Intercepting entropy: hooking PRNG to recover ransomware encryption keys

Intercepting entropy: hooking PRNG to recover ransomware encryption keys

Speakers: Raviv Rachmiel, Cyber Security Consultant, Draastic

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=ih-KS42LXfk

Overview

In this compelling talk, Raviv Rachmiel, a seasoned reverse engineer and cybersecurity consultant, presents a novel approach to ransomware decryption by intercepting the Pseudo-Random Number Generator (PRNG) functions employed by malware. Titled "Intercepting entropy: hooking PRNG to recover ransomware encryption keys," the presentation delves into the fundamental cryptographic mechanisms of ransomware families, clustering them into distinct categories based on their key generation and encryption protocols. Rachmiel's research posits that by capturing the initial random values generated on the victim's machine, it is possible to reconstruct the encryption keys and achieve full file decryption, offering a potential path to a "universal" decryptor for a significant portion of ransomware variants.

The core premise of this work addresses a persistent challenge in incident response: the seemingly unbreakable nature of correctly implemented ransomware cryptography. Instead of seeking vulnerabilities in the cryptographic algorithms themselves or attempting to recover private keys held by threat actors, Rachmiel focuses on the local generation of entropy. This strategy leverages the fact that ransomware must generate unique keys on the compromised system, making the PRNG a single, critical point of failure that, if monitored, can reveal the secrets necessary for decryption. The talk culminates in a practical proof-of-concept demonstration using Babuk V1 ransomware, showcasing the feasibility and effectiveness of this innovative technique.

Background

▶ Watch: Speaker introduction and personal motivation (0:00)

The motivation behind this research is rooted in the escalating threat of ransomware, a problem that has grown exponentially in market size and financial impact, yet whose core cryptographic locking mechanism remains remarkably consistent since the 1989 AIDS Trojan. Modern ransomware, including sophisticated variants employing double extortion, triple extortion, and even AI-generated components like Prompt Lock and Mal-Terminal, fundamentally relies on encrypting files and demanding a ransom. While attack vectors and extortion tactics evolve, the underlying principle of cryptographic locking has endured for over 36 years.

Rachmiel emphasizes that ransomware operators often perceive themselves as businesses, sometimes even offering "customer support" and penetration test reports to paying victims. This business model necessitates reliable decryption capabilities, meaning the encryption algorithm must be sound. A typical ransomware encryption scheme involves strong symmetric encryption (e.g., AES, Chacha20) for file data, as it is significantly faster than asymmetric encryption, often with unique keys per file for enhanced security. These symmetric keys are then encrypted using an asymmetric encryption algorithm (e.g., RSA, ECDH) with the attacker's public key, ensuring that only the attacker, possessing the corresponding private key, can decrypt them. For incident responders and researchers, decrypting files typically requires either discovering a cryptographic vulnerability in the implementation or obtaining the attacker's private key, which is rarely feasible. This inherent difficulty in traditional decryption methods spurred Rachmiel to seek an alternative, common ground among ransomware families.

His extensive analysis of numerous top ransomware families revealed that their encryption methodologies could be clustered into two primary mechanisms. This clustering, based on how symmetric keys are generated and protected, forms the foundation for his PRNG-hooking strategy. The crucial insight is that regardless of the specific cryptographic primitives used, the initial generation of random values on the victim's machine is an unavoidable step, presenting a universal target for interception.

Key Findings

▶ Watch: Clustering ransomware into two encryption mechanisms (6:00)

Rachmiel's primary finding is that despite the diversity of ransomware families and their varying cryptographic implementations, their core encryption protocols can be categorized into two main mechanisms, both of which rely on Pseudo-Random Number Generators (PRNGs) on the victim's machine. This reliance on local entropy generation provides a crucial interception point for decryption.

Encryption Mechanism One (more sophisticated) involves a hardcoded public key within the ransomware binary. The malware generates a random value, from which it derives a private key. Using an elliptic curve algorithm like ECDH (Elliptic Curve Diffie-Hellman), it then generates a corresponding public key. This newly generated public key, combined with the attacker's hardcoded public key and the derived private key, facilitates the creation of a shared secret. This shared secret is identical to what the ransomware operator can generate with their private key, allowing for future decryption. From this shared secret, the ransomware derives one or more symmetric keys to encrypt files. Examples include Babuk V1, RansomExx, and Knight.

