Breaking Prometheus: When Ransomware Crypto Goes Wrong
summary
Researchers reverse-engineered the Prometheus ransomware to analyze its encryption implementation and identified specific cryptographic weaknesses that allowed scalable decryption of victim files. The talk covers the reverse-engineering process and how those implementation flaws were exploited to build a rapid-acting decryptor, illustrating how non-expert ransomware authors can introduce recoverable vulnerabilities.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:33Decryption is not a Strategy
- 2:04Ransomware Encryption 101
- 7:02Analyzing Prometheus - Environment.TickCount
- 9:20Analyzing Prometheus - Predicting Environment.TickCount
- 10:55Analyzing Prometheus - Decrypting Files
- 12:34Analyzing Prometheus - Decryption Optimizations
- 17:35Example - Bandana Ransomware
- 18:14Example - Bandana Decryption
- 19:08Example: Chaos Ransomware
- 19:51Example: PartyTicket Ransomware
- 21:28Next Steps: Investigate Creating a Decryptor Framework
- 22:22Encrypted File Format
- 24:12Decryptor Framework - Determine Success
- 25:42Failures & Lessons learned
- 28:07Apply - Security Management
- 31:57Apply - Leverage Reverse Engineering - Can you Create a Decryptor?
- 33:02Apply - What about sharing?
related talks
38mCracking a ransomware family
20mWhen ransomware strikes
54mYes, you too can break crypto Exploiting common crypto mistakes
32mProspecting Ransomware Tech
40mRansomware: New Recipe For An Old Dish
41mRansomware Incident Response - The Real-World Story of a Ransomware Attack
21mRansomware Attack: Lessons Learned
52mRansomware 101: Get Smart Understanding Real Attacks