Researchers Crack Linux Ransomware By Design Flaw

Researcher managed to crack the Linux.Encoder-ransomware for Linux so that victims without paying their files to recover. The ransomware was last week announced by the anti-virus company Doctor Web. At the time, it was unknown how the ransomware spreading.

It was known that it was mostly web servers that were infected. Now the Romanian anti-virus company said Bitdefender attackers use a vulnerability in the popular content management system magento to access servers. Then they install the ransomware, which looks a lot like Windows ransomware. Like Windows-based ransomware encrypts Linux.Encoder files with AES. The symmetric key is then encrypted with an asymmetric encryption algorithm (RSA).

When designing the ransomare the creators have made ​​a big mistake, allowing researchers Bitdefender can identify the AES key without that first with the RSA private key must be decrypted. The ransomware does not use any keys and initialisation vectors for encryption, but leads these two pieces of information on a specific feature in combination with the time of the encryption. This information is easily retrieved and, according to the researchers, a major design flaw. They now have a tool(zip) has been developed which automatically encrypted files can decrypt.

Linux Users Targeted By New Ransomware

Researchers from the Russian anti-virus company Doctor Web discovered ransomware which has provided the Linux Users. How the "Linux Encoder" ransomware is spreading the virus fighter does not know. The malware has to cater to webmasters and web servers.

Once the ransomware can start with administrator privileges which will include instructions on how to download a file with the victim and to encrypt files. It is in this case to files in home directories and directories associated with the administration of the website. After this, only encrypted files with specific extensions and specific directory names. The encrypted files are a .encrypted extensions.

There is also the file installed with instructions in any directory with encrypted files. It states that the victim must first bitcoin payment, equivalent to 360 euros. According to the ransomware Doctor Web created more than 10 victims. The anti-virus company advises victims to contact the technical department of the company. To decrypt it is that important as the virus fighter users can not modify them or remove the files, otherwise the encrypted data may be permanently lost.