System and method for decrypting files
View Patent ↗In accordance with particular embodiments, a computer-implemented method for execution by one or more processors includes intercepting a communication comprising a message. The method also includes identifying words from within the message. The method further includes storing in a dictionary words from within the message of the communication and one or more parameters of the communication for each of the words. The dictionary comprises a plurality of words from a plurality of intercepted text-based communications. The method also includes receiving an encrypted file that is configured to be decrypted using a password. The method additionally includes identifying words from the dictionary to be used to attempt to decrypt the encrypted file. The identified words are identified based on at least one parameter associated with the encrypted file and the one or more parameters stored in the dictionary. The method further includes attempting to decrypt the encrypted file using at least a portion of the identified words from the dictionary as the password for decrypting the encrypted attachment.
1. A computer-implemented method for execution by one or more processors, the method comprising:
intercepting at least one first communication comprising a first message and an associated first encrypted file, wherein the first encrypted file is configured to be decrypted using a password;
parsing the first message to identify one or more words from within the first message;
creating a dictionary for words to use to decrypt the first encrypted file;
storing in the dictionary the one or more identified words parsed from within the first message of the first communication, the dictionary comprising a plurality of words from a plurality of intercepted communications;
storing in the dictionary meta data associated with parameters associated with the first communication from which the one or more words identified by parsing the first message and stored in the dictionary;
using the meta data to prioritize the words stored in the dictionary;
identifying one or more of the prioritized words from the dictionary to be used to decrypt the first encrypted file; and
applying the one or more of the prioritized words identified from the dictionary to decrypt the first encrypted file using at least a portion of the one or more prioritized words identified from the dictionary as the password for decrypting the first encrypted file.
2. The method of claim 1 , further comprising sorting the one or more prioritized words based on the meta data such that a first word used to attempt to decrypt the first encrypted file is more likely to be the password than a subsequent word used to attempt to decrypt the first encrypted file.
3. The method of claim 1 , further comprising:
intercepting a second communication comprising a second message, wherein the first encrypted file is configured to be decrypted using a password;
parsing the second message to identify one or more words from within the second message;
storing in the dictionary the one or more identified words parsed from within the second message of the second communication with the one or more words of the first message;
storing in the dictionary meta data associated with parameters associated with the second message from which the one or more words identified by parsing the first message and stored in the dictionary;
using the meta data to prioritize the words stored in the dictionary;
identifying one or more of the prioritized words from the dictionary to be used to attempt to decrypt the second encrypted file; and
applying the one or more of the prioritized words identified from the dictionary to decrypt the second encrypted file using at least a portion of the one or more prioritized words identified from the dictionary as the password for decrypting the second encrypted file.
4. The method of claim 3 , further comprising applying the one or more of the prioritized words identified from the dictionary to decrypt the second encrypted file using at least a portion of the one or more prioritized words identified from the dictionary as the password for decrypting the second encrypted file.
5. The method of claim 1 , wherein storing in the dictionary one or more words parsed from within the first message of the first communication comprises searching the first message for delimiters indicating a start and a stop for a string of characters forming the word to be stored in the dictionary.
6. The method of claim 1 , wherein the dictionary is associated with an intended recipient of the intercepted first communication.
7. The method of claim 1 , further comprising, in response to successfully decrypting the first encrypted file, analyzing the first decrypted file to determine whether the first decrypted file contains malicious code.
8. The method of claim 1 , further comprising:
determining that none of the words in the dictionary are able to decrypt the first encrypted file;
waiting to store at least one additional word in the dictionary; and
applying the one or more of the prioritized words identified from the dictionary to decrypt the first encrypted file using the at least one additional word from the dictionary as the password for decrypting of the first encrypted file.
9. The method of claim 1 , further comprising sorting the one or more prioritized words identified based on a priority level associated with the one or more words, wherein a non-English dictionary word has a higher priority level than a word found in an English dictionary.
