Specialized media lost no time covering the news: a new variant of ransomware designed to attack Linux-based web servers began to make its rounds, demanding exactly one Bitcoin as payment for affected users to regain access to the content of their projects. But in the peculiar world of malware, some are very good... and others stink. In this case, the developers used a very predictable key, and tools already exist to recover the data.
The Threat
One particularity of ransomware is that it terrifies the average user. I'm sure our readers would take the infection more calmly, looking for alternatives to thwart the desires of the "digital kidnapper". However, imagine that user who uses their computer as a tool, but at the same time is incapable of responding to a minimal error message, and suddenly discovers that years of work (of which they have no backup) have been taken hostage by an unscrupulous subject who is probably on the other side of the world. Yes, what that user will do is pay what they ask. We must also consider the following: Ransomware evolves. Attacking isolated terminals is increasingly unsuccessful, so its creators have decided to change targets, focusing their efforts on Linux servers.
The latest example was identified as Linux.Encoder.1. The folks at Dr. WEB explain that the ransomware encrypts files in the /home, /root, /var/lib/mysql, /var/www, /etc/nginx, /etc/apache2 and /var/log folders, then moves on to anything identified as git, svn, www, webapp, backup and public_html. So far, the feeling is that Linux.Encoder.1 leaves no loose ends, and as ransom it demands the sum of one Bitcoin, which according to CoinDesk is about 344 dollars.
Why It Failed
So what happened? The minds at Bitdefender began to study more deeply the operation of Linux.Encoder.1, especially the way it generates AES keys. This is done on the affected system, but instead of creating truly random elements, all it does is take the necessary values from the libc rand() function, seeded with the computer's timestamp at the moment of the attack. In short, all that is needed is a script to obtain the AES key and release the files. The tool is simple, but not so its use, and Bitdefender offers precise instructions (link below) that allow reaching a successful end. The story of Linux.Encoder.1 seems over, but there is no doubt that it will seek revenge.
Bitdefender
