HACKER Q&A
📣 dt3ft

The most recent REvil ransomware attack may have an easy fix


I read that the hackers offered to provide a group "decryptor tool" which would work for all encrypted files, regardless of the company. This got me thinking...

In their ransom note, they demanded a Bitcoin payment, for which they promised to provide a decryptor tool which would revert the encryption.

Is it just me, or are we seeing a pattern here?

They never requested any identifier, meaning that they most likely have a single encryption key, re-used everywhere. They don't seem to have a database of keys for each victim.

If they are able to provide a "master decryptor tool" which would decrypt files for every one of their victims, this means that the encryption was most likely done with the same key everywhere.

Does anyone have the copy of the original encryptor they used? In theory, we should be able to reverse-engineer it and extract the key which was used for encryption, and develop an open-source and free tool which allows their victims to decrypt their files for free, effectively reversing the damage done?


  👤 python273 Accepted Answer ✓
This would be possible with symmetric key encryption, but with asymmetric key (aka public key) encryption, it's impossible.

https://en.wikipedia.org/wiki/Public-key_cryptography


👤 GianFabien
You could be correct. But now that you have made the suggestion the gang(s) might be a step ahead and make it harder to decrypt.