# How to deal with ransomware questions?

We have specific questions asking about breaking ransomware for CryptoLocker, CryptoWall, and now *.[MKKitana@india.com].wallet (which may be a variant of some other ransomware.

All of these have a similar thread, I know some plaintext, ciphertext pairs, how do I get the key to decrypt?

What should we do with questions like this?

• I have a few suggestions that I will post as answers below. – mikeazo Dec 19 '16 at 15:51
• I've voted everything up, we certainly should do something about them. I've slightly in favor of creating a (new) canonical answer because these persons are often desperate and won't stop unless they find some closure (and we can certainly help with that :P ). – Maarten Bodewes Dec 19 '16 at 16:14
• There are also other SE-sites, where this question comes up, mostly superusers and security-SE. E.g. this answer on security-SE adresses some parts. – tylo Dec 19 '16 at 17:27

There is some value to these questions, we should instead create a canonical question and answer about breaking modern cryptography with known plaintext/ciphertext pairs (maybe we already have a good question we could use), then close all these as duplicates.

• Creating a well written specific question and wiki-answer would be the best way of implementing this solution. The questions themselves are often specific to one particular attack. – Maarten Bodewes Dec 19 '16 at 16:15
• We indeed have such a Q that asked about ransomware in general, while not mentioning specific types or sets of algos. @otus answered it back in Jan16. See “Understanding ransomware – What makes plain-text-attacks or brute-forcing so hard?” The Q now asks What are the characteristics of different algorithms that could be used in such a hacker scenario? which I would say was perfectly answered back then; making the now (rather broadly asking) Q a dupe. – e-sushi Dec 19 '16 at 18:23
• While I think a canonical question would be a good idea, there are differences in some cases – e.g. if some ransomware does something wrong and so can be broken. So canonical, but only close as dupe if the answer matches? – otus Dec 19 '16 at 18:26
• I‘ve added a comment to today‘s Q, asking for clarification to why the asker might not find that Q&A acceptable, or what exactly he/she might not be understanding in relation to ransomware in general. – e-sushi Dec 19 '16 at 18:45

## Generally

I don’t think we can come up with a definite “keep” or “kill” to this meta Q as we’ve all seen that a “good question” can make very much sense and show imense quality, even when the topic itself is regarded to be – let’s just call it – a bit critical. (eg: some might remember all those Snowden Q&As, several RSA-breaking Q&As, etc.).

In the end, I would say it always depends “what they ask” and “how they ask”, and “what they explain” (eg: showing research efforts, what exactly they‘re not grasping etc.) If an asker manages to clearly express his/her Q, I’m all-in for keeping it around.

But when an asker reboots things using different wording while asking what was asked and answered before… well, that’s where the fine line resides that helps decide if it’s a dupe, or not.

When such a rebooted question doesn‘t even add anything to it, which might help differ and/or clarify the difference between two (or more) alike questions,there’s not much else we can do besides asking forsuch additional information and/or a clarification via a comment and hope for the best. Sometimes, we do see an edit that turns a borderlining or even off-topic question into a good question;sometimes we don’t. Experience shows you can never tell untill things actually change to the better.

## In relation to the Q discussed here

When I first looked at that question, I could’t help noticing the question’s initial problem of being rather broad:

What are the characteristics of different algorithms that could be used in such a hacker scenario?

I mean, where should one start when trying to answer that Q in a few paragraphs?

Untill the asker clarifies his/her research efforts, his/her knowledge level, etc. (which I asked for via my comment) we don’t know if the asker already did any research related to crypto algos and/or ransomware that contais and uses it. However we read it, we certaily can’t see from the question what kind of crypto-knowledge level the asker might (or might not) have.

In a worst-case scenario, we might end up being forced to begin from scratch with an general introduction to cryptography, then explain a yet-to-be-defined amount of ciphers et all, followed by explaining public cryptography from A-Z, how different forms of cryptanalysis and attacks work, and who-knows-what beyond that. And we still would’t have mentioned the word ransomware yet – which merely uses cryptographic means to achieve it’s illegal purpose which frequently causes negative security impacts on individual victims or groups of victims.

## Ignoring worst-cases

Even when completely ignoring the described broadness issue for the benefit of the doubt, I still end up concluding that today’s ransomware Q hardly asks anything that wasn’t already asked before.

From the current state of today’s ransomware question, I think it might already finds a perfect answer at and older, likewise generalized, yet less broadly formulated Q&A:

That one was asked and answered in back in January 2016. It’s not yet clear to me what today‘s Q might be asking beyond that. As noted above, I asked but I’m still waiting for the requested clarifications and/or additional indormation that could help differ it from tha already existing question(s) and/or could help narrow it‘s broadness; so that it can be answered within some more limited boundries.

That doesn’t mean all hope is lost in relation to today‘s ransomware question though. It can still transform into a “good question” (as described by our help center). After all,there’s always a chance we can save it. Yet that doesn’t work untill/unless the poster at least provides some hints for us to work with, so that we can pull things completely on-topic with an edit or two, while keeping the core of the question untouched. Has been done before, and should also be possible in this case… provided the asker replies and gives us (at least) some minimal infos.

## Going Canonical

Should the community decide we indeed need a canonical, ransomware-related Q, I would support that decision to the fullest while suggesting we build upon what we already have.

After all, Otus’ answer from back in January 2016 already provides a perfect base which we could build upon by adding additional information via answers (whenever that makes sense).

These questions are of no use to us here. They aren't really related to cryptography in the way we want this site to be geared. The three examples in the question should all be closed as off-topic.