I am a victim of the Petya ransomware. Is there a solution to decrypt my disk?

Question

My computer got encrypted by the Petya ransomware. After a long search I could not find a solution other than using file recovery software.

This helps a bit, but I am wondering if there is a way to completely restore my disk. I am not going to pay.

To improve this question you might want to add some telltale signs that a ransomware infection is from this particular malware. Most users have no way to tell the name of the particular malware which hit them which means they won't find this question. — Philipp, Apr 10, 2016 at 16:32
I don't think there is a real infection, they are just collecting reps, which is ok here on SU if it is a good question that has not been asked before. — Moab, Apr 10, 2016 at 18:20
Looks like it's not a rep grab but publicity for the exploit, which is by the OP himself. I wouldn't begrudge it, it looks non-trivial and potentially useful :-) — alexis, Apr 10, 2016 at 20:25
I know it's not terribly relevant, but would you mind sharing how it happened? Perhaps it might help other users avoid this problem. — Nobilis, Apr 11, 2016 at 7:21

leostone · Accepted Answer · 2016-11-05 04:33:40Z

311

Fortunately, yes, there is a solution - I've written an application that would help with this.

Petya encryption has been reversed, analyzed and there is a solution to get the decryption key, just from the data on the encrypted disk.

The program code for key recovery is hosted on github: https://github.com/leo-stone/hack-petya.

If you can't or don't want to compile the program yourself,
there is an online service available:
https://petya-pay-no-ransom.herokuapp.com/
https://petya-pay-no-ransom-mirror1.herokuapp.com/ (if the first link is erroring for you)

You will still need to have a little computer experience though, to get the necessary data off your disk.

Update: Service has been taken down, it wasn't used anymore.

answered Apr 10, 2016 at 13:55

leostone

1,7593 gold badges11 silver badges10 bronze badges

78

This is why you should never write your own encryption.. though I suppose in this case it's fortunate that they did. If they had used AES, there'd be no way to brute-force the key like this.
– BlueRaja - Danny Pflughoeft
Apr 10, 2016 at 19:43
9

@vsz The authors of this malware encrypt the hard-drive at a hardware level, and wrote their own bootloader (!?!). I'm sure they've heard of AES. It's like as oakad says, they probably did this intentionally for maximum speed.
– BlueRaja - Danny Pflughoeft
Apr 11, 2016 at 5:12
34

Oh, the disclosure rule. I do strongly recommend you do so, if only cause I'm getting a ton of spam flags for a useful tool ;)
– Journeyman Geek ♦
Apr 11, 2016 at 12:04
14

Could you add a basic explanation of what your code does? The answer is complete; I'm just curious and my school WiFi doesn't let me load GitHub repos that don't belong to me.
– Nic
Apr 11, 2016 at 13:14
5

@QPayTaxes The author goes about it in an intentionally roundabout way -- You can plug the decryption routine into just about any constraint solver and have an answer in seconds ( pastebin.com/Zc16DfL1 )
– zetavolt
Apr 12, 2016 at 8:07

| Show 11 more comments

1 Answer 1