Clop ransomware had a rather handy flaw for Linux users to exploit

Date:
Wed, 08 Feb 2023 19:46:03 +0000

Description:
Linux users could easily retrieve data stolen by ransomware as its encryptor had some crucial flaws

FULL STORY ======================================================================

A relatively obscure ransomware variant called Clop may stay that way for a bit longer, after it was discovered to have a Linux version that had a rather embarassing flaw.

The Linux version of the ransomware was first spotted in December 2022 by a SentinelLabs researcher named Antonis Terefos. His analysis determined that the Linux variant is almost identical to the Windows one, but with a few
small (albeit crucial) differences.

Namely, Linux users were able to quietly decrypt all of the affected files
and reclaim their endpoints - without having to pay the criminals anything. Retrieving the master key

Among those differences is the fact that the Linux version did not encrypt
the RC4 keys used for file encryption with the RSA-based asymmetric algorithm used in the Windows variant.

Unlike the Windows version, the Linux one uses a hardcoded RC4 master key which generates encrypting keys, and then uses the same one to encrypt and store files, locally. When SentinelLabs figured it out, they used the flaw to freely retrieve the keys and reverse the encryption. The team has now built a Python script to help automate the process, which can be found on GitHub.
Read more

Clop ransomware looks to target Windows 10 apps

This worrying new ransomware trend is hitting businesses where it hurts

Here's our list of the best endpoint protection services right now

But thats not the only major flaw this ransomware has. Apparently, the
malware also writes extra data to the encrypted file, such as its size and encryption time. Usually, this type of data is obfuscated as it can help forensic analysts identify important documents. In this case, it wasnt hidden at all.

All of this prompted the researchers to conclude that the Clop ransomware, at least in its current form, is unlikely to take off as a major threat. Now
that the cat is out of the bag, its safe to assume that a new version is in the works and that it could be released soon.

Still, news like this is always good, especially for the victims:

"We shared our findings early with relevant law enforcement and intelligence partners and will continue to collaborate with the relevant organizations to affect the economics of the ransomware space in favor of defenders," SentinelLabs told BleepingComputer. These are the best firewalls right now

Via: BleepingComputer



======================================================================
Link to news story: https://www.techradar.com/news/clop-ransomware-had-a-rather-handy-flaw-for-lin ux-users-to-exploit


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)