10. The method of claim 1 , further comprising sorting the one or more prioritized words identified based on a priority level associated with the one or more words, wherein a word distinguished from the other words of the first message has a higher priority level than a word not distinguished from the other words.
11. The method of claim 1 :
wherein the first communication has a communication date associated therewith and the first encrypted file has a file data associated therewith; and
further comprising sorting the one or more prioritized words identified based on a priority level associated with the one or more words, wherein the priority level associated with a word increases as a date associated with the first communication is closer to the first date.
12. The method of claim 1 , further comprising, upon failing to decrypt the first encrypted file using at least a portion of the one or more words from the dictionary, prompting a user for the password used to decrypt the first encrypted file.
13. The method of claim 1 , further comprising sorting the one or more prioritized words identified based on a sender and a recipient associated with the first encrypted file.
14. A system for decrypting a file, comprising:
an interface configured to intercept a first communication comprising a first message and an associated first encrypted file, wherein the first encrypted file is configured to be decrypted using a password;
a processor coupled to the interface and configured to:
parse the first message to identify one or more words from within the first message;
create a dictionary for words to use to decrypt the first encrypted file;
store in the dictionary the one or more identified words parsed from within the first message of the first communication, the dictionary comprising a plurality of words from a plurality of intercepted communications; and
store in the dictionary meta data associated with parameters associated with the first communication from which the one or more words identified by parsing the first message and stored in the dictionary;
use the meta data to prioritize the words stored in the dictionary;
identify one or more of the prioritized words from the dictionary to be used to attempt to the first encrypted file; and
applying the one or more of the prioritized words identified from the dictionary to decrypt the first encrypted file using at least a portion of the one or more prioritized words identified from the dictionary as the password for decrypting the first encrypted file.
15. The system of claim 14 , wherein the processor is further configured to sort the one or more prioritized words based on the meta data such that a first word used to attempt to decrypt the first encrypted file is more likely to be the password than a subsequent word used to attempt to decrypt the first encrypted file.
16. The system of claim 14 , wherein:
the interface is further configured to intercept a second communication comprising a second message, wherein the first encrypted file is configured to be decrypted using a password;
the processor is further configured to:
parse the second message to identify one or more words from within the second message;
store in the dictionary the one or more identified words parsed from within the second message of the second communication with the one or more words of the first message; and
store in the dictionary meta data associated with parameters associated with the second message from which the one or more words identified by parsing the first message and stored in the dictionary;
use the meta data to prioritize the words stored in the dictionary;
identify one or more of the prioritized words from the dictionary to be used to attempt to decrypt the second encrypted file; and
applying the one or more of the prioritized words identified from the dictionary to decrypt the second encrypted file using at least a portion of the one or more prioritized words identified from the dictionary as the password for decrypting the second encrypted file.
17. The system of claim 14 , wherein the processor configured to store in the dictionary one or more words parsed from within the first message of the first communication comprises searching the first message for delimiters indicating a start and a stop for a string of characters forming the word to be stored in the dictionary.
18. The system of claim 14 , wherein the dictionary is associated with an intended recipient of the intercepted first communication.
19. The system of claim 14 , wherein the processor, m response to successfully decrypting the first encrypted file, is further configured to analyze the first decrypted file to determine whether the first decrypted file contains malicious code.
20. The system of claim 14 , wherein the processor is further configured to:
determine that none of the words in the dictionary are able to decrypt the first encrypted file;
wait to store at least one additional word in the dictionary; and
applying the one or more of the prioritized words identified from the dictionary to decrypt the first encrypted file using the at least one additional word from the dictionary as the password for decrypting of the first encrypted file.
21. The system of claim 14 , wherein the processor is further configured to sort the one or more identified words based on a priority level associated with the one or more words, wherein a non-English dictionary word has a higher priority level than a word found in an English dictionary.
22. The system of claim 14 , wherein the processor is further configured to sort the one or more prioritized words identified based on a priority level associated with the one or more words, wherein a word distinguished from the other words of the first message has a higher priority level than a word not distinguished from the other words.
