Fergie's Tech Blog

Russian Police 'Find' Author of Notorious Gpcode Malware - UPDATE

John E. Dunn writes on Techworld.com:

The infamous Gpcode 'ransomware' virus that hit computers in July was the work of a single person who is known to the authorities, a source close to the hunt for the attacker has told Techworld.

The individual is believed to be a Russian national, and has been in contact with at least one anti-malware company, Kaspersky Lab, in an attempt to sell a tool that could be used to decrypt victims' files.

Initially sceptical, the company was able to verify that the individual was the author of the latest Gpcode attack - and probably earlier attacks in 2006 and 2007 - using a variety of forensic evidence, not least that he was able to provide a tool containing the RC4 key able to decrypt the work of the malware on a single PC.

The 128-bit RC4 keys, used to encrypt the user's data, are unique for every attack. The part that had stymied researchers was that this key had, in turn, been encrypted using an effectively unbreakable 1024-bit RSA public key, generated in tandem with the virus author's private key. But the tool did at least prove that the individual had access to the private 'master' key and must therefore be genuine.

More here.

UPDATE: 17:12 PDT, 30 September 2008: Also related to this, and worth a read, Dancho Danchev's "Identifying the Gpcode Ransomware Author".

posted by Fergie @ 9/30/2008 11:47:00 AM