Ransomware virus uses 1,024-bit key

Security specialists are warning of a new virus that encrypts data on infected machines and demands money for the decryption key.

'Gpcode' is thought to access PCs via unpatched browsers. Once active it encodes most of the data on the computer, including .doc, .txt, .pdf, .xls, .jpg and .png files, with a 1,024-bit key.

Once all the files have been encrypted a ReadMe file is left on the machine giving an email address to send money in order to get the decryption key.

The malware is a revision of a previous virus, thought to be from the same author, which appeared two years ago but only used a 660-bit key.

"Virus researchers have been able to crack keys up to 660 bits," said Timur Tsoriev of Kaspersky Labs.

"This was the result of a detailed analysis of the RSA algorithm implementation. If the encryption algorithm is implemented correctly, it could take one PC with a 2.2GHz processor around 30 years to crack a 660-bit key."

The company has urged users struck by the virus not to reboot or shut down the infected machine.

Instead they should get in contact immediately with the last few websites they visited to determine what, if any, programs were running.

"We urge infected users not to yield to the blackmailer, but to contact us and your local cyber-crime law enforcement units," said Tsoriev. "Yielding to blackmailers only continues the cycle."

See also:

Ransomware attacks target Symbian mobiles

Pay up, or you'll never see your text messages again  05 Mar 2008

Cyber-crooks switch to code obfuscation

Technique being used to bypass signature-based systems  12 Jan 2007

Ransomware data kidnapping on the rise

30 per cent increase in software demanding payment to release files  25 Aug 2006

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!