Wednesday , January 27 2021

Bitcoin-hungry hackers broke their own decryption tool, analysts warn

TNW uses cookies to personalize content and ads to
make our site easier for you to use.
We do also share that information with third parties for
advertising & analytics.

Powered by

Blockchain, cryptocurrencies, and insider stories by TNW.

System admins: make all the backups, right now

Cybersecurity researchers warn that paying Bitcoin BTC to retrieve files locked by the prolific Ryuk ransomware may still result in data loss.

This means that Ryuk‘s latest victims are stuck between a rock and a hard place. If they refuse to send their attackers Bitcoin, they’ll lose access to their data altogether, but if they pay, the hackers will provide them with a decryption tool that doesn’t work.

Software company Emsisoft told Hard Fork that the attackers themselves are responsible for breaking their own encryption tool with an update.

“Obviously, we’re hoping to get the word out about this as quickly and widely as possible so that affected organizations can avoid data loss,” said Emsisoft via email.

The firm explained that in one of the latest versions of Ryuk, attackers made changes to the way it calculates the length of certain files. This has created unexpected consequences during decryption.

“As a result, the decryptor provided by the Ryuk authors will truncate files, cutting off one too many bytes in the process of decrypting the file,” Emsisoft said in a blog post. “Depending on the exact file type, this may or may not cause major issues.”

Researchers said that in the best case scenario, the byte that was cut off is unused, therefore unnecessary, and could even be decrypted just fine.

However, in virtual disk type files (such as VHD/VHDX), as well as many database files (such as Oracle’s), that last byte stores important information. It’s common for larger, high-value target networks to feature these types of files.

This means that those files will be damaged by Ryuk‘s decryption tool, and will fail to load properly even after they’ve been unlocked by the tool provided by the attackers.

Ryuk has hit hospitals, state-owned oil refineries, nursing homes, schools, private corporations, and government institutions across the world over the past year, demanding hundreds of millions of dollars worth of Bitcoin in exchange for access to critical computer systems.

Unfortunately for those who find themselves struck by Ryuk, there’s currently no way to retrieve files without paying up. Previous analysis run on the malware shows that perps scale their Bitcoin ransoms dependant on the size of the target.

As such, Emisoft advises Ryuk victims to make copies or backups of any data that’s been encrypted, especially considering that the decryption tool provided by the attackers will reportedly delete files it thinks have been properly unlocked.

That said, creating regular backups of data is advisable in any sense, as it will dampen the effect of being hit by ransomware in general.

It should be noted that while Emsisoft has released many free decryption tools for other ransomware strains, the service it offers to Ryuk victims is a paid one.

“A final word of advice: prior to running any ransomware decryptor – whether it was supplied by a bad actor or by a security company – be sure to back up the encrypted data first. Should the tool not work as expected, you’ll be able to try again,” said Emsisoft.

Published December 10, 2019 — 13:28 UTC

Thank you!

Copyright © 2006—2019.
All rights reserved.
Made with in Amsterdam.

This Article was first published on

About IT News Ug

Check Also

Airbnb to be bigger than eBay after its long-awaited IPO

TNW uses cookies to personalize content and ads to make our site easier for you …

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.