Ransomware Encrypts Victim Files With 1,024-Bit Key

Now more than ever, it's important that Windows users ensure their machines are safe from hackers/Linux users you do not need to worry about these things. A dangerous new strain of malicious software that holds the victim's computers files for ransom has been unleashed, and Kaspersky Lab is warning that security researchers have yet to crack the encryption key.

The malware in this case is the latest version of Gpcode (Kaspersky calls it Gpcode.ak), a nasty piece of "ransomware" - A cryptovirus, cryptotrojan or cryptoworm is a type of malware that encrypts the data belonging to an individual on a computer, demanding a ransom for its restoration- that scrambles all of the victim's data files with an encryption key known only to the attacker(s). Victims are told via a pop-up message that they need to purchase a special decryption program to regain access to their data.

Kaspersky and other anti-virus companies have previously unraveled the secret encryption key for all previous versions of Gpcode, but this time, the malware author apparently has learned from his previous mistakes. Now, the Gpcode author is encrypting victim files with an extremely strong 1,024-bit RSA encryption key.

"We estimate it would take around 15 million modern computers, running for about a year, to crack such a key," writes Aleks Gostev, senior virus analyst at Kaspersky, on the company's blog.

"The author has bided his time, waiting almost two years before creating a new, improved variant of this file encryptor. Gpcode.ak doesn't not repeat the errors found in previous versions of the virus."

Kaspersky said it's not clear yet how the ransomware is being spread. Once a system is infected and the files are encrypted, it leaves the following message in a pop-up alert:

"Your files are encrypted with RSA-1024 algorithm.
To recovery your files you need to buy our decryptor.
To buy decrypting tool contact us at: ********@yahoo.com"

I don't see anyone but Kaspersky making a lot of noise about this virus, so my guess is that most of the victims are probably in Eastern Europe and Russia. But if your machine does get infected with Gpcode, Kaspersky wants to hear from you (so does Security Fix, for that matter). They're offering assistance to anyone victimized by this virus. Check out this link for more information.

The company also is trying to generate support for a collaborative effort to break the encryption key; check out the forum here. I wish Kaspersky luck with that, but I don't believe they will succeed. It is extremely fortunate for most users that this type of attack isn't more widespread, as it is likely that most victims will end up paying the ransom if they ever want their data returned.