Uploaded byWhiskeyNeon
PPTX, PDF1,098 views

Ransomware: History, Analysis, & Mitigation

The document provides an overview and analysis of ransomware, including its history, technical details, trends, and mitigation techniques. It discusses how ransomware has evolved from early variants like AIDS to modern cryptoware like CryptoLocker and Locky. The document also analyzes the infection process, command and control infrastructure, and outlines strategies organizations can take to help prevent and recover from ransomware attacks, such as backups, patching, and isolation of critical systems.

Embed presentation

Downloaded 37 times
RANSOMWARE: HISTORY, ANALYSIS, & MITIGATION RAINMAKER @R41NM4KR
• CUSTOMER SUCCESS TECHNICAL ADVISOR – CYBERARK SOFTWARE • B.S. MIS – UNIVERSITY OF TEXAS • COMPTIA A+ & SEC+ • VMWARE VCA-DCV • (ISC)2 SSCP & CISSP • MARRIED, FATHER OF 2 GIRLS. • MEMBER OF SHADOW SYSTEMS HACKER COLLECTIVE • MEMBER OF DALLAS HACKERS ASSOCIATION WHOAMI – RAINMAKER
AGENDA • OVERVIEW • IN THE NEWS • TIMELINE • TECHNICAL ANALYSIS • ANALYSIS OF CLIENT INFECTION • COMMAND & CONTROL (C2) ARCHITECTURE SETUP/DESIGN • EVOLVED RANSOMWARE • MITIGATION TECHNIQUES • FINAL THOUGHTS
RANSOMWARE DEFINED… • LEVERAGING SOFTWARE TO INHIBITS USE OF THE SYSTEM. • APPLIES EXTORTION ON THE ASSUMPTION THAT THE DATA IS IMPORTANT ENOUGH TO THE USER THEY ARE WILLING TO PAY FOR RECOVERY. • THERE IS NO GUARANTEE OF ACTUAL RECOVERY, EVEN AFTER PAYMENT IS MADE.
RANSOMWARE VICTIMS • ONLY A QUARTER OF AMERICAN HOMES BACK UP THEIR DATA ON A REGULAR BASIS. • ACCORDING TO TRIPWIRE.COM, HALF OF ALL AMERICAN RANSOMWARE VICTIMS HAVE PAID THE RANSOM. • ACCORDING TO TREND MICRO AROUND 30% OF BUSINESSES END UP PAYING THE RANSOM. Much larger ransoms have been demanded into the millions. Some organizations refuse to pay and suffer the consequences. Others do not disclose they have actually paid the ransom.
RANSOMS PAID • HOLLYWOOD PRESBYTERIAN MEDICAL CENTER • 40 BTC (~$17,000 USD) RANSOM PAID. • HORRY COUNTY SCHOOL DISTRICT, SOUTH CAROLINA • 20 BTC (~$8,000 USD) • TEWKSBURY POLICE DEPARTMENT • 1 BTC (~$500 USD) • SWANSEA POLICE DEPARTMENT • 2 BTC (~$750 USD) • VILLAGE OF ILION, NEW YORK • $800 USD
RECENT RANSOMWARE NEWS • METHODIST HOSPITAL KENTUCKY • MARCH 22 • DECLARES ‘INTERNAL STATE OF EMERGENCY’ AFTER RANSOMWARE INFECTION • MEDSTAR HEALTH SYSTEMS COMPLETELY SHUT DOWN • MARCH 28TH • 10 HOSPITALS, 250 OUTPATIENT FACILITIES. • 45 BTC ~ $19,000 RANSOM. • APRIL 7TH – ADOBE ISSUES EMERGENCY UPDATE. • FLASH 0-DAY USED TO DISTRIBUTE RANSOMWARE
MALVERTISING VICTIMS • UP 325% FROM 2014-2015 • RECENTLY AS OF MARCH 15TH, 2016 • COMPANIES OUTSOURCE THEIR ADVERTISING THROUGH ADVERTISING NETWORKS • TAINTED ADS WITH THE ANGLER TOOLKIT. • NYTIMES, BBC, MSN, AOL, ANSWERS.COM, ZEROHEDGE, INFOLINKS, MY.XFINITY, NFL, REALTOR.COM, THEWEATHERNETWORK, THEHILL, AND NEWSWEEKALL SERVED UP RANSOMWARE. • OTHER VICTIMS INCLUDE: • SPOTIFY, TMZ, SKYPE, EBAY, DRUDGE REPORT, AND MANY MANY MANY OTHERS.
