Kaspersky Lab is warning the public at large to be on the lookout for a new version of the blackmail virus Gpcode which has started to appear in the wild. This particularly nasty twist on the virus format encrypts your files using an RSA encryption algorithm, this time with a 1024-bit key. In order to get your file access back, the virus author offers to sell you a decryption tool. Straightforward blackmail for the digital age, and if those files are critical to your work or contain vital personal data then you might just consider giving in and paying up.
Kaspersky, of course, has seen Gpcode before. In fact, it has managed to thwart the efforts of the virus authors in previous versions by cracking the private encryption keys using in-depth and time consuming cryptographic analysis of the RSA algorithm implementation. The last time around a 660-bit key was used, which Kaspersky says would take a single 2.2Ghz PC some 30 years to crack alone. Unfortunately, in the two years that have followed, the author has tweaked his code to fix previous errors which allowed that analysis to take place and added a 1024-bit encryption key which Kaspersky has been unable to crack so far.
Unless any errors are found it is, to be honest, unlikely that a key of this length will be cracked. Which means that if you do get infected, and if your files do get encrypted, then the only decryption option would appear to sit with the virus author who has that private key to do the unlocking with.
Kaspersky specialists recommend that victims contact them by email to stopgpcode@kaspersky.com if they get infected, using another computer, and tell them exactly what they were doing in the five minutes before infection and the exact time and date of infection. Kaspersky also stresses that users do not restart or power down the infected computer.
"We urge infected users not to yield to the blackmailer, but to contact us and your local cyber crime law enforcement units" a Kaspersky spokesperson told me "yielding to blackmailers only continues the cycle."
