science

PGPCoder

PGPCoder is a science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand PGPCoder rather than just read about it. In short: PGPCoder or GPCode is a trojan that encrypts files on the infected computer and then asks for a ransom in order to release these files, a type of behavior dubbed ransomware or cryptovirology. Trojan Once installed on a computer, the trojan creates two registry keys: one to ensure it is run on every system startup, and the second to monitor the progress of the trojan in the infected computer, counting the number of f…

Key takeaways

PGPCoder belongs to science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect PGPCoder to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of PGPCoder from memory before moving on to harder problems.

Reference excerpt

PGPCoder or GPCode is a trojan that encrypts files on the infected computer and then asks for a ransom in order to release these files, a type of behavior dubbed ransomware or cryptovirology.

Trojan Once installed on a computer, the trojan creates two registry keys: one to ensure it is run on every system startup, and the second to monitor the progress of the trojan in the infected computer, counting the number of files that have been analyzed by the malicious code. Once it has been run, the trojan embarks on its mission, which is to encrypt, using a digital encryption key, all the files it finds on computer drives with extensions corresponding to those listed in its code. These extensions include .doc, .html, .jpg, .xls, .zip, and .rar. The blackmail is completed with the trojan dropping a text file in each directory, with instructions to the victim of what to do. An email address is supplied through which users are supposed to request for their files to be released after paying a ransom of $100–200 to an e-gold or Liberty Reserve account.

Efforts to combat the trojan While a few Gpcode variants have been successfully implemented, many variants have flaws that allow users to recover data without paying the ransom fee. The first versions of Gpcode used a custom-written encryption routine that was easily broken. Variant Gpcode.ak writes the encrypted file to a new location, and deletes the unencrypted file, and this allows an undeletion utility to recover some of the files. Once some encrypted+unencrypted pairs have been found, this sometimes gives enough information to decrypt other files. Variant Gpcode.am uses symmetric encryption, which made key recovery very easy. In late November 2010, a new version called Gpcode.ax was reported. It uses stronger encryption (RSA-1024 and AES-256) and physically overwrites the encrypted file, making recovery nearly impossible. Kaspersky Lab has been able to make contact with the author of the program, and verify that the individual is the real author, but have so far been unable to determine his real world identity.

Worked examples

Example 1 — a first encounter with PGPCoder

Start with the simplest possible case. Write down what PGPCoder claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to PGPCoder before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about PGPCoder ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of PGPCoder

In research: PGPCoder appears in science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses PGPCoder in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: PGPCoder is common in secondary-school and first-year university syllabi. It links to neighbouring topics Ransomware, Windows trojans, so understanding it makes those chapters shorter.
In everyday life: Look for PGPCoder outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Ask Teacher Smith questions about this articleOpens your AI tutor with a question about “PGPCoder” →

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study PGPCoder in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what PGPCoder means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain PGPCoder out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is PGPCoder in simple terms?

PGPCoder or GPCode is a trojan that encrypts files on the infected computer and then asks for a ransom in order to release these files, a type of behavior dubbed ransomware or cryptovirology. Trojan Once installed on a computer, the trojan creates two registry keys: one to ensure it is run on every…

Why does PGPCoder matter?

Because it connects several science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study PGPCoder?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on PGPCoder.