A BRIEF HISTORY OF RANSOMWARE
THE FIRST RANSOMWARE: THE AIDS VIRUS • DISCOVERED IN 1989 • REPLACED AUTOEXEC.BAT • AFTER 90 DAYS, ENCRYPTED FILE NAMES ON C:/ • ASKED TO ‘RENEW THE LICENSE’ • $189 TO A PO BOX IN PANAMA • DR. JOSEPH POPP WAS ARRESTED BY SCOTLAND YARD LATER THAT YEAR AND CHARGED WITH BLACKMAIL
REVETON
INTERNET ERA RANSOMWARE: FBI LOCKSCREEN • CIRCA 2011 • REVETON TROJAN FAMILY • IMPERSONATES NATIONAL LAW ENFORCEMENT • LOCKS OUT OF PC • EASILY REMOVED • BOOT TO SAFEMODE • REMOVE REGISTRY KEY
CRYPTO-CURRENCY • BITCOIN • ANONYMOUS • SECURE • INSTANT • NOT REGULATED • PERFECT FOR EXTORTION!
CRYPTOLOCKER
CRYPTOLOCKER • STARTED TO APPEAR AROUND SEPTEMBER 2013 • DELIVERED MAINLY THOUGH THE GAMOVERZEUS (GOZ) P2P BOTNET • USED DOMAIN GENERATED ALGORYTHMS (DGA) • PRODUCE THOUSANDS OF DOMAINS • ONLY 1 OR 2 WERE REAL Example: Faoefijawjfaslekf9ejaklja[.]ru Bitcoin Price
CRYPTOLOCKER…A DEEPER LOOK. • INFECTED LOCAL DRIVES AND NETWORK STORAGE • AES-2048 ASYMMETRICAL ENCRYPTION • DE-FACTO NAME FOR EVERY ‘CRYPTO’ INFECTION TODAY
CRYPTOLOCKER CONTINUED… • MID 2014 GOZ IS SHUT DOWN. • DOWN GOES CRYPTOLOCKER • KEYS RECOVERED FROM C2C ALLOW FOR DECRYPTION. • NEW VARIANTS EMERGE SHORTLY THEREAFTER
TORRENTLOCKER
TORRENTLOCKER • MAINLY SEEN IN AUSTRALIA & NEW ZEALAND. • PHISHING DISGUISED AS RED- LIGHT TICKETS AND TAX NOTICES.
TORRENTLOCKER: A COMMON NAMING CONVENTION • "(AUS|NSW)"-"(POST|GOV)"."(COM|ORG|NET|ETC) • EXAMPLE: ENFORCEMENT-AUS-GOV.ORG • EXAMPLE: NSW-POST.COM • EASY TO BLOCK TOP LEVEL DOMAIN (TLD)
ALPHA/TESLACRYPT
ALPHA/TESLACRYPT • INITIALLY • ATTACKED GAMERS (GAME RELATED FILE EXTENSIONS) • DGA BASED DOMAINS FOR C2 • EXAMPLE: ASDFWEF23SDF.COM • EVOLVED • EXPANDED FILE EXTENSIONS • COMPROMISED DOMAINS FOR C2 • EXPLOIT KITS AND NOW SPAM
ALPHA/TESLACRYPT • V1.0 USED SYMMETRIC AES KEYS • TALOS GROUP RELEASED TESLADECRYPT • V2.0+ USED ASYMMETRIC KEYS • STILL IN THE WILD • V4.1 DISCOVERED APRIL 22, 2016
CRYPTOWALL
CRYPTOWALL • EXPLODED IN END OF 2014 • COMPROMISED SERVERS & EXPLOIT KITS • USED ANONYMOUS TOR & I2P
2016 The Year of Ransomware
LOCKY
LOCKY • HUGE IN 2016. • SPREADING MOSTLY THOUGH SPAM • DAY 1 – OVER 5 MIL. • SPAM CAMPAIGN SIMILAR TO DRYDEX FINANCIAL TROJAN. • APRIL 5TH - V2.0 NOW LEVERAGING THE NUCLEAR EXPLOIT KIT AND C2 COMMUNICATION METHOD
Compromised Site Redirect Exploit Kit Locky Infection Spam Macros Locky Infection
SAMSAM & MAKTUB
