Reply to thread

Message

<blockquote data-quote="Deleted member 65228" data-source="post: 720445">Ransomware decryption is a case-by-case basis because not all ransomware encryption can be decrypted. If the ransomware does the encryption procedure properly (and thus being securely) then without that key you will not be performing decryption on the encrypted documents. Sometimes network monitoring can be handy in-case the ransomware has a communication with a server to send the keys back to the attacker (e.g. if the ransomware really would decrypt the encrypted files after ransom payment - some do but you should never trust the attacker).However, on that note, some ransomware does not have proper encryption procedures from a security point-of-view. In these situations, the encryption algorithm may be able to be reversed by security researchers and this reverse encryption algorithm can be put into a utility to decrypt affected documents by that specific ransomware variant. At the same time, servers possessing decryption keys from specific variants may be seized by law enforcement if it can be located and overruled but this usually would only happen if the ransomware variant caused a lot of damage, and even if it did, there&#039;s no guarantee.Some ransomware trashes the random key used for the encryption procedure and lies about offering decryption in exchange for the ransom payment as well.Other forms of ransomware aside from the typical file encryption attempts exist in the wild as well, such as screen-lockers. Screen-locking ransomware will lock the screen and demand a payment to unlock the screen - sometimes threatening you and claiming that your files have been encrypted even if they haven&#039;t been.The best thing you can do is keep a good backup, that is the best defense against ransomware.</blockquote>

[QUOTE="Deleted member 65228, post: 720445"] Ransomware decryption is a case-by-case basis because not all ransomware encryption can be decrypted. If the ransomware does the encryption procedure properly (and thus being securely) then without that key you will not be performing decryption on the encrypted documents. Sometimes network monitoring can be handy in-case the ransomware has a communication with a server to send the keys back to the attacker (e.g. if the ransomware really would decrypt the encrypted files after ransom payment - some do but you should never trust the attacker). However, on that note, some ransomware does not have proper encryption procedures from a security point-of-view. In these situations, the encryption algorithm may be able to be reversed by security researchers and this reverse encryption algorithm can be put into a utility to decrypt affected documents by that specific ransomware variant. At the same time, servers possessing decryption keys from specific variants may be seized by law enforcement if it can be located and overruled but this usually would only happen if the ransomware variant caused a lot of damage, and even if it did, there's no guarantee. Some ransomware trashes the random key used for the encryption procedure and lies about offering decryption in exchange for the ransom payment as well. Other forms of ransomware aside from the typical file encryption attempts exist in the wild as well, such as screen-lockers. Screen-locking ransomware will lock the screen and demand a payment to unlock the screen - sometimes threatening you and claiming that your files have been encrypted even if they haven't been. [B][I]The best thing you can do is keep a good backup, that is the best defense against ransomware.[/I][/B] [/QUOTE]

Verification