You really need to read up on public-key cryptography, methinks.
The scheme - if properly (i.e. securely) implemented - could work somewhat like this:
- generate a public/private key pair on the infected/affected machine. NOTE: this means each key pair is specific to the machine and there is no single private key that could be used to decrypt everything across a number of machines
- transfer the private key to the C&C server
- securely delete (overwrite) the private key (assuming it was even ever on disk ... could have been in memory the whole time)
- encrypt files against the public key (matching the now unavailable private key)
- show the ransom note
... now, as a victim you don't have a private key at all.
You can vary this further, of course. So this is just one example of how to make sure there is no escape from paying the ransom other than having an (offline) backup in place.
Now some more comments regarding what seem to be misconceptions on your part:
From my understanding most randomware has a secret key used for
encryption in a server which it contacts to send over the key and use
it for encryption
In asymmetric crypto you need
- the public key:
- to encrypt data (with the owner of the matching private key being the recipient) or
- validate a signature (made by the owner of the matching private key)
- the private key:
- to decrypt data or
- sign something
Why would someone trying to extort a ransom from you give you the private key before payment?
But I am wondering, couldnt someone easily either intercept the
winsock functions or just grab the key themselves and use it to
decrypt the encrypted files?
Since this is based on the misconception above ... nope. But let's assume for a second that that "author" of the ransomware would want to provide a way to prove they are able to decrypt the data, they could simply demand that the victim send them one encrypted file and send back the decrypted file without the victim ever getting to see the private (or "secret") key. With this modus operandi I have immediately dismantled your idea of sniffing the private key (by whatever means).
Also, transport encryption (TLS) can be used to make it even harder to sniff the traffic. So good luck with your suggestion. In theory it may work, but only if the "author" of the ransomware is patently stupid.
Even if it is encrypted, it couldnt be that hard to find the place
where it gets decrypted by debugging the ransomware
You would only ever get the private key from the ransomware "author" after payment. So for all practical purposes they could even disclose the source code of their "client-side" software and you'd still have to pay to be able to decrypt your files.
The gist is: if properly implemented, modern crypto is rather secure. In this case to the disadvantage of the victims.
Your view on ransomware, and I don't mean this in any denigrating fashion, is rather naïve. I hope I have clarified some aspects.