A WannaCry Flaw Could Help Some Windows XP Victims Get Files Back – ANDY GREENBERG 05.18.17 3:28 PM


Getty Images

Since the WannaCry ransomware ripped through the internet late last week, infecting hundreds of thousands of machines and locking up critical systems from health care to transportation, cryptographers have searched for a cure. Finding a flaw in WannaCry’s encryption scheme, after all, could decrypt all those systems without any ransom.

Now one French researcher says he’s found at least a hint of a very limited remedy. The fix still seems too buggy, and far from the panacea WannaCry victims have hoped for. But if Adrien Guinet’s claims hold up, his tool could unlock some infected computers running Windows XP, the aging, largely unsupported version of Microsoft’s operating system, which analysts believe accounts for some portion of the WannaCry plague.

No Silver Bullet

On Friday, Guinet released “WannaKey” to the open source code repository Github. Guinet, who works for the Paris-based security firm QuarksLab, says the software can pull traces of a private key from the memory of a Windows XP computer, which can then be used to decrypt a WannaCry-infected PC’s files.

Guinet says he’s successfully used the decryption tool several times on test XP machines he’s infected with WannaCry. But he cautions that, because those traces are stored in volatile memory, the trick fails if the malware or any other process happened to overwrite the lingering decryption key, or if the computer rebooted any time after infection.

“If you get some luck, you can access parts of the memory and regenerate a key,” says Guinet. “Maybe it’ll still be there, and you can retrieve a key used to decrypt the files. It won’t work every time.”

Article continues:

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s