Low-cost data decryption of adaptive-pricing ransomware with honeypot (for asymmetric keys malware)

1 . A method, comprising:

detecting, at a data storage site, a ransomware process;

taking a snapshot of the ransomware process;

using the snapshot to intentionally install and execute an instance of the ransomware process on a honeypot system controlled by the data owner, such that the ransomware process reports an infection of the honeypot system to an attacker; and

receiving, from an attacker, a first demand for a ransom of data stored at the data storage site; and

receiving, from the attacker, a second demand for a ransom of data stored in the honeypot system, wherein the second demand is generated by execution of the ransomware process on the honeypot system using an adaptive cost mechanism and specifies a ransom amount lower than a ransom amount of the first demand

receiving a private key from the attacker after payment of the ransom of the second demand, but without payment of the ransom of the first demand; and

decrypting the data at the data storage site with the private key.

2 . The method as recited in claim 1 , wherein the ransomware process uses asymmetric encryption process that encrypts the data stored at the data storage site, and encrypts the data stored in the honeypot system.

3 . The method as recited in claim 1 , wherein the ransomware uses a public key to encrypt the data at the data storage site, and the ransomware also uses that public key to encrypt the data stored in the honeypot system.

4 . The method as recited in claim 1 , wherein a difference between the ransom of the first demand and the ransom of the second demand is due to an adaptive cost mechanism used by the ransomware.

5 . The method as recited in claim 1 , wherein the data at the data storage site is decrypted after payment of the ransom of the second demand, but without requiring payment of the first ransom demand.

6 . A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:

detecting, at a data storage site, a ransomware process;

taking a snapshot of the ransomware process;

using the snapshot to intentionally install and execute an instance of the ransomware process on a honeypot system controlled by the data owner, such that the ransomware process reports an infection of the honeypot system to an attacker;

receiving, from an attacker, a first demand for a ransom of data stored at the data storage site; and

receiving, from the attacker, a second demand for a ransom of data stored in the honeypot system, wherein the second demand is generated by execution of the ransomware process on the honeypot system using an adaptive cost mechanism and specifies a ransom amount lower than a ransom amount of the first demand;

receiving a private key from the attacker after payment of the ransom of the second demand, but without payment of the ransom of the first demand; and

decrypting the data at the data storage site with the private key.

7 . The non-transitory storage medium as recited in claim 6 , wherein the ransomware process uses asymmetric encryption process that encrypts the data stored at the data storage site, and encrypts the data stored in the honeypot system.

8 . The non-transitory storage medium as recited in claim 6 , wherein the ransomware uses a public key to encrypt the data at the data storage site, and the ransomware also uses that public key to encrypt the data stored in the honeypot system.

9 . The non-transitory storage medium as recited in claim 6 , wherein a difference between the ransom of the first demand and the ransom of the second demand is due to an adaptive cost mechanism used by the ransomware.

10 . The non-transitory storage medium as recited in claim 6 , wherein the data at the data storage site is decrypted after payment of the ransom of the second demand, but without requiring payment of the first ransom demand.

11 . A system, comprising:

one or more hardware processors; and

a non-transitory storage medium having stored therein instructions that are executable by the one or more hardware processors to perform operations comprising:

detecting, at a data storage site, a ransomware process;

taking a snapshot of the ransomware process;

using the snapshot to intentionally install and execute an instance of the ransomware process on a honeypot system controlled by the data owner, such that the ransomware process reports an infection of the honeypot system to an attacker;

receiving, from an attacker, a first demand for a ransom of data stored at the data storage site; and

receiving, from the attacker, a second demand for a ransom of data stored in the honeypot system, wherein the second demand is generated by execution of the ransomware process on the honeypot system using an adaptive cost mechanism and specifies a ransom amount lower than a ransom amount of the first demand;

receiving a private key from the attacker after payment of the ransom of the second demand, but without payment of the ransom of the first demand; and

decrypting the data at the data storage site with the private key.

12 . The system as recited in claim 11 , wherein the ransomware process uses asymmetric encryption process that encrypts the data stored at the data storage site, and encrypts the data stored in the honeypot system.

13 . The system as recited in claim 11 , wherein the ransomware uses a public key to encrypt the data at the data storage site, and the ransomware also uses that public key to encrypt the data stored in the honeypot system.

14 . The system as recited in claim 11 , wherein a difference between the ransom of the first demand and the ransom of the second demand is due to an adaptive cost mechanism used by the ransomware.

15 . The system as recited in claim 11 , wherein the data at the data storage site is decrypted after payment of the ransom of the second demand, but without requiring payment of the first ransom demand.