On: Ransomware Decryptor

[ge0rg]

Implementing this right is surprisingly hard, as the Debian SSL fiasco and the Java/Android's so called SecureRandom RNG have shown. Maybe they were using a defective RNG for the keys as well, so in total there is a very limited number of keys out there, making collisions probable?

[duskwuff → ge0rg]

Or possibly they seized the C&C servers and recovered all of the encryption keys stored on them?

[fragmede → duskwuff]

That's exactly what happened.

https://securelist.com/blog/69595/challenging-coinvault-its-...