January 25, 2016 By Larry Loeb 2 min read

Bleeping Computer reported that researchers have been quietly helping victims of the ransomware TeslaCrypt, which was first discovered in early 2015, recover their files. This effort used a flaw in TeslaCrypt’s encryption key storage algorithm present in version 2.0 of the ransomware. The fact that this malware could be decrypted was kept under wraps because the researchers were hoping that the developer would not learn about it and attempt to find a fix.

But somehow the cybercriminals found out they had been hosed and came up with version 3.0, which corrected the key storage so that all keys were once again encrypted. Luckily, keys and files used in older versions of the ransomware are still recoverable, provided they have certain file extensions.

Key Storage: The Weakest Link

The problem for the ransomware revolved around how the decryption keys were stored on the target’s computer. The malware encrypts the victim’s files using the AES encryption algorithm. This means that it used the same key to encrypt and decrypt a file. Researchers found that every time TeslaCrypt was restarted, a new AES key was generated. This key was stored in the files that were encrypted during each session. As Bleeping Computer pointed out, that meant some files would be encrypted with different keys than others.

To protect this variable key, the malware developers first used another algorithm to encrypt it before it was stored in each encrypted file. That’s where researchers found the chink in the malware’s armor.

How TeslaCrypt Was Cracked Open

The size of this stored key was not sufficiently strong enough to remain hidden. It was possible for victims to use specialized programs to factorize the key and retrieve their prime numbers. Once the prime numbers were identified, other programs could reconstruct the decryption key and decrypt the malware-created files. Volunteers even opened a support forum to help infected users get their files back.

The efforts of these volunteers and researchers showed that a united response to this kind of pernicious malware is possible, and it can even succeed in retrieving data that has been hijacked. The community effort should give hope to others caught up in a web of criminal activities.

More from

Airplane cybersecurity: Past, present, future

4 min read - With most aviation processes now digitized, airlines and the aviation industry as a whole must prioritize cybersecurity. If a cyber criminal launches an attack that affects a system involved in aviation — either an airline’s system or a third-party vendor — the entire process, from safety to passenger comfort, may be impacted.To improve security in the aviation industry, the FAA recently proposed new rules to tighten cybersecurity on airplanes. These rules would “protect the equipment, systems and networks of transport…

Protecting your digital assets from non-human identity attacks

4 min read - Untethered data accessibility and workflow automation are now foundational elements of most digital infrastructures. With the right applications and protocols in place, businesses no longer need to feel restricted by their lack of manpower or technical capabilities — machines are now filling those gaps.The use of non-human identities (NHIs) to power business-critical applications — especially those used in cloud computing environments or when facilitating service-to-service connections — has opened the doors for seamless operational efficiency. Unfortunately, these doors aren’t the…

Communication platforms play a major role in data breach risks

4 min read - Every online activity or task brings at least some level of cybersecurity risk, but some have more risk than others. Kiteworks Sensitive Content Communications Report found that this is especially true when it comes to using communication tools.When it comes to cybersecurity, communicating means more than just talking to another person; it includes any activity where you are transferring data from one point online to another. Companies use a wide range of different types of tools to communicate, including email,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today