THE DR WILL SEE YOU NOW…AFTER PAYING THE RANSOM • TO DATE, ONLY HOSPITALS HAVE BEEN TARGETED WITH THESE TWO MALWARE SAMPLES. • EXPLOITS KNOWN VULNERABILITIES IN UNPATCHED SERVERS. • SPECIFICALLY JBOSS. • 3.2 MILLION SERVERS VULNERABLE. • ONCE IN, LATERALLY MOVES TO CAUSE THE MOST AMOUNT OF DESTRUCTION Samas/Samsam/MSIL.B/C
NEW TRENDS IN RANSOMWARE
• DISCLOSED MARCH 23, 2016 • MASQUERADES AS A JOB APPLICATION • LINKS TO A SHARED DROPBOX FOLDER CONTAINING SELF EXTRACTING ARCHIVE CONTAINING APPLICANT RESUME AND FAKE PHOTO • REWRITES SYSTEMS MBR AND FORCES BSOD. • FAKE “CHECK DISK” RUNS AND ENCRYPTS MASTER FILE TABLE. LATEST TRENDS Petya – The MBR Encryptor
• DISCLOSED MARCH 25TH, 2016 • DISGUISED IN SPAM AS AN “INVOICE” • LEVERAGES MS WORD AND NATIVE POWERSHELL. • DOES NOT PULL DOWN ANY ADDITIONAL BINARIES, AND LEVERAGES POWERSHELL (ALREADY ON THE SYSTEM AND APPROVED TO BE THERE) TO DO THE DIRTY WORK. LATEST TRENDS PowerWare – Using your own tools against you.
• DISCLOSED MARCH 23, 2016 • RANSOM PAYMENT OF $150 • SERIOUS ABOUT ITS THREATS • EVERY HOUR IT DELETES 100 FILES PERMANENTLY. • EVERY REBOOT IT DELETES 1000 FILES. • DECRYPTER AVAILABLE NOW. LATEST TRENDS Jigsaw – I want to play a game.
TECHNICAL ANALYSIS
ATTACK ANATOMY Installation Phone Home Key Exchange Encrypt Extortion
TYPICAL RANSOMWARE REQUEST • EXPLOIT KIT FIRES STARTING PROCESS • GEOLOCATION CALL • C2 EXCHANGE 18:24:25 wefasdif.facetrap.io 18:24:26 m.wordpress.com 18:24:38 ip-addr.es 18:24:45 travelsecretstoday.com 18:24:45 banzaiitreesofdallas.net 18:24:45 mrchinscyberfriends.org 18:27:04 api.uark.edu
CHAIN OF EVENTS - A.K.A PATH OF PAIN • ANY ATTACK VECTORS INITIATES CHAIN • PHISHING • COMPROMISED SERVER • MALVERTISING
THE RAW IP ADDRESS • USED FOR GEOLOCATION • EXCLUDE CODE EXECUTION OR PERFORM DIFFERENT OPERATION BASED ON GLOBAL POSITION • CHINA, RUSSIA, IRAN, TYPICALLY IGNORED • ATTEMPT TO DISPLAY MESSAGE IN NATIVE LANGUAGE • UNIQUE IDENTIFIER • ADDED HASH WITH OTHER SYSTEM INFO. • (<REQUEST ID>|CAMPAIGN|<MD5>|<OS INFO>|IP ADDRESS) • CAN RESTRICT ONE INFECTION PER IP ADDRESS • IDENTIFY POSSIBLE ANALYSIS ATTEMPTS
RANSOMWARE EVOLVED
LINUX.ENCODER RANSOMWARE • TARGETS LINUX POWERED WEB SERVERS BY ENCRYPTING MYSQL, APACHE, AND HOME/ROOT FOLDERS ASSOCIATED WITH THE TARGET • ASKS FOR 1 BITCOIN TO DECRYPT CRUCIAL FILES. • 3 VERSIONS CURRENTLY. ALL HAVE BEEN ALREADY DECRYPTED • WRITTEN BY THIS GUY.
