If your computer has been infected by the WannaCry ransomware that spread devastation across the world last Friday, you may be lucky enough to get your encrypted files back without paying the $300 ransom to the cybercriminals.
Adrien Guinet, a French security researcher from Quarkslab, has discovered a way to recover the secret encryption keys used by the ransomware for free, which works on Windows XP, Windows 7, Windows Vista, Windows Server 2003 and 2008.
WannaCry Ransomware Decryption Keys
WannaCry's encryption program works by creating a pair of keys on the victim's computer based on prime numbers, a public key and a "private" key for encrypting and decrypting system files respectively.
To prevent the victim from accessing the private key and decrypting locked files themselves, WannaCry deletes the key from the system, leaving no option for victims to recover the decryption key except by paying the ransom to the attacker.
But here's the kicker: WannaCry "doesn't erase the first numbers from memory before freeing the associated memory," Guinet says.
Based on this finding, Guinet released a decryption tool, called WannaKey , which essentially attempts to recover the first two numbers used in the formula to generate encryption keys from memory.
However, this method comes with some limitations and will only work if:
- The computer that has been infected has not been rebooted after the infection.
- The related memory has not been allocated and deleted by some other process.
“To be able to work, your computer must not have rebooted after the infection. Also note that you need a bit of luck to work (see below) and thus it may not work in every case!”, says Guinet.
Although WannaKey only pulls the prime numbers from the affected computer's memory, the tool can only be used by those who can use these prime numbers to manually generate the decryption key to decrypt files infected by the malware.
