Menu
Encryption goof fixed in TorrentLocker file-locking malware

Encryption goof fixed in TorrentLocker file-locking malware

A new variant of TorrentLocker fixes a problem that allowed encrypted files to be freed

The developers of a type of malicious software that encrypts a computer's files and demands a ransom have fixed an error security experts said allowed files to be recovered without paying.

The malware, called TorrentLocker, popped up last month, targeting users in Australia, according to iSight Partners, a security consultancy. It now appears to be also geo-targeting victims in the U.K.

TorrentLocker's developers ironically made a similar mistake as the creators of another ransomware program, CryptoDefense. Researchers found earlier this year that CryptoDefense left a decryption key on a person's computer, although the error was soon fixed.

Earlier this month, researchers with the consultancy Nixu found that TorrentLocker used the same keystream to encrypt all of a computer's files. That was a mistake, as a keystream should never be used more than once, according to a writeup on the SANS Institute blog.

"As the encryption was done by combining the keystream with the plaintext file using the XOR operation, we were able to recover the keystream used to encrypt those files by simply applying XOR between the encrypted file and the plaintext file," they wrote.

With the error out in the open, it was only a matter of time before it was fixed.

Richard Hummel, a senior technical analyst with iSight, wrote that a variant of TorrentLocker without that bug has now been found, which shows the "extremely high pace of innovation of our collective adversaries."

The latest version also scans profiles in the Thunderbird email client for email addresses and passwords, he wrote. "This will almost certainly be used to further the spam campaign for TorrentLocker," he wrote.

TorrentLocker asks for US$500 to unlock the files, payable in bitcoin. Hummel wrote that although the percentage of people who pay is low, a look at the bitcoin address associated with TorrentLocker showed that the attackers are making "many bitcoins," he wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the newsletter!

Error: Please check your email address.

Tags NixuSANS InstitutesecurityiSight Partnersmalware

Featured

Slideshows

Tech industry comes together as Lexel celebrates turning 30

Tech industry comes together as Lexel celebrates turning 30

Leading figures within the technology industry across New Zealand came together to celebrate 30 years of success for Lexel Systems, at a milestone birthday occasion at St Matthews in the City.​

Tech industry comes together as Lexel celebrates turning 30
HP re-imagines education through Auckland event launch

HP re-imagines education through Auckland event launch

HP New Zealand held an inaugural Evolve Education event at Aotea Centre in Auckland, welcoming over 70 principals, teachers and education experts to explore ways of shaping and enhancing learning using technology.

HP re-imagines education through Auckland event launch
Reseller News ICT Industry Awards 2017 - Meet the winners...

Reseller News ICT Industry Awards 2017 - Meet the winners...

Reseller News honoured the industry’s finest on a standout evening for the New Zealand channel, recognising the achievements of established and emerging partners on a memorable night in Auckland.

Reseller News ICT Industry Awards 2017 - Meet the winners...
Show Comments