Give us your money or the data gets it
vnunet.com, 06 Jun 2008
Security specialists are warning of a new virus that encrypts data on infected machines and demands money for the decryption key.
'Gpcode' is thought to access PCs via unpatched browsers. Once active it encodes most of the data on the computer, including .doc, .txt, .pdf, .xls, .jpg and .png files, with a 1,024-bit key.
Once all the files have been encrypted a ReadMe file is left on the machine giving an email address to send money in order to get the decryption key.
The malware is a revision of a previous virus, thought to be from the same author, which appeared two years ago but only used a 660-bit key.
"Virus researchers have been able to crack keys up to 660 bits," said Timur Tsoriev of Kaspersky Labs.
"This was the result of a detailed analysis of the RSA algorithm implementation. If the encryption algorithm is implemented correctly, it could take one PC with a 2.2GHz processor around 30 years to crack a 660-bit key."
We urge infected users not to yield to the blackmailer
Timur Tsoriev Kaspersky Labs
The company has urged users struck by the virus not to reboot or shut down the infected machine.
Instead they should get in contact immediately with the last few websites they visited to determine what, if any, programs were running.
"We urge infected users not to yield to the blackmailer, but to contact us and your local cyber-crime law enforcement units," said Tsoriev. "Yielding to blackmailers only continues the cycle."
30 per cent increase in software demanding payment to release files
Hackers using more sophisticated encryption
First Looks Editor Ian Williams gets hands on with the Sony Ericsson Xperia X1
Over a third insist the service should remain free for...
Kernel-based Virtual Machine virtualisation added to latest Enterprise Linux beta
Do you agree?
Have your say on this article