Clop Ransomware Had A Rather Useful Flaw That Linux Users Could Exploit

Clop, a relatively unknown ransomware variant, may remain so for a while longer after it was discovered to have a Linux version with a rather embarrassing flaw.

The Linux version of the ransomware was first spotted in December 2022 by a SentinelLabs researcher named Antonis Terefos. His analysis determined that the Linux variant is almost identical to the Windows one, but with a few small (albeit crucial) differences.

Namely, Linux users were able to quietly decrypt all of the affected files and reclaim their endpoints without having to pay the criminals anything.

Retrieving the master key

Among those differences is the fact that the Linux version “did not encrypt the RC4 keys used for file encryption with the RSA-based asymmetric algorithm used in the Windows variant.”

Unlike the Windows version, the Linux one uses a hardcoded RC4 “master key,” which generates encryption keys, and then uses the same one to encrypt and store files locally. When SentinelLabs figured it out, they used the flaw to freely retrieve the keys and reverse the encryption. The team has now built a Python script to help automate the process, which can be found on GitHub.

But that’s not the only major flaw this ransomware has. The malware also writes extra data to the encrypted file, such as its size and encryption time. Usually, this type of data is obfuscated, as it can help forensic analysts identify important documents. In this case, it wasn’t hidden at all.

All of this prompted the researchers to conclude that the Clop ransomware, at least in its current form, is unlikely to take off as a major threat. Now that the cat’s out of the bag, it’s safe to assume that a new version is in the works and that it could be released soon.

Still, news like this is always good, especially for the victims.

“We shared our findings early with relevant law enforcement and intelligence partners and will continue to collaborate with the relevant organizations to affect the economics of the ransomware space in favor of defenders,” SentinelLabs told BleepingComputer.

Via: BleepingComputer