imported>Jimmy-bot：机器人: 已有较多条目链入本条目

2021-09-23T23:22:04Z

机器人: 已有较多条目链入本条目

新页面

{{NoteTA
|G1=IT
|G2=Games
}}
{{Infobox computer virus
|Fullname= TeslaCrypt
|Technical name=
|Aliases=
|Family=
|Classification= [[特洛伊木馬 (電腦)|特洛伊木馬]]
|Type= [[勒索軟體]]
|Subtype= [[加密病毒]]
|IsolationDate= 2015年
|Point of Isolation=
|Origin=
|Author=
}}
'''TeslaCrypt'''是一個曾經專事[[勒索軟體|勒索]]的[[木馬程式]]。而目前該程式已宣告終止，加密金鑰也已被其開發者公布。[[ESET]]公司據其金鑰已開發出對應的解密軟體。<span class="cx-segment" data-segmentid="51"></span>

早期的TeslaCrypt針對電腦遊戲資料進行加密。<ref>{{Cite web|url=http://www.bleepingcomputer.com/forums/t/568525/new-teslacrypt-ransomware-sets-its-scope-on-video-gamers/|title=New TeslaCrypt Ransomware sets its scope on video gamers|date=27 February 2015|last=Abrams|first=Lawrence|website=BleepingComputer|accessdate=2016-05-21|archive-date=2016-05-25|archive-url=https://web.archive.org/web/20160525222926/http://www.bleepingcomputer.com/forums/t/568525/new-teslacrypt-ransomware-sets-its-scope-on-video-gamers/|dead-url=no}}</ref><ref name="bbcnews">{{Cite web|url=http://www.bbc.com/news/technology-31869589|title=Gamers targeted by ransomware virus|accessdate=14 March 2015|date=13 March 2015|website=BBC News|archive-date=2016-03-14|archive-url=https://web.archive.org/web/20160314022518/http://www.bbc.com/news/technology-31869589|dead-url=no}}</ref><ref>{{Cite web|url=http://arstechnica.com/security/2015/03/cryptolocker-look-alike-searches-for-and-encrypts-pc-game-files/|title=CryptoLocker look-alike searches for and encrypts PC game files|accessdate=14 March 2015|author=Sean Gallagher|date=Mar 12, 2015|website=Ars Technica|archive-date=2015-03-15|archive-url=https://web.archive.org/web/20150315065927/http://arstechnica.com/security/2015/03/cryptolocker-look-alike-searches-for-and-encrypts-pc-game-files/|dead-url=no}}</ref><ref>{{Cite web|url=http://www.zdnet.com/article/new-cryptolocker-ransomware-targets-gamers/|title=New CryptoLocker ransomware targets gamers|accessdate=14 March 2015|date=March 13, 2015|website=ZDNet|archive-date=2016-06-06|archive-url=https://web.archive.org/web/20160606032111/http://www.zdnet.com/article/new-cryptolocker-ransomware-targets-gamers/|dead-url=no}}</ref>新版本的TeslaCrypt則像其他勒索軟體一樣，對使用者的其他檔案一併加密。

在早期版本中，TeslaCrypt會對其已知的40款遊戲中共185種的檔案類型進行加密，包括[[決勝時刻]]、[[魔兽世界|魔獸世界]]、[[我的世界|Minecraft]]、[[戰車世界]]等遊戲進行加密。受加密的檔案包括儲存在受害者磁碟上的遊戲資料、玩家帳戶資料、自訂地圖、遊戲模組等。新版本的TeslaCrypt則向其他勒索軟體看齊，將受害者的Microsoft Word、PDF、JPEG等檔案一起加密。每一位受害者都會被提示要繳出等值於500美元的比特幣贖金，才能讓被加密的檔案解密。<ref name="bbcnews"/><ref>{{Cite web|url=https://www.securityweek.com/teslacrypt-ransomware-encrypts-video-game-files|title=TeslaCrypt Ransomware Encrypts Video Game Files|accessdate=14 March 2015|date=March 13, 2015|website=Security Week|deadurl=yes|archiveurl=https://web.archive.org/web/20150314182407/http://www.securityweek.com/teslacrypt-ransomware-encrypts-video-game-files|archivedate=2015年3月14日}}</ref>

雖然和另一個著名的勒索軟體[[CryptoLocker]]有相似之處，TeslaCrypt卻未與其共用程式碼，而是獨立開發的病毒。TeslaCrypt利用Anglar Adobe Flash漏洞潛入受害者的電腦。
<ref name="bbcnews"/><ref>{{Cite web|url=http://labs.bromium.com/2015/03/12/achievement-locked-new-crypto-ransomware-pwns-video-gamers/|title=Achievement Locked: New Crypto-Ransomware Pwns Video Gamers|accessdate=14 March 2015|date=March 12, 2015|website=Bromium Labs|archive-url=https://web.archive.org/web/20160319131453/http://labs.bromium.com/2015/03/12/achievement-locked-new-crypto-ransomware-pwns-video-gamers/|archive-date=2016-03-19|dead-url=yes}}</ref>

