Method for decrypting data encrypted by ransomware
A technique is described for protecting file data from malicious programs, in particularly, by decrypting data that has been maliciously encrypted by software such as ransomware. The described technique generates a copy of a first block of a plurality of files stored on a computing device, and also intercepts request(s) from a process executing on the computing device to obtain certain types of random data and system entropy, which are recorded. When the system detects that the plurality of files have been encrypted by a malicious program, the described system determines a cryptographic key determined based on the generated copies of the first blocks of the plurality of files and on the recorded random data, and uses that key to decrypt the plurality of files.
1. A method for protecting file data from malicious programs, the method comprising:
generating a copy of a first block of a plurality of files stored on a computing device;
intercepting a request, from a process executing on the computing device, for a randomized value;
recording, on the computing device, the randomized value returned by the intercepted request;
detecting that the plurality of files have been encrypted by a malicious program wherein the plurality of files have been encrypted using a symmetric key (K) that is a result of an XOR function between the randomized value (U) and a string value (V);
predicting the string value (V) associated with the malicious program; and
decrypting the plurality of files encrypted by the malicious program using a cryptographic key determined based on the generated copy of the first block of the plurality of files, the string value (V) and the recorded randomized value (U).
2. The method of claim 1 , further comprising:
generating a candidate key based on the recorded randomized value returned by the intercepted request;
determining the candidate key is the cryptographic key for decrypting the plurality of files based on a comparison using the copy of the first block of the plurality of files.
3. The method of claim 2 , wherein determining the candidate key is the cryptographic key for decrypting the plurality of files based on the comparison using the copy of the first block of the plurality of files further comprises:
generating ciphertext from the copy of the first block of at least one of the plurality of files using the candidate key; and
determining whether the generated ciphertext matches a corresponding ciphertext created by the malicious program.
4. The method of claim 1 , wherein the request for the randomized value further comprises a system call to generate a pseudo-random number.
5. The method wherein the first block of the plurality of files is copied periodically.
6. The method of claim 1 , wherein determining K comprises:
determining whether the malicious program is identified in a database of malware signatures, wherein the database comprises information on hash functions and types of randomized data and entropy data utilized by each respective malware in database;
in response to determining that the malicious program is identified in the database, retrieving for the malicious program information comprising possible values of V; and
determining and verifying 1 for each possible value of V identified in the retrieved information, wherein the K that successfully decrypts the plurality of files is the cryptographic key.
7. The method of claim 6 , further comprising:
in response to determining that the malicious program is not identified in the database, determining a time when encryption of the plurality of files began by the malicious program and a process identifier at the time of encryption;
determining at subsequent time during the encryption another process identifier, wherein process identifiers increment monotonically;
setting a range for the possible values of V between a value of the process identifier and a value of the another process identifier; and
determining and verifying K for each possible value of V identified in the range, wherein the K that successfully decrypts the plurality of files is the cryptographic key.
8. A system for protecting file data from malicious programs, comprising:
a hardware processor configured to:
generate a copy of a first block of a plurality of files stored on a computing device;
intercept a request, from a process executing on the computing device, for a randomized value;
record, on the computing device, the randomized value data returned by the intercepted request;
detect that the plurality of files have been encrypted by a malicious program, wherein the plurality of files have been encrypted using a symmetric key (K) that is a result of an XOR function between the randomized value (U) and a string value (V);
predict the string value (V) associated with the malicious program; and
decrypt the plurality of files encrypted by the malicious program using a cryptographic key determined based on the generated copy of the first block of the plurality of files, the string value (V) and the recorded randomized value (U).
9. The system of claim 8 , wherein the hardware processor is further configured to:
generate a candidate key based on the recorded randomized value returned by the intercepted request; and
determine the candidate key is the cryptographic key for decrypting the plurality of files based on a comparison using the copy of the first block of the plurality of files.
10. The system of claim 9 , wherein the processor configured to determine the candidate key is the cryptographic key for decrypting the plurality of files based on the comparison using the copy of the first block of the plurality of files is further configured to:
generate ciphertext from the copy of the first block of at least one of the plurality of files using the candidate key; and
determine whether the generated ciphertext matches a corresponding ciphertext created by the malicious program.
11. The system of claim 8 , wherein the request for the randomized value further comprises a system call to generate a pseudo-random number.
12. The system of claim 8 , wherein the first block of the plurality of files is copied periodically.
13. The system of claim 8 , wherein the hardware processor is configured to determining K by:
determining whether the malicious program is identified in a database of malware signatures, wherein the database comprises information on hash functions and types of randomized data and entropy data utilized by each respective malware in database;
in response to determining that the malicious program is identified in the database, retrieving for the malicious program information comprising possible values of V; and
determining and verifying K for each possible value of V identified in the retrieved information, wherein the K that successfully decrypts the plurality of files is the cryptographic key.
14. The system of claim 13 , wherein the hardware processor is further configured to:
in response to determining that the malicious program is not identified in the database, determine a time when encryption of the plurality of files began by the malicious program and a process identifier at the time of encryption;
determine at subsequent time during the encryption another process identifier, wherein process identifiers increment monotonically;
set a range for the possible values of V between a value of the process identifier and a value of the another process identifier; and
determine and verify K for each possible value of V identified in the range, wherein the K that successfully decrypts the plurality of files is the cryptographic key.
15. A non-transitory computer readable medium storing computer executable instructions for protecting file data from malicious programs, including instructions for:
generating a copy of a first block of a plurality of files stored on a computing device;
intercepting a request, from a process executing on the computing device, for a randomized value;
recording, on the computing device, the randomized value returned by the intercepted request;
detecting that the plurality of files have been encrypted by a malicious program, wherein the plurality of files have been encrypted using a symmetric key (K) that is a result of an XOR function between the randomized value (U) and a string value (V);
predicting the string value (V) associated with the malicious program; and
decrypting the plurality of files encrypted by the malicious program using a cryptographic key determined based on the generated copy of the first block of the plurality of files, the string value (V) and the recorded randomized value (U).
16. The non-transitory computer readable medium of claim 15 , further storing instructions for:
generating a candidate key based on the recorded randomized value returned by the intercepted request;
determining the candidate key is the cryptographic key for decrypting the plurality of files based on a comparison using the copy of the first block of the plurality of files.
17. The non-transitory computer readable medium of claim 16 , wherein the instructions for determining the candidate key is the cryptographic key for decrypting the plurality of files based on the comparison using the copy of the first block of the plurality of files further comprises instructions for:
generating ciphertext from the copy of the first block of at least one of the plurality of files using the candidate key; and
determining whether the generated ciphertext matches a corresponding ciphertext created by the malicious program.
18. The non-transitory computer readable medium of claim 15 , wherein the request for the randomized value further comprises a system call to generate a pseudo-random number.