Third try is no charm for failed Linux ransomware creators

Linux.Encoder version 3 still uses buggy encryption, allowing file recovery, researchers found

Getting cryptographic implementations right is difficult. A group of malware creators is currently experiencing that hard truth, to the amusement of security researchers.

For the past several months, a group of cybercriminals have been infecting Linux systems -- primarily Web servers -- with a file-encrypting ransomware program that the security industry has dubbed Linux.Encoder.

This development is worrying, because Web server infections don't require user interaction as on desktop computers where getting users to open rogue email attachments or visit malicious websites are common attack vectors. Instead, the hackers use automated scanners to find servers that host vulnerable applications or have weak SSH passwords they can guess using brute-force methods.

Many webmasters are also in the bad habit of creating automatic backup routines that save the backed-up directories and database contents on the same server as the website itself, meaning that a ransomware infection will encrypt those as well.

Fortunately, all of the Linux.Encoder variants found so far have had cryptographic implementation errors allowing researchers to create tools to decrypt the affected files.

Security researchers from antivirus vendor Bitdefender recently came across the third version of Linux.Encoder that, according to them, has infected at least 600 servers so far.

The good news is that despite its creators' attempts to address their previous failures, this version of the program also has a flaw that makes decryption possible without paying the ransom.

The new version attempts to generate an AES-256 encryption key by getting 32 random bytes from the rand() function and then hashing them 8 times.

However, the ransomware creators forgot to select a hashing algorithm, so the output of the hashing function remains unchanged, the Bitdefender researchers said in a blog post Tuesday. "As a result, the full AES key is now written to the encrypted file, which makes its recovery a walk in the park."

Bitdefender has released a new tool that can decrypt files affected by this latest Linux.Encoder version.

Unfortunately, the people behind this ransomware program seem pretty determined and are unlikely to keep making mistakes. It's safe to assume that they'll get their implementation right at some point, and when that happens files encrypted by Linux.Encoder will be unrecoverable without backups or paying the ransom.

That's why it's important to secure SSH authentication; to keep Web applications like WordPress, Joomla and other content management systems up to date and to use a Web application firewall that can detect and block different types of exploitation attempts. Creating regular backups and storing them offsite is also critically important.

Join the CSO newsletter!

Error: Please check your email address.

More about LinuxSSH

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts