Researchers Find Way To Recover NotPetya Files

Researchers have discovered that it appears to be possible to recover files encrypted by last month’s attack by malware known as Petya or NotPetya – although they warned that the technique isn’t yet accessible to most users.

The malware that spread around the world on 27 June, disabling the systems of a number of major companies, was based on the earlier Petya ransomware, but was modified in such a way that the systems it infects can’t be entirely restored, although it may be possible to recover individual encoded files.

File recovery

Kaspersky Lab has referred to the newer malware as NotPetya to distinguish it from the earlier, more conventional ransomware.

Now security firm Positive Technologies found that due to errors in the way the malware carries out encryption recovery may be possible in some cases without having to obtain a decryption key from the attackers.

In cases where NotPetya is able to obtain administrator privileges it encrypts using the Salsa20 algorithm, and Positive found that due to an implementation error only half the encryption bytes are used, making the system easier to crack.

This fact combined with other errors on the programmers’ part makes it possible to guess the data needed to decrypt files, Positive said in a blog post.

“Many different pieces of data are encrypted using the same keystream fragments,” wrote Dmitry Sklyarov, Positive’s head of reverse engineering. “This fact allows implementing a trivial attack based on known plaintext.”

While the manual technique discovered by Positive is highly technical, and wouldn’t be accessible to most users, Sklyarov said automated tools could be developed to carry it out.

“We can expect that professional service providers will be able to recover more data than has been the case to date,” he wrote.

If NotPetya can’t gain administrator privileges it encrypts using a different technique that requires a decryption key to recover files, Sklyarov said, noting there’s no way of knowing in how many cases the flawed Salsa20 technique was used.

Damaging attack

The fact that NotPetya irreversibly damages systems has led some to speculate it was intended as an attack on infrastructure in the Ukraine, where it first spread.

NotPetya’s developers initially made no response to those who asked to pay in order to recover their data, but late last week reportedly offered the malware’s decryption key online for 100 bitcoin, or about £195,000.

Consumer goods maker Reckitt Benckiser, which makes Nurofen painkillers, Harpic cleaner and Nurofen painkillers, issued a warning stating it would lower its expected net revenue growth for the second quarter by 2 percent, or about £100m, due to disruption caused by NotPetya.

The company said it might not be able to recover lost earnings due to continuing issues caused by the malware.

“The continued production difficulties in some factories mean that we… expect to lose some further revenue permanently,” the company stated.

An individual who appears to have been the developer behind the earlier Petya ransomware last week publicly released the decryption key for earlier variants of that malware.

But that key can only be used to decode data encrypted by the first versions of Petya in attacks which mostly occurred last year, and can’t be used to decode files encrypted in last month’s incident.

Do you know all about security in 2017? Try our quiz!