Lorenz 랜섬웨어용 무료 복호화 툴 개발

출처 : https://securityaffairs.co/wordpress/119492/cyber-crime/lorenz-ransomware-free-decryptor.html

Experts developed a free decryptor for the Lorenz ransomware

Experts analyzed a recently discovered threat, the Lorenz ransomware, and developed a free decryptor ...

Security Affairs / 2021-06-29

 

Tesorion의 연구원들이 Lorenz 랜섬웨어를 분석한 후 피해자가 파일을 무료로 복호화할 수 있는 툴을 개발했다. 

해당 보안 회사는 NoMoreRansom 이니셔티브를 통해 곧 Lorenz 랜섬웨어 복호화 툴을 공개할 예정이라고 밝혔다. Lorenz 랜섬웨어는 CBC 모드에서 RSA와 AES-128 조합을 통해 파일을 암호화하고, 각 파일용 랜덤 비밀번호를 생성하여 사용하며, CryptDeriveKey 기능을 통해 얻은 암호화 키를 사용하는 것으로 알려졌다. 전문가들은 암호화 프로세스 중 CryptEncrypt 함수에서 취약점을 발견했으며, 해당 취약점으로 인해 공격자로부터 복호화 툴을 구매했더라도 파일을 완전히 복구하기 어렵다고 밝혔다. 

Lorenz 랜섬웨어 복호화 툴이 개발됨에 따라 Lorenz 랜섬웨어 피해자들은 빠른 시일 내에 시스템을 복구할 수 있게 됐다.