What is Cryptovirology? Is it dangerous?

Looks like there are enough cyber threats for you to worry about. But cybercriminals can now launch even more powerful attacks through Cryptovirology. This has nothing to do with cryptocurrencies. So, what is Cryptovirology and is it dangerous?

Cryptography Basics

What is Cryptovirology? Is it dangerous? Picture 1

Cryptovirology is a method of mining cryptography to create or improve malicious programs. In short, it moves cryptography from a defensive method to an offensive one.

Cryptography has done great things for cybersecurity and privacy. This area involves taking easy-to-read information and converting it into encrypted text that is much harder to decipher, thus harder to exploit. You may have heard of the term "encryption" before as many online platforms are now using this security method to protect users. This method encrypts your data so that no unauthorized party can see it.

While cryptography offers many benefits, like most technologies, it can be leveraged for illegal activities, including the development of malware.

Ransomware is a well-known example of cryptovirology. Ransomware is a type of malware that encrypts files on an infected device. If the victim pays the ransom demanded by the attacker, they will have a chance to get their data back through the decryption key held by the attacker. Sometimes, the victim will be able to get their data back by paying a ransom, but in the worst case, the attacker will run away with the money without providing the decryption key.

This malicious method could also involve the exploitation of Public key cryptography, a specific field in cryptology. Public key cryptography uses related key pairs to encrypt data. One key is public and the other is private. You may have heard of this cryptography method being used in the cryptocurrency industry on blockchain.

By abusing cryptography systems, cybercriminals can get hold of highly sensitive private data. But how is it done?

How is Cryptovirology used?

As Shivale Saurabh Anandrao stated in "Cryptovirology: Virus Approach", the core aim of cryptovirology is to "give malware a greater and stronger degree of privacy to resist detection, also such as giving the attacker more anonymity while communicating with the deployed malicious program". In short, it is very useful in evading anti-virus protocols.

Asymmetric backdoors are very useful in cryptovirology attacks. An asymmetric backdoor is a backdoor that can only be used by the attacker responsible for creating it. They are also known as kleptograhpic backdoors. Unlike typical backdoors, it's not symmetric, so even if you find it, you can't use it.

But cryptovirology is not just one form. You can get cryptoviruses, cryptotrojans and cryptoworms. These types of attacks can also be used to steal symmetric keys over private keys.

As mentioned before, a more well-known use of cryptovirology is ransomware. Ransomware attacks are not uncommon, several large organizations have been hit by this line of malware. Common examples of ransomware include LockBit, WannaCry, and CryptoLocker. Using such programs, individuals can blackmail victims with huge amounts of money by holding their important data hostage.

Take the Colonial Pipeline attack as an example. In May 2021, this US-based oil pipeline system was the target of a massive ransomware attack. Using a VPN, a group of Russian hackers (known as DarkSide) managed to remotely compromise the Colonial Pipeline system and shut it down. The attackers demanded a ransom in return for normal operation, and Colonial Pipeline eventually gave in.

Cryptovirology attacks have been around since the mid-1990s, but there have been many cases of viruses using cryptography in the past, such as the Tremor virus. Although this form of malware did not use cryptography in the payload, it did use such a technique to evade detection by anti-virus software.

Cryptovirology can do a lot of damage

With the breaking of security detection and the theft of highly sensitive data, cryptovirology attacks have the potential to cause a lot of harm. We've seen how these programs can target both individuals as well as organizations and don't know how it will evolve in the future.

Marvin Fry

Update 27 June 2023