Уровень 0 · материалов: 3
В кластер включены документы об обнаружении уязвимостей в алгоритмах шифрования программ-вымогателей для восстановления данных, но не включены документы об уязвимостях транспортных систем.
Общие признаки: анализ вредоносного ПО, реверс-инжиниринг, ошибки в реализации шифрования, восстановление данных без выкупа
Группа выше: Шифровальщики и вымогатели
Смысл: The main idea is to demonstrate that some ransomware is poorly implemented, allowing security professionals to reverse-engineer the encryption process and recover files without paying the ransom by identifying flaws in key management (e.g., using the system UUID as a key).
An analysis of a ransomware attack that uses PowerShell to encrypt files via the system UUID, including a provided decryption script to recover the data.
Смысл: The main idea is to demonstrate the process of analyzing and defeating ransomware through reverse engineering and network analysis. It highlights that security flaws in the malware's own design (lack of encryption in C2 communication and poor code protection) can be leveraged to recover data without paying the ransom.
A technical expert recovers encrypted files from a ransomware attack by reverse-engineering the malware and spoofing a request to the attacker's server to obtain the decryption key.
Смысл: The main idea is that the Petya ransomware's encryption was flawed, enabling the community to create free tools and services that generate decryption keys, allowing victims to recover their data without paying the ransom.
Victims of the Petya ransomware can recover their encrypted disks for free using the Petya Sector Extractor tool and a community-developed key generation website.