4

Reports indicate that there are three default addresses to which victims of Wanna Cry are asked to send funds.

Assuming that Wanna Cry actually does decrypt once payment is verified, how can the software know that the specific computer is the one that should be decrypted in association with the victim's payment?

Improve this question
1
  • Just an opinion, but I don't think it really can. In order to do so a single payment address should be assigned to every victim, or a digital signature over a message using the private key that belongs to the same key pair as the public key used to derive the Bitcoin address from where the payment has been performed should be requested by the attacker. Long story short, it seems that the WannaCry was not that well developed, and no victim-payment match can be performed.
    – sr_gi
    May 17, 2017 at 20:21

3 Answers 3

Reset to default
2

IIRC WannaCry requires you to contact the malware authors (via their built in chat system thing) and then tell them the address that you used to send the payment. Then they will manually decrypt your files for you. Otherwise there is no way for them to track who sent what payment. This of course is fraught with issues and is very unreliable. I have heard some people say that their files were decrypted even without paying, and others say that they have paid but their files were not decrypted.

Improve this answer
3
0

There are two ways that I can think of:

  • Ask for a signed message from the address of the sender of the Bitcoin.

    After the payment is sent, ask them to sign a message with a unique ID to establish a connection between the payment and the computer.

  • Have everyone pay slightly different amounts of Bitcoin.

Improve this answer
3
  • Aha. Second one seems more​ plausible as it's easier to expect a non Bitcoin user to get an amount right than to figure out signing.
    – Leif Jones
    May 18, 2017 at 2:28
  • I'm more familiar with vanilla Stack Overflow - where it's more clear whether an answer solves a problem. If I'm not the expert, how do I judge marking something as correct?
    – Leif Jones
    May 18, 2017 at 2:33
  • @LeifSegen My rule of thumb is that I mark as accepted if I know the answer is correct, or if it helps me. The above is just an informed guess.
    – Nick ODell
    May 18, 2017 at 2:36
0

Here are the three addresses which the payments were sent to for Wanacry: https://blockchain.info/address/13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 https://blockchain.info/address/12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw https://blockchain.info/address/115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Judging by the differing amounts for nearly all of the payments, I thought it would be the amount which differentiates them, although there does seem to be some duplicate amounts, so I'm not entirely sure this is the case.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.