpcode.ag was downloaded to thousands
of Russian computers from an infected site. This latest variant
used a 660-bit key, the longest key which has ever been broken.
According to estimates, it would take at least 30 years using a 2.2
GHz computer to break such a key. But luck was on our side – our
analysts were able to add decryption routines for files which had
been encrypted using this key to antivirus databases within a
single day."
The viruses behind the ransoms were spread via a Russian
recruitment site, so some social engineering was involved in its
spreading. Gostev said that the problem, though solved in the short
term, is likely to grow in seriousness, even if the writers of the
current viruses are found.
"RansomWare will undoubtedly remain a major headache for the
antivirus industry, at least in the near future," he said in his
report.