Encryption Mechanism Two (more common and straightforward) also starts with the generation of a random value. From this random value, a symmetric key is directly derived. This symmetric key is then encrypted using an asymmetric encryption algorithm, typically RSA, with the attacker's public key. The resulting encrypted symmetric key, often referred to as a "blob," is stored in the encrypted file metadata, usually at the end of the file, alongside other information like a victim identifier. This metadata allows the ransomware operator to decrypt the symmetric key and subsequently the file. Examples include Akira, Medusa, Babuk V3, and DarkSide. Akira, for instance, uses QueryPerformanceCounter for entropy and a custom PRNG, while Medusa relies on rand() and srand().

A critical commonality across both mechanisms (and indeed, almost all ransomware variants observed by Rachmiel that use asymmetric encryption) is the absolute necessity of a PRNG concept to generate keys on the local machine. The only significant outlier identified was Bian Lean, which used a hardcoded AES key and IV, making its encryption inherently weak and decryptable without payment if the key could be extracted from the sample. This exception highlights the strength of the PRNG-based approach for the vast majority of sophisticated ransomware. The central hypothesis and key finding of this research is that by comprehensively understanding these encryption protocols and intercepting the initial random values generated by the PRNGs, a universal decryption solution becomes achievable.

Technical Deep Dive

▶ Watch: Theory: Intercepting PRNG to recover encryption keys (15:00)

The technical core of Rachmiel's research lies in the detailed reverse engineering of ransomware encryption protocols and the subsequent interception of their PRNG calls. For his proof-of-concept, he focused on Babuk V1, an excellent choice due to its real-world prevalence, the leak of its source code and builder in 2021, and its use of a core logic that has influenced other ransomware families like RansomExx and Knight. This accessibility allowed for a more rapid and in-depth analysis.

Babuk V1, while not obfuscated, incorporates several common ransomware techniques, such as using the Windows Restart Manager to terminate processes holding files, iterating through files with FindFirstFile and FindNextFile, and employing multi-threading (though not optimally, being per-drive rather than per-file). The critical aspect for this research is its key generation process, which relies on an API call to agree on a shared secret and derive the symmetric encryption key.

The full encryption protocol of Babuk V1 proceeds as follows:

1. PRNG Generation: The ransomware initiates its key generation by calling the Windows API function RtlGenRandom (specifically, ntdll.dll's SystemFunction36). This function is used to generate 88 bytes of cryptographically secure random data.
2. Buffer Division: The 88-byte random buffer is then divided into four distinct variables: a 32-byte segment for key1, a 12-byte segment for nonce1, another 32-byte segment for key2, and a final 12-byte segment for nonce2. These are specifically tailored for the Chacha20 stream cipher.
3. Chacha20 Rounds: Babuk V1 uses Chacha20 with a counter of 20 rounds.
4. Key Derivation Step 1: It performs a Chacha20 encryption using key1 and nonce1 on the concatenation of key2 and nonce2.
5. Key Derivation Step 2: Interestingly, it then uses the newly generated key2 and nonce2 (output from the previous step) to encrypt the original key1 and nonce1. This somewhat unusual double-encryption step is a characteristic of Babuk V1.
6. Private Key Generation: From the result of these Chacha20 operations, the first 72 bytes are extracted. These 72 bytes, comprising the new key1, new nonce1, and 28 bytes from the new key2, form the ransomware's private key.
7. Public Key Generation: This private key is then used in an ECDH (Elliptic Curve Diffie-Hellman) key agreement protocol to generate a corresponding public key, which is 144 bytes in length (twice the private key size). This public key is saved to the victim's AppData directory, as it's essential for the threat actor to receive it to facilitate decryption for "paying customers."
8. Shared Secret Derivation: The ransomware operator, upon receiving this public key, combines it with their own private key to generate a shared secret.
9. Symmetric Key Derivation: From this shared secret, two symmetric keys are derived using SHA (Secure Hash Algorithm). The first key is a SHA hash of the first 72 bytes of the shared secret, and the second is a SHA hash of the full 144 bytes. A single nonce is used for both. This particular derivation method is noted as "not the best encryption protocol" by Rachmiel.
10. File Encryption:

• Small Files (< 40 MB): The file is encrypted twice using Chacha20. First, with the first derived key and the nonce. Then, the result of this encryption is encrypted again with the second derived key and the same nonce.
• Big Files (> 40 MB): To optimize performance, only three 10 MB chunks of the file are encrypted: one at the beginning, one in the middle, and one at the end. This means a maximum of 30 MB per large file is encrypted, leaving the majority of the file intact but rendering it unusable.

