{"id":8243,"date":"2017-07-06T10:10:32","date_gmt":"2017-07-06T18:10:32","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/07\/06\/news-2018\/"},"modified":"2017-07-06T10:10:32","modified_gmt":"2017-07-06T18:10:32","slug":"news-2018","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2017\/07\/06\/news-2018\/","title":{"rendered":"The key to old Petya versions has been published by the malware author"},"content":{"rendered":"

Credit to Author: Malwarebytes Labs| Date: Thu, 06 Jul 2017 17:06:15 +0000<\/strong><\/p>\n

As research concluded, the original author of Petya, Janus, was not involved in the latest attacks on Ukraine. His original malware was pirated and extended by an unknown actor (read more here<\/a>). As a result of the recent events, Janus probably decided to shut down the Petya project. Similarly to the authors of TeslaCrypt<\/a>, he released his private key, allowing all the victims of the previous Petya attacks, to get their files back.<\/p>\n

(The author of Petya has been known for previously leaking the keys of his rival, Chimera ransomware – details here<\/a>).<\/p>\n

What exactly happened?<\/h3>\n

Yesterday, Janus has made a public announcement on Twitter:<\/p>\n

\"\"<\/p>\n

The message contained a link to the file, hosted at mega.nz<\/em> service.<\/p>\n

\"\"<\/p>\n

The linked file was encrypted and password protected:<\/p>\n

\"\"<\/p>\n

After guessing the password and decrypting the package with the help of openssl<\/em>, I got the following plaintext:<\/p>\n

\"\"<\/p>\n

Congratulations!  Here is our secp192k1 privkey:  38dd46801ce61883433048d6d8c6ab8be18654a2695b4723  We used ECIES (with AES-256-ECB) Scheme to encrypt the decryption password into the \"Personal Code\" which is BASE58 encoded.<\/pre>\n
The verification process will take some time, but so far it seems that this is Janus’ private key for all the previous Petyas.<\/p>\n
Can it help in case of EternalPetya\/NotPetya?<\/h3>\n
This key cannot help in case of EternalPetya, since, in this particular case, the Salsa keys are not encrypted with Janus’ public key, but, instead of this, erased and lost forever (read more<\/a>). It can only help the people who were attacked by Petya\/Goldeneye in the past.<\/p>\n
What is the value added by having this key?<\/h3>\n
Just to recall, the first version of Petya, Red Petya<\/a>, has been successfully cracked by leo_and_stone<\/a>. Based on his work, various decryptors have been released, i.e. antipetya live CD.<\/p>\n
The error in the second version<\/a> – a.k.a. Green Petya<\/a>, revealed by me, was not as severe. Yet, it allowed for writing a bruforcer. Thanks to the GPU-based solution implemented by procrash<\/a>, the process of cracking the Salsa key has been sped up to 3 days.<\/p>\n
Higher versions fixed the flaws to an extent making cracking of the Salsa key no longer possible.<\/p>\n
Thanks to the currently published master key, all the people who have preserved the images of the disks encrypted by the relevant versions of Petya, may get a chance of getting their data back.<\/p>\n
Further research related to the verification of the obtained material and the decryptor is in progress. We will keep you updated, please stay tuned!<\/strong><\/p>\n
Appendix<\/h3>\n
Goldeneye – the last Petya version released by Janus:<\/p>\n
\n
Goldeneye Ransomware – the Petya\/Mischa combo rebranded<\/a><\/p>\n<\/blockquote>\n