Ransomware encryption mechanisms

Rezaur Rahman

Introduction: Ransomware is a kind of of malware which cryptographically lock user fi les and prevent them from accessing. As content of the aff ected fi les are changed, it becomes unusable for the user. To use these fi les again, the attacker claims fi nancial benefi t, usually in BitCoin, and in return the decryption key is promised to be provided and with which the user will be able to perform decryption and eventually convert the fi les back to readable format. But to understand how a ransomware works, fi rst some basic knowledge in cryptography is required and an overview is given below. Cryptography 101: In this section, we will briefl y discuss on how a encryption mechanism works and how it is used by the malware. After which, we will be able to understand at a basic level that whether we can decrypt the aff ected fi les or not. Symmetric Key: This encryption mechanism is dependent on a specifi c key. A mathematically computational process is performed

on the data to change it with the help of the key and reverse process is applied to revert it back to original form. This key is used to both encrypt and decrypt content of a fi le. This key can be considered as a lock with which you secure your personal items and those who have the key can unlock and obtain the those items. The process is illustrated in Figure 1.

This key can be any thing from numbers to symbols at any combination. The length of this key is not expected to be short so that it can not be brute forced. For those who are not familiar with brute force, it is a process by which all the character combinations are tested to discover the password. There are many algorithms which we can use to encrypt
our data securely.  AES (Advanced Encryption Standard)  DES (Data Encryption Standard)  IDEA (International Data Encryption Algorithm)  Blowfi sh  RC4 (Rivest Cipher 4)  RC5 (Rivest Cipher 5)  RC6 (Rivest Cipher 6)

One of the primary problem with is method is the key itself. It is quite diffi cult to either transport this key from one location to another, or store it securely. Such encryption method does not provide any inherent ability to protect the key from outsiders. If the key is obtained by another person, he or she can use this key to unlock the data with ease. However the performance benefi t of this encryption mechanism is high. The data can be encrypted or decrypted extremely fast. If a user want to encrypt a large pool of data, the user will see signifi cant reduction of time when comparing with asymmetric encryption.

Asymmetric Key: Asymmetric cryptography is also known as public-private key encryption. The public key in this mechanism is being used for encryption and the private key is for decryption. By randomly generating one pair of public key and one private key, which are mathematically related, one of the key is used for encryption and another one is for decryption.