CTB-Locker is a currently active ransomware that encrypts files to lock users out.

Here are a few links about this malware:

Is there a complete analysis about the encryption used by CTB-Locker, and some hints about possible cryptanalysis based on some weaknesses of this cryptographic scheme that can be used to recover the encrypted files.

The idea would be to produce a (free) tool similar to decryptcryptolocker.com, that can perform the decryption for users.

  • Do you think this would work better on crypto stack exchange? – baordog Feb 11 '15 at 16:41
  • 1
    @baordog He's pretty much just asking if anyone's analyzed this particular piece of malware. Not sure the Crypto SE would know what to do with it. – RoraΖ Feb 11 '15 at 17:02
  • 1
    I'm afraid that, even if "us" reverse-engineers would be able to reverse the malware to fully documented source code, we'd need the help of "them" crypto guys to attack it; and there was no way to succeed unless the malware writers messed up somewhere. Openssl has been open source for >10 years and we still don't know how to sniff TLS traffic. – Guntram Blohm supports Monica Feb 11 '15 at 18:39
  • In fact, it seems that the cipher algorithm used by CTB-Locker has a few weaknesses and the context in which the cipher occurs is a bit peculiar because you may imagine to have access to some couple (ciphertext, cleartext) if you have a (partial) backup of your system. The point here is to recover precisely the encryption scheme of CTB-Locker to see if there is a way to break it. – perror Feb 11 '15 at 18:58

I found a full analysis of the cipher algorithm of CTB-Locker performed by Zairon.

He's not really optimistic about the possibility to cryptanalyse the files as the first paragraph of the blog post is the following:

After my last post about CTB-Locker I received a lot of e-mails from people asking for a complete analysis of the malware. Most of them wanted to know if it’s possible to restore the compromised files without paying the ransom. The answer is simple: it’s impossible without knowing the Master key! That key resides on the malicious server and it’s the only way to restore every single compromised file.

And, follow a full analysis of the encryption scheme of CTB-Locker. A good reading for anybody wants to know more about it !

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.