雖然該惡意軟體聲稱其使用的加密方式為[[公开密钥加密|公開金鑰加密（非對稱加密）]]，[[思科公司]]的網路安全公司Talos卻發現該病毒實際上使用的是[[對稱密鑰加密]]，並據此開發出了一款破解工具。<ref>{{Cite web|url=http://www.pcworld.com/article/2915812/decryption-tool-available-for-teslacrypt-ransomware-that-targets-games.html|title=Decryption tool available for TeslaCrypt ransomware that targets games|accessdate=17 May 2015|date=2015|website=PC World|archive-date=2016-06-02|archive-url=https://web.archive.org/web/20160602012459/http://www.pcworld.com/article/2915812/decryption-tool-available-for-teslacrypt-ransomware-that-targets-games.html|dead-url=no}}</ref>這個弱點在下一次的改進中被修正了，因此遭受2.0版TeslaCrypt攻擊的電腦無法利用此套工具進行解密。<ref>{{Cite web|url=https://securelist.com/blog/research/71371/teslacrypt-2-0-disguised-as-cryptowall/|title=TeslaCrypt 2.0 disguised as CryptoWall|accessdate=5 November 2015|last=Sinitsin|first=Fedor|publisher=AO Kaspersky Lab|website=securelist|archive-date=2016-05-28|archive-url=https://web.archive.org/web/20160528221422/https://securelist.com/blog/research/71371/teslacrypt-2-0-disguised-as-cryptowall/|dead-url=no}}</ref>

在2015年11月，[[卡巴斯基實驗室]]的研究員已經在私底下獲得了2.0版本病毒的弱點細節，但是他們小心的封鎖消息，避免對外傳開，以免讓病毒開發者有機會再次進行補強。<ref>{{Cite web|url=http://www.bleepingcomputer.com/news/security/teslacrypt-decrypted-flaw-in-teslacrypt-allows-victims-to-recover-their-files/|title=TeslaCrypt Decrypted: Flaw in TeslaCrypt allows Victim's to Recover their Files|accessdate=21 January 2016|last=Abrams|first=Lawrence|publisher=2015 Bleeping Computer LLC|website=BleepingComputer|archive-date=2016-05-24|archive-url=https://web.archive.org/web/20160524043703/http://www.bleepingcomputer.com/news/security/teslacrypt-decrypted-flaw-in-teslacrypt-allows-victims-to-recover-their-files/|dead-url=no}}</ref>不過到了隔年（2016年）的1月時，他們發現3.0版本的TeslaCrypt已經修正了該弱點。<ref>{{Cite web|url=http://www.bleepingcomputer.com/news/security/teslacrypt-3-0-released-with-new-encryption-algorithm-and-xxx-file-extensions/|title=TeslaCrypt 3.0 Released with Modified Algorithm and .XXX, .TTT, and .MICRO File Extensions|accessdate=21 January 2016|last=Abrams|first=Lawrence|publisher=2015 Bleeping Computer LLC|website=BleepingComputer|archive-date=2016-05-14|archive-url=https://web.archive.org/web/20160514214447/http://www.bleepingcomputer.com/news/security/teslacrypt-3-0-released-with-new-encryption-algorithm-and-xxx-file-extensions/|dead-url=no}}</ref>

JoeSecurity公司對該病毒進行過全面的分析，並且在該公司的網站上公開了病毒活動的細節。<ref>{{Cite web|url=http://joesecurity.org/reports/report-43855c9d765fe7da2adcc4e6fb9d237c.html|title=BehaviorReport Ransomware Teslacrypt|accessdate=29 Dec 2015|publisher=Joe Security|website=securelist|archive-date=2016-06-04|archive-url=https://web.archive.org/web/20160604114212/http://www.joesecurity.org/reports/report-43855c9d765fe7da2adcc4e6fb9d237c.html|dead-url=no}}</ref>

2016年5月，TeslaCrypt的開發者宣布停止勒索行為，並對外釋出了加密的主金鑰。 <ref>{{Cite web|url=http://www.bleepingcomputer.com/news/security/teslacrypt-shuts-down-and-releases-master-decryption-key/|title=TeslaCrypt shuts down and Releases Master Decryption Key|website=BleepingComputer|access-date=2016-05-19|archive-date=2016-05-19|archive-url=https://web.archive.org/web/20160519000619/http://www.bleepingcomputer.com/news/security/teslacrypt-shuts-down-and-releases-master-decryption-key/|dead-url=no}}</ref>在數天後，ESET釋出了一個程式，能用該加密金鑰還原受害者被鎖住的檔案。<ref>{{Cite web|url=http://download.eset.com/special/ESETTeslaCryptDecryptor.exe|title=由ESET提供的TeslaCrypt解密工具|website=ESET|access-date=2016-05-21|archive-date=2016-05-19|archive-url=https://web.archive.org/web/20160519072010/http://download.eset.com/special/ESETTeslaCryptDecryptor.exe|dead-url=no}}</ref>

== 參考資料 ==
{{Reflist}}

{{电脑入侵}}
[[Category:2015年计算机科学]]
[[Category:密码分析]]
[[Category:勒索軟體]]

TeslaCrypt - 版本历史

imported>Jimmy-bot：​机器人: 已有较多条目链入本条目

imported>Jimmy-bot：机器人: 已有较多条目链入本条目