Kaspersky Lab is asking for help cracking an encryption key that holds victims’ PCs for ransom. It’s an extortion scheme that demands money from victims whose machines have been infected.
Kaspersky detected a new variant of Gpcode, which encrypts a variety of user files, targeting those with extensions such as DOC, TXT, PDF, XLS, JPG and PNG.
“We recently started getting reports from infected victims, analyzed a sample, and added detection for Gpcode.ak to our antivirus databases,” wrote Kaspersky analyst “VitayK” in the Russian company’s blog. “However, although we detect the virus itself, we can’t currently decrypt files encrypted by Gpcode.ak — the RSA encryption implemented in the malware uses a very strong, 1,024-bit key.”
Calling All Researchers
The encryption algorithm uses two keys, according to Kaspersky, a public key and a private key. Messages can be encrypted using the public key, but can only be decrypted using the private key. That’s how Gpcode works — it encrypts files on victim machines using the public key coded into its body. Once encrypted, files can only be decrypted by someone who has the private key — in this case, the author or the owner of the malicious program, Kaspersky analysts explained.
Kaspersky estimates it will take about five million modern computers, running for about a year, to crack the key. The firm has offered up the public keys, hoping other security researchers will join the firm in factoring the key.
“We’re calling on you: cryptographers, governmental and scientific institutions, antivirus companies, independent researchers … join with us to stop Gpcode,” Kaspersky senior virus analyst Aleks Gostev wrote on the company blog. “This is a unique project — uniting brainpower and resources out of ethical, rather than theoretical or malicious, considerations.”
The Novelty of the Ransom
Sophos Principal Virus researcher Vanja Svajcer confirmed this is a variant of the…