23. The system of claim 14 , wherein:
the first communication has a communication date associated therewith and the first encrypted file has a file data associated therewith; and
the processor is further configured to sort the one or more prioritized words identified based on a priority level associated with the one or more words, wherein the priority level associated with a word increases as a date associated with the first communication is closer to the first date.
24. A non-transitory computer-readable storage media comprising instructions that when executed by a processor cause the processor to perform operations for decrypting a file, the operations being arranged to:
intercept a first communication comprising a first message and an associated first encrypted file, wherein the first encrypted file is configured to be decrypted using a password;
parse the first message to identify one or more words from within the first message;
create a dictionary for words to use to decrypt the first encrypted file;
store in the dictionary the one or more identified words from within the first message of the first communication, the dictionary comprising a plurality of words from a plurality of intercepted communications;
store in the dictionary meta data associated with parameters associated with the first communication from which the one or more words identified by parsing the first message and stored in the dictionary;
identify one or more of the prioritized words from the dictionary to be used to attempt to the first encrypted file; and
applying the one or more of the prioritized words identified from the dictionary to decrypt the first encrypted file using at least a portion of the one or more prioritized words identified from the dictionary as the password for decrypting the first encrypted file.
25. The media of claim 24 , wherein the operations being further arranged to sort the one or more prioritized words based on the meta data such that a first word used to attempt to decrypt the first encrypted file is more likely to be the password than a subsequent word used to attempt to decrypt the first encrypted file.
26. The media of claim 24 , wherein the operations being further arranged to:
intercept a second communication comprising a second message, wherein the first encrypted file is configured to be decrypted using a password;
parse the second message to identify one or more words from within the second message;
store in the dictionary the one or more identified words parsed from within the second message of the second communication with the one or more words of the first message;
store in the dictionary meta data associated with parameters associated with the second message from which the one or more words identified by parsing the first message and stored in the dictionary;
use the meta data to prioritize the words stored in the dictionary;
identify one or more of the prioritized words from the dictionary to be used to attempt to decrypt the second encrypted file; and
applying the one or more of the prioritized words identified from the dictionary to decrypt the second encrypted file using at least a portion of the one or more prioritized words identified from the dictionary as the password for decrypting the second encrypted file.
27. The media of claim 24 , wherein the operations being further arranged to store in the dictionary one or more words parsed from within the first message of the first communication comprises logic arranged to search the first message for delimiters indicating a start and a stop for a string of characters forming the word to be stored in the dictionary.
28. The media of claim 24 , wherein the dictionary is associated with an intended recipient of the intercepted first communication.
29. The media of claim 24 , wherein the operations being further arranged to, in response to successfully decrypting the first encrypted file, analyze the first decrypted file to determine whether the first decrypted file contains malicious code.
30. The media of claim 24 , wherein the operations being further arranged to:
determine that none of the words in the dictionary are able to decrypt the first encrypted file;
wait to store at least one additional word in the dictionary; and
applying the one or more of the prioritized words identified from the dictionary to decrypt the first encrypted file using the at least one additional word from the dictionary as the password for decrypting of the first encrypted file.
31. The media of claim 24 , wherein the operations being further arranged to sort the one or more prioritized words identified based on a priority level associated with the one or more words, wherein a non-English dictionary word has a higher priority level than a word found in an English dictionary.
32. The media of claim 24 , wherein the operations being further arranged to sort the one or more prioritized words identified based on a priority level associated with the one or more words, wherein a word distinguished from the other words of the first message has a higher priority level than a word not distinguished from the other words.
33. The media of claim 24 :
wherein the first communication has a communication date associated therewith and the first encrypted file has a file data associated therewith; and
wherein the operations being further arranged to sort the one or more prioritized words identified based on a priority level associated with the one or more words, wherein the priority level associated with a word increases as a date associated with the first communication is closer to the first date.