Regarding Sicarii's broken decryption process, researchers said that "during execution, the malware regenerates a new RSA key pair locally, uses the newly generated key material for encryption, and then discards the private key."

you are viewing a single comment's thread
view the rest of the comments

[–] OnfireNFS@lemmy.world 9 points 2 days ago (1 children)

So they basically created a hashing function?

[–] pivot_root@lemmy.world 43 points 2 days ago (1 children)

A hash is at least consistent when given identical inputs. What they created is more like a digital incinerator.

[–] Jayjader@jlai.lu 6 points 1 day ago (1 children)

shred -f -u

[–] anton@lemmy.blahaj.zone 4 points 1 day ago (1 children)

-u would give you the space back.
The ransomware doesn't. There is a block of data, sitting there, taunting you.

[–] Jayjader@jlai.lu 2 points 1 day ago

ehehehehe thanks for that mental image

Of course, one can always reclaim that space if the data truly is inaccessible. Makes me want to write a joke program for "cleaning up" after ransomware that just removes the data from the partition table (or whatever the equivalent for files is - would that just be rm?)