This intricate dance of PRNG, Chacha20, ECDH, and SHA highlights the complexity of modern ransomware cryptography. However, by pinpointing the initial RtlGenRandom call, Rachmiel demonstrates that even such sophisticated schemes can be unraveled.

Demo / Proof of Concept

▶ Watch: Proof of Concept: Hooking PRNG and decryption demo (24:00)

The proof-of-concept (PoC) demonstrated by Raviv Rachmiel showcases the practical application of his research using Babuk V1 ransomware. The core idea is to intercept the initial random bytes generated by the ransomware on the victim's machine, which are crucial for key derivation.

For this demonstration, Rachmiel utilized MinHook, an open-source library designed for hooking API calls in user mode. The specific API call targeted for interception was RtlGenRandom, also known as SystemFunction36, which Babuk V1 employs to generate its initial 88 bytes of entropy.

The PoC workflow is straightforward:

1. Hooking RtlGenRandom: Using MinHook, the RtlGenRandom function call is intercepted.
2. Capturing Entropy: When RtlGenRandom is invoked by the ransomware, the PoC captures the 88 bytes of random data that are generated. This specific size (88 bytes) is critical, as it directly corresponds to the buffer size requested by Babuk V1. If multiple calls occur, the PoC can identify the correct 88-byte output or, if necessary, brute-force a few possibilities.
3. Storing Entropy: The captured 88-byte random value is saved to a separate, secure file. This file effectively contains the seed from which all subsequent encryption keys are derived.
4. Mimicking Ransomware Logic: Once the initial entropy is secured, the PoC proceeds to mimic the entire key generation and encryption protocol of Babuk V1, but in reverse (or rather, to restore the intermediate values).

• The captured 88 bytes are read and divided into the four Chacha20 components (key1, nonce1, key2, nonce2) as per Babuk's logic.
• The two Chacha20 encryption steps (Chacha20 on key2 || nonce2 with key1/nonce1, then Chacha20 on key1 || nonce1 with new key2/nonce2) are re-executed in the same order to restore the intermediate values, not to cryptographically reverse them. This is a crucial distinction: the goal is to reproduce the exact state of the keys at specific points, not to decrypt the Chacha20 output in the traditional sense.
• From these restored intermediate values, the 72-byte private key is reconstructed.
• The ECDH algorithm is then used to generate the public key.
• The shared secret is derived, followed by the two SHA-derived symmetric keys.
• Finally, the decryption process for small and large files (using Chacha20 with the derived keys and nonce) is applied. Rachmiel highlights that for decryption, the Chacha20 steps are effectively reversed: first decrypting with key2, then with key1.

Rachmiel demonstrated this on a virtual machine infected with a real Babuk V1 sample. By applying his algorithm to an encrypted file (e.g., an "alias" file), the PoC successfully decrypted the file, restoring it to its original, unencrypted state. This live demonstration provided concrete evidence of the method's viability.

It is important to note the current limitations of this PoC: it uses user-mode hooking, which is not scalable for a production-level solution and can be bypassed by ransomware operating in kernel mode. However, as a proof-of-concept, it clearly validates the core theory that intercepting PRNG output can lead to successful ransomware key recovery and decryption.

Defensive Implications

▶ Watch: POC limitations and future research directions (26:30)

The research presented by Raviv Rachmiel offers significant defensive implications for organizations and incident responders battling ransomware. The core takeaway is that by focusing on the Pseudo-Random Number Generator (PRNG) functions, defenders can potentially bypass the cryptographic strength of ransomware and achieve decryption, even when the attacker's private key is unavailable.

