Ransomware virus uses 1,024-bit key
Friday, June 6. 2008
Security specialists are warning of a new virus that encrypts data on infected machines and demands money for the decryption key.
'Gpcode' is thought to access PCs via unpatched browsers. Once active it encodes most of the data on the computer, including .doc, .txt, .pdf, .xls, .jpg and .png files, with a 1,024-bit key.
Once all the files have been encrypted a ReadMe file is left on the machine giving an email address to send money in order to get the decryption key.
The malware is a revision of a previous virus, thought to be from the same author, which appeared two years ago but only used a 660-bit key.
"Virus researchers have been able to crack keys up to 660 bits," said Timur Tsoriev of Kaspersky Labs.
"This was the result of a detailed analysis of the RSA algorithm implementation. If the encryption algorithm is implemented correctly, it could take one PC with a 2.2GHz processor around 30 years to crack a 660-bit key."
The company has urged users struck by the virus not to reboot or shut down the infected machine.
Instead they should get in contact immediately with the last few websites they visited to determine what, if any, programs were running.
"We urge infected users not to yield to the blackmailer, but to contact us and your local cyber-crime law enforcement units," said Tsoriev. "Yielding to blackmailers only continues the cycle."
Written by Iain Thomson
Original Story
