Locky ransomware goes into lockdown mode

Jrs30

Level 11
Thread author
Verified
Honorary Member
Top Poster
Well-known
Feb 4, 2016
549
Locky communication with its victims is now encrypted, giving the ransomware more secrecy and control over its operations.

Locky ransomware has shifted into an encrypted lockdown mode and is now protecting the network communication between victims and the command & control servers with public key encryption.

The changeover gives Locky workings greater secrecy and gives the overlords distributing the ransomware tighter control over their network infrastructure and restricts researchers’ ability to eavesdrop on botnet activities.

“The addition of the public key encryption of the network communication throws a wrench in the ability of outsiders to track or even influence Locky activities,” said Moritz Kroll, malware researcher at Avira. “You now have to have the RSA private key – the other half of this equation – to tap into the network. And the Locky developers are clearly keeping this to themselves.”

Locky has always sent a specific public key to each victim as part of the file encryption process. Now it’s also using an RSA public key, which is provided with the sample, to encrypt the keys for C&C communication. The new development has Locky sending out one binary blob with an AES-CTR encrypted connection string as well as one RSA encrypted block with two keys and a HMAC-SHA1 hash.

“The private RSA key is needed to extract the request and response keys which then sets off one more decryption of the request message and one hash verification. If you don’t have this RSA key, it is neither possible to understand the request nor to create a response that the Locky Trojan can decrypt and understand,” explained Kroll.

Full article : Locky ransomware goes into lockdown mode - Avira Blog
 
H

hjlbx

The solution to this is very simple:

1. Don't download and execute unknown files on your system (default-deny behavior and security soft)
2. Keep softs updated (anti-exploit measure)
3. Back up your data in a safe manner (recoverable data)
4. Be willing to clean install your OS at the drop of a dime (have recovery media prepared in advance; home user)

If you happen to get Locky-Locked, then you are none for the worse...
 
  • Like
Reactions: Der.Reisende

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top