Here's how defenders can leverage this information:

1. Target PRNGs as a Chokepoint: The research establishes the PRNG as a universal and vulnerable point in almost all ransomware key generation processes. Security solutions, particularly Endpoint Detection and Response (EDR) systems, could be enhanced to monitor and intercept calls to common PRNG functions like RtlGenRandom, CryptGenRandom, rand(), srand(), or custom PRNG implementations. Capturing these initial entropy values could be a game-changer for post-incident recovery.
2. Develop Proactive Decryption Tools: The methodology provides a blueprint for creating proactive decryption tools. If an EDR can detect ransomware activity and capture the PRNG output in real-time, it could theoretically generate a decryptor specific to that infection, rather than waiting for threat actors to release keys or for researchers to find cryptographic flaws.
3. Enhance Forensic Capabilities: In the aftermath of a ransomware attack, forensic investigators could employ similar hooking techniques in a controlled environment (e.g., a sandbox) to analyze captured ransomware samples. By running the sample and observing its PRNG calls, they could extract the necessary entropy to reverse-engineer the keys and potentially decrypt files.
4. Focus on Key Generation Protocol Analysis: The clustering of ransomware into two main encryption mechanisms provides a framework for analyzing new threats. Incident responders can quickly categorize a new ransomware variant's encryption approach, which then guides their efforts to identify the specific PRNG calls and key derivation steps to target.
5. Address Limitations for Production Readiness: While the PoC uses user-mode hooking via MinHook, a robust production solution would require more advanced techniques. Defenders should push for research and development into kernel-mode hooking to intercept PRNG calls at a lower level, making the solution more resilient against ransomware attempts to bypass user-mode controls and offering broader coverage.
6. Securely Store Captured Entropy: A critical defensive consideration is the secure storage of any captured PRNG values. If these values are intercepted, they must be immediately exfiltrated and stored in a highly secure, isolated location, inaccessible to the ransomware itself. Otherwise, the ransomware could encrypt or delete the very data needed for decryption, rendering the interception useless.
7. Anticipate Future Cryptographic Evolutions: While the current approach covers a significant portion of ransomware, the threat landscape is constantly evolving. Defenders must remain vigilant, continuously researching new cryptographic implementations and key derivation strategies adopted by ransomware to adapt and extend this PRNG-hooking methodology.

Ultimately, this research shifts the paradigm from hoping for cryptographic vulnerabilities or private key leaks to a more proactive, system-level interception strategy. By "catching them all" at the entropy generation stage, organizations can move closer to a comprehensive solution for ransomware recovery.

Key Takeaways

• Ransomware encryption largely follows two common patterns: Raviv Rachmiel's research successfully clusters most ransomware families into two main encryption mechanisms, both relying on local key generation.
• PRNGs are the universal weak point: Regardless of the specific cryptographic algorithms (e.g., Chacha20, RSA, ECDH), almost all ransomware must generate initial random values on the victim's machine, making the Pseudo-Random Number Generator (PRNG) a critical and interceptable component.
• API hooking can capture essential entropy: Techniques like user-mode API hooking (demonstrated with MinHook on RtlGenRandom) can effectively capture the initial random bytes needed to reconstruct encryption keys.
• Babuk V1 PoC validates the approach: The successful decryption of files encrypted by Babuk V1 ransomware using captured PRNG output proves the feasibility of this methodology for a complex and real-world threat.
• Potential for broad ransomware decryption: This research offers a promising path towards developing a more universal decryption solution for a significant percentage of ransomware families, moving beyond case-by-case vulnerability exploitation.
• Further research is needed for production-ready solutions: While the PoC is effective, scaling this approach for production environments requires advancements such as kernel-mode hooking for enhanced resilience and performance, along with secure mechanisms for storing captured entropy.

About the Speaker(s)

Raviv Rachmiel is a highly experienced cybersecurity professional with a passion for reverse engineering and malware research. He has dedicated almost a decade to dissecting malware, a pursuit that began with his involvement in Capture The Flag (CTF) competitions. His academic background includes studies at the Technion in Israel and an MBA from Tel Aviv University and George Washington University.

Throughout his career, Raviv has held significant roles, notably serving as the head of a cyber security R&D unit at a national lab within the Israeli Ministry of Defense. Currently, he operates as an independent cyber security consultant, specializing in reverse engineering, malware research, cloud security research, and incident response (IR). His personal motivation for this research stems from a deep desire to find a definitive solution to the ransomware problem, a challenge he views with the same dedication his mother applies to her endocrinology research. He is also an avid kite surfer and enjoys FlareOn challenges.