OSX KERANGER • DISCOVERED MARCH 4, 2016 • DOWNLOADED 6000 TIMES BEFORE IT WAS SHUT DOWN. • VARIANT OF LINUX.ENCODER & “EDUCATIONAL” HIDDEN TEAR RANSOMWARE • RECOMPILED INTO THE OPEN SOURCE BIT TORRENT CLIENT TRANSMISSION. • PUBLISHED ON THEIR SITE WITH UPDATED MD5 HASH. • TURKISH DEVELOPER KEY WAS USED TO BYPASS APPLE’S GATEKEEPER SECURITY FEATURE
IOS “RANSOMWARE” • MAY 2014 AUSTRALIAN IPHONE USERS WERE VICTIMS OF RANSOMWARE ATTACK. • ACTUALLY VICTIMS ICLOUD ACCOUNTS WERE PHISHED. • DEVICES WERE PUT IN LOST (LOCKED) MODE W/ RANSOM MESSAGE. • FAILURE TO PAY RESULTED IN WIPED DEVICE. • RUSSIAN OFFICIALS ARRESTED 2 PEOPLE A MONTH LATER.
SIPLOCKR – 1ST ANDROID ENCRYPTING RANSOMWARE • DETECTED JUNE 1ST, 2014 • LOTS OF ANDROID SCREEN LOCKERS, BUT THIS WAS THE FIRST FILE ENCRYPTER. • ENCRYPTS *.JPG, *.JPEG, & *.PNG TO *.ENC • COMMUNICATES TO C2 VIA TOR NETWORK • DECRYPTER IS CURRENTLY AVAILABLE.
ADULT PLAYER – EXTORTION AT ITS FINEST • MASQUERADES AS A PORN MOVIE PLAYER. • TAKES PHOTOS USING THE FRONT FACING CAMERA WHILE IN USE. • INITIATE LOCK SCREEN WITH PHOTOS AND RANSOM MESSAGE. • IF RANSOM IS NOT PAID, SEND MESSAGE AND PHOTOS TO ALL CONTACTS ON PHONE. • EASY TO FIX
WHAT’S NEXT?
INTERNET OF THINGS • INSTITUTE FOR CRITICAL INFRASTRUCTURE TECHNOLOGY – “IOT PRESENTS AN INFINITE ATTACK SURFACE”. • WHAT’S NEXT? • PACEMAKERS • AUTOMOBILES • YOUR HOUSE?
MITIGATION
MITIGATION TECHNIQUES • BACKUP OFTEN • KEEP DISCONNECTED WHEN NOT IN USE • REVIEW AND RESTRICT ACCESS TO SHARED RESOURCES • DISCONNECT FROM NETWORK SHARES WHEN NOT IN USE. • TRAIN END-USERS ABOUT SOCIAL ENGINEERING TECHNIQUES. • PHISHING • PHISHING • PHISHING!
MORE MITIGATION TECHNIQUES • ANTIVIRUS • ACTUALLY KEEP IT UPDATED. • PATCH THE OS AND SOFTWARE. • CAN’T EXPLOIT VULNERABILITIES THAT HAVE BEEN PATCHED. • PREVENT MALVERTISING/INJECTION • ADBLOCK/UBLOCK ORGIN/ADFENDER • NOSCRIPT • SANDBOXIE • END OF LIFE – IT’S CALLED THAT FOR A REASON
EVEN MORE MITIGATION TECHNIQUES • ONLY INSTALL SOFTWARE FROM TRUSTED SOURCES • FOLLOW THE PACK • APPLE STORE IS SAFE • BAD CODE STILL FALLS THROUGH • ANDROID MARKETPLACE STILL IFFY • YOU HAVE TO TRUST THE DEVELOPER • AVOID OPEN SOURCE SOFTWARE • VALIDATE HASHES FROM EXTERNAL SITES
WILL THIS GUY EVER STOP? • INTRUSION PREVENTION SYSTEMS • ACTUALLY IMPLEMENT BLOCK MODE. • WEB CONTENT PROVIDERS HOST THEIR OWN AD CONTENT • PROBABLY UNREALISTIC, BUT IT’S A REAL POSSIBILITY FOR SMALL/MEDIUM BUSINESSES. • MACROS. • DO I REALLY HAVE TO SAY IT?
