14 DAY TRIAL // Emsisoft security researcher Fabian Wosar has released today a free decrypter for the BadBlock ransomware that can help ailing victims recover their files without paying the crooks' ransom.
BadBlock has ensured its place in ransomware lore, but not because of its ability to evade antivirus detection or by using some sort of powerful encryption, but due to a huge error in its code that ruins the users' operating system.
BadBlock ruins operating systems
While most ransomware families take great care to filter out filesystem paths like the Windows and Program Files folders, BadBlock doesn't, and the result is as catastrophic as you'd expect.
The ransomware, which normally targets 56 file types among which EXE files, will end up encrypting Windows' executables, making the computer unbootable at the next restart.
BadBlock authors knew this, but they released their ransomware anyway, opting to "recommend" that users keep their computer on, but without mentioning what would happen if they didn't.
BadBlock authors request that victims pay up 2 Bitcoin (~$500), which is quite a steep price compared to other ransomware variants.
BadBlock tells victims in real time what file has just been encrypted
Another thing that stands out is that BadBlock shows the ransom note as soon as the encryption process starts, even showing the user an animated marquee with the latest file that was encrypted.
The BadBlock authors claim to use strong RSA encryption, storing the private key on their own server. They also recommend that users pay the ransom at a unique Bitcoin address, which they say is constantly monitored for payment.
In case the payment takes place, they tell victims that the decryption process would start automatically. Of course, restarting the PC would render it unresponsive, and all sorts of complications would follow.
The good thing is that a free decrypter is now available, and if you need help using it, there's an in-depth tutorial available on Bleeping Computer.
The BadBlock ransomware was spotted by security researcher S!Ri and was later analyzed by Dell's security team.
