Share:

  • Facebook
  • Hacker News

Follow:

  • Twitter
  • Facebook
  • RSS
Chris Cardell

Your holiday snaps… up for ransom

Let us set the scene. You’ve got the family around and your computer is all set up to show off your holiday snaps. As you open the directory, something doesn’t feel right. Thumbnails aren’t appearing and your images have been renamed from “BEACH08.JPG” to “BEACH08.JPG._CRYPT”. You then notice a new file named “!_READ_ME_!.txt”, after some deliberation you decide to open this mysterious text file… you realise after reading that you have been e-blackmailed,

“Your files are encrypted with RSA-1024 algorithm. To recovery your files you need to buy our decryptor. To buy decrypting tool contact us at: xxxxxxxx@yahoo.com”

That’s enough scene setting… This process means that your computer has been infected with an upgraded version of the Gpcode virus, this new version is the Gpcode.ak. RSA-1024 means 1024-bit encryption which is enough to get the secret services scratching their heads. Basically this is the webs answer to blackmail.

The original virus used a 660-bit encryption which was eventually cracked by Kaspersky Labs found this new ‘strain’ of the virus which had taken the virus programmer two years to better equip the virus. The virus’ encryption algorithm has been improved from 660-bits to 1024-bits and previous bugs in the code have been fixed.

It is thought that it would take 1 PC with a 2.2 Ghz processor around 30 years to crack a 660-bit key. This is why currently Kaspersky is unable to crack the updated 1024-bit key. This means that currently the only way to decrypt these files is to receive the private key from the malicious coder. However Kaspersky recommends that you contact at stopgpcode@kaspersky.com and not the blackmailer.

The answer is to back-up regularly as the virus will encrypt your photos, documents, spreadsheets and anything it can get its hands on that it thinks may have some worth to you.

Is this the future of virus’? It’s certainly a more risky option for malicious coders, but more attractive due to the possible earnings which could bring greater satisfaction than writing virus’ that carry out attacks with no financial gain.

Please note that this isn’t an epidemic and as long as you keep updating your anti-virus you should have no issues.

This entry was posted on Friday, June 6th, 2008 at 1:46 am GMT. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.



Quick links

Print | Email this story

You might also like

    None Found
  • redsetter

    has it be cracked yet?

  • http://doeswhat.com DoesWhat

    It’s unlikely that it has been cracked as of yet.

Most Popular


Recent Articles



What is the biggest hurdle you, personally, have faced or are still facing?

It’s very hard to find really great people to join your team. That’s the biggest hurdle for all the 10 years I’ve been an...
Filip Molcan (MOREDAYS)

Filip Molcan
MOREDAYS

How did you decide on the look and feel of Zerply?

The most frustrating thing for us in the early days was that anything professional automatically equalled corporate and boring. Just do a Google image search for...
Christofer Karltorp (Zerply)

Christofer Karltorp
Zerply

What do you wish you’d have know 5 years ago?

I wish Eric Ries had written “The Lean Startup” in 2007. The passage in the book about him spending 6 months writing an IM feature nobody wanted and his realisation the company would have been in the same position if he sat on the beach sipping...
Gary Brewer (BuiltWith)

Gary Brewer
BuiltWith

What is one mistake you’ve made, and what did you learn from it?

We made the mistake of promoting people that were really good at the job they did into a job they had no experience doing. With enough management and...
Joe Griffin (iAcquire)

Joe Griffin
iAcquire