ADVANCED MITIGATION TECHNIQUES • PREVENT LATERAL MOVEMENT IN YOUR ENVIRONMENT. • NO PASSWORD REUSE. • FREQUENT PASSWORD ROTATION. • ENABLE LEAST PRIVILEGE • NOT EVERYONE NEEDS ADMINISTRATIVE RIGHTS. • EVEN BETTER, IMPLEMENT APPLICATION CONTROL • RESTRICT THE BINARIES FROM EVER EXECUTING • AC CAN PREVENT RANSOMWARE ENTIRELY • ISOLATE YOUR CRITICAL RESOURCES Ransomware no longer wants to infect a single machine. Isolate the infection.
FINAL THOUGHTS
REASONS WHY YOU SHOULD PAY. • FBI SAYS, “EASIEST PATH IS TO PAY”. • IT’S IN THEIR BEST INTEREST TO DELIVER. • IT MIGHT BE CHEAPER.
REASONS WHY YOU SHOULDN'T PAY. • IT MIGHT BE CHEAPER, BUT IT’S REALLY NOT. • DISCLOSURE IS NOT CHEAP. • THERE’S A TARGET ON YOUR BACK. • COPYCAT ATTACKS ARE REAL. • US-CERT SAYS SO. • THE CRIMINALS WIN.
LAST SLIDE…I SWEAR “AN OUNCE OF PREVENTION IS WORTH A POUND OF CURE.”
REFERENCES • HTTP://THEHACKERNEWS.COM/2016/03/WHAT-IS-MALVERTISING.HTML • HTTPS://EN.WIKIPEDIA.ORG/WIKI/AIDS_(TROJAN_HORSE) • HTTP://WWW.COINDESK.COM/FBI-MALWARE-VICTIMS-SHOULD-PAY-BITCOIN-RANSOMS/ • HTTPS://NAKEDSECURITY.SOPHOS.COM/2013/10/12/DESTRUCTIVE-MALWARE-CRYPTOLOCKER-ON-THE-LOOSE/ • HTTPS://BLOG.KASPERSKY.COM/RANSOMWARE_TARGETS_IOS_OSX/4903/ • HTTPS://THREATPOST.COM/ALLEGED-OLEG-PLISS-IPHONE-HACKERS-ARRESTED-IN-RUSSIA/106570/ • HTTP://THEHACKERNEWS.COM/2016/01/LINUX-RANSOMWARE-DECRYPTION.HTML • HTTP://WWW.SECURITYWEEK.COM/OS-X-RANSOMWARE-KERANGER-BASED-LINUXENCODER • HTTP://WWW.VIRUSRADAR.COM/EN/ANDROID_SIMPLOCKER.A/DESCRIPTION • HTTP://THEHACKERNEWS.COM/2013/07/ANDROID-RANSOMWARE-MALWARE-MOHIT-KUMAR-HACKER.HTML • HTTP://WWW.DOYNEWS.COM/TAGS/ADULT-PLAYER-ANDROID • HTTP://WWW.IBTIMES.CO.UK/ADULT-PLAYER-ANDROID-PORN-APP-BLACKMAILING-USERS-SECRET-PHOTOS- DEMANDS-RANSOM-1518808 • HTTPS://LABS.BITDEFENDER.COM/2016/03/KERANGER-IS-ACTUALLY-A-REWRITE-OF-LINUX-ENCODER/ • HTTPS://BLOG.AVAST.COM/2015/02/10/MOBILE-CRYPTO-RANSOMWARE-SIMPLOCKER-NOW-ON-STEROIDS/ • HTTPS://NAKEDSECURITY.SOPHOS.COM/2012/08/29/REVETON-RANSOMWARE-EXPOSED-EXPLAINED-AND- ELIMINATED/ • HTTP://ARSