Please help! SHow step and explain! 2-12. [4 marks Ransomware such as WannaCry u
ID: 3604982 • Letter: P
Question
Please help!
SHow step and explain!
2-12. [4 marks Ransomware such as WannaCry uses encryption to encrypt the files on a victim's computer, then demands that they pay a ransom to be able to decrypt their files. Read about how WannaCry's encryptions works in the "Ransomware Analysis" section of the Wikipedia article about WannaCry: https://en.wikipedia.org/ wiki/WannaCry_ransomware_attack a) Explain what cryptographic operations happen after the WannaCry malware is installed. What term did we use in class for when different types of encryption are used together in this way? (b) Why should the design of the system make it impossible for users to decrypt the files without paying the ransom? (c)According to the "Defensive response" section of the Wikipedia article, re- searchers were able to create a tool that allowed some users to be able to decrypt their files. What was the flaw in the WannaCry malware that enableod this tool to be successful?Explanation / Answer
Wannacry also called as wanacrrptor malware
-> This wannacry malware will spreads vulnerability through internal networks over the internet
-> once this malware entered into our system or PC it get installed by our one cick then it can encryp all our data with .wcry extention.
-> For decrypting of the encrypted data hackers demands nearly $300 or &600 through bitcoin.
-> The wannacry ransomeware had enterd into arround 120 countries and china japan already got effected by this issue
-> Thousands of machines in 10,000 companies lost data because of wannacry
-> If we want to decrypt the data we need a decryption key.
-> If the malwatre is running in our machine it will create a asymmetric key. so in a an organisation each machine needs a unique key to decrypt the data.
-> This wannacry malware have two components or two hardcoded keys one is for encrypt the data and another is for decryption.which is differ for each machine.
-> once malware got installed it will lock all oue official data.
-> even if we have did patching work for windows OS then also malware effect will be there.
-> If anothere machines are in your networh and they didn't have protection or havn't patched those systems also will get effected
-> The malware will enter into other machines from effected machine through ports.
-> sometimes the anti virus also get failed to detect the malwares.
suppose in a machin in an organisation wannacry is attcked it will generate a key into the machine and this demo key will encrypt the files.
->To decrypt the data we need a decryption key and we need to get it by money in the form of bitcoins
->Data security anlysers and data engineers have analysed and they got a tool, which can decrypt the few files But we cannot decrpt the entire data only the data which is encrypted by demo key can be decrypted.