Cloud

4/28/2015
03:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Cisco Offers Free Decryption Tool For Ransomware Victims

Tool decrypts, unlocks files hit by TeslaCrypt ransomware attacks.

First the good news: there are now free utilities for decrypting your data after a ransomware attack. Now the bad news:  the tools only work for specific ransomware, not all variants.

Cisco Systems' Talos team today released a free tool for victims of the TeslaCrypt ransomware attack that decrypts the locked-down files. TeslaCrypt, which Cisco says may be related to the now mostly defunct CryptoLocker, uses symmetric AES encryption, which allowed Cisco to build a tool using the decryption key. Interestingly, TeslaCrypt warns that it uses strong asymmetric AES-2048 encryption to lock victims out of their files, but that's not the case.

TeslaScript goes after various victims, including PC gamers, whose games and coveted and valuable Steam activation keys get locked down in its attack.

"We reverse engineered the way the TeslaCrypt worked and were able to develop the tool based on that," says Earl Carter, threat researcher with Talos. "In the past, we have also reverse engineered other ransomware, like Cryptowall, but in that case, the ransomware was using asymmetric encryption, so creating a tool was not possible."

Kaspersky Lab, meanwhile, offers a tool for victims of the CoinVault ransomware. Kaspersky, which teamed up with Dutch law enforcement authorities in the CoinVault attacks, obtained access to the private keys from the attackers and offers CoinVault victims who are locked out of their data access to their confiscated key.

"The Kaspersky instance is similar to the original CryptoLocker decryption tool that was developed after the police takedown of CryptoLocker.  Both of those tools consists of a list of private keys obtained by law enforcement -- not necessarily all of the private keys generated by the ransomware. If one of these private keys corresponds to the key used to encrypt your system -- the keys are unique per system -- then you can recover your files," Cisco's Carter says.

Cisco's tool is different in that it can recover the files on any system infected by TeslaCrypt "as long as the master key is still on the system and we developed the tool without having to access one of the threat actor's servers," he says.

Dave Lewis, global security advocate for Akamai, says ransomware decryption tools are more of a stopgap measure. These ransomware decryption tools help, he says, but it's a temporary fix.

Lewis says he's noticed how ransomware attackers have gradually upped the ante in their blackmail. "I've noticed it's been slightly going up incrementally," says Lewis, who will speak at the Dark Reading Cyber Security Crash Course at Interop Las Vegas tomorrow.

The key to defending against ransomware attacks are basic security hygiene: layered defenses and good security awareness programs for end users, according to Lewis.

Cisco's Carter says the tool is aimed at all levels of victims, technical or nontechnical. "This tool is only a single instance of ransomware. There are many variants of ransomware currently attacking user systems," he notes. "The best defense is a strong multi-layered defense strategy including an industry standard backup and restore policy. A good backup will circumvent almost all of these ransomware variants."

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
BillyC608
50%
50%
BillyC608,
User Rank: Apprentice
5/12/2017 | 3:59:24 AM
Great software
Well I started using Impedio Security a while ago and I must say that I'm suprised I didn't find it earlier. It's great way to keep your data safe and don't have to worry about your files being corrupted iny any way. It's helpful because last time my friend acidentally deleted folder where I had important stuff for school and now I just put these folders in read-only volumes so no one can delete them, even malicious softwares. I was ransomware victim once but thank God now it's all over and I encouraged all of you to get Impedio and don't worry about malware anymore (y)
Crypt0L0cker
50%
50%
Crypt0L0cker,
User Rank: Strategist
2/21/2017 | 12:39:27 PM
Re: Free Decryption Tools For Ransomware Victims
Unfortunately, not all of them are possible to decrypt. Here is the list of ransomware extensions and available decryptors for them.
BPID Security
50%
50%
BPID Security,
User Rank: Strategist
5/4/2015 | 5:25:14 PM
Thank you
Thank you Kelley.

This represents the good and bad of security.

First the bad you can get your data locked and the good is get help unlocking.

Second the bad means that for a price there are tools to decrypt your data available to those who shouldn't have them and your data is no longer 'safe' as there are free tools to unlock it. The good? Gee I don't know anything more than getting help when your data is locked and you don't have a key.

Great article and thanks for sharing.

 

Paul BPID Security

 

 
WillReadPC
50%
50%
WillReadPC,
User Rank: Apprentice
4/29/2015 | 3:27:53 PM
Help remove TeslaCrypt Virus - Worked for me...

Hey I know the TeslaCrypt virus is extremely prevalent this time of year, However; I was able to remove it from my computer using the steps listed in this 3-step guide 

https://virushelpcenter.com/remove-teslacrypt-virus/

Please let me know if anyone else if successful in removing this virus. The instructions are a little lengthy but it did the trick for me.

Hope this helps at least a few people,

Will

RyanSepe
100%
0%
RyanSepe,
User Rank: Ninja
4/29/2015 | 9:00:45 AM
Temporary Fix
Unfortunately, because this is only for certain variants of ransomware I see this teetering out in the near future. I can't see companies offering free utilities and spending man hours to reverse engineer all the new variants that come out. Though this is a good start, its not sustainable.
Memoinfo
50%
50%
Memoinfo,
User Rank: Apprentice
4/28/2015 | 7:45:21 PM
Re: From Reverse Engineering to Development
That's the way... You have to reverse to have the key
Christian Bryant
100%
0%
Christian Bryant,
User Rank: Ninja
4/28/2015 | 5:15:24 PM
From Reverse Engineering to Development
Something about this reminds me of how the first skeleton key must have come about, followed by a long and distinguished array of lock pickers.  Not only that, but the large keyring of both original and skeleton keys that we've come to associate with the locksmith who you call when you get locked out.  More on that later...

First, I think this is a brilliant piece of work on the part of all parties who have provided decryption tools to victims.  Not just because that is what they should do, but because it makes good business sense and it sets the tone for other companies and their customer relationships.

...and we're back.  What I see here is an opportunity, too.  Imagine developing a decryption tool that is the equivalent of that keyring your handy locksmith sports about.  You'd keep it on a USB or similar device, and it would have hundreds of thousands of modules based upon reverse-engineered ransomware (or other sources of encryption) and their key stores.  It would be bootable and based on GNU/Linux, BSD or a similar UNIX flavor.

No, you wouldn't be handing this out to folks, and no, only a "locksmith" (or in this case an InfoSec professional) would carry it. 

There are similar USB-geared projects out there but there is so much more you could do with the architecture.  Thinking out loud.
Game Change: Meet the Mach37 Fall Startups
Ericka Chickowski, Contributing Writer, Dark Reading,  10/18/2017
Why Security Leaders Can't Afford to Be Just 'Left-Brained'
Bill Bradley, SVP, Cyber Engineering and Technical Services, CenturyLink,  10/17/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.