Cracking a ransomware family
summary
Claims a practical exploit that breaks an entire family of ransomware and restores files without private keys. Shows the exact flaw: predictable .NET Random seeds giving ~2 billion seed space, AES keys/IVs derived weakly, and file magic bytes used to recover IVs. Builds a working decrypter using precomputed lookup tables (8–103 GB depending on variant) and a GPU/CUDA accelerated lookup to reduce table generation from months to minutes, and demonstrates successful decryption and planned open‑source release.
AI-written summary · about
chapters (34)
- 0:00Introduction
- 0:42The story begins
- 1:36Backlight ransomware
- 3:21Chaos ransomware
- 3:47What happens when someone distributes
- 4:06Chaos ransomware in Ukraine
- 5:49Rebrands
- 6:07Fork
- 6:52SolidBit
- 7:45Germany
- 9:03Investigation
- 11:55File size change
- 12:29Password generation
- 13:29Generate password
- 14:32System Random
- 15:11Free Random
- 15:34Seed
- 16:20cfp
- 17:29plain text
- 18:20hash table
- 18:50PDF
- 19:09File Encryption
- 20:35Table
- 20:56Can we generalize
- 21:06Chaos
- 21:59CBC
- 22:21Passwords
- 23:07Cuda
- 24:04Solid Bit
- 25:18SystemRandom
- 31:28File decryption
- 33:42Read the documentation
- 35:18Select the decrypter
- 35:48Select the folder
related talks
54mYes, you too can break crypto Exploiting common crypto mistakes
32mProspecting Ransomware Tech
37mBreaking Prometheus: When Ransomware Crypto Goes Wrong
14mThe Conjuring: ransomware edition!!
51mThe New Scourge of Ransomware: A Study of CryptoLocker and Its Friends
40mRansomware: New Recipe For An Old Dish
19mThe Innerworkings of Ransomware
29mRendering Ransomware Detection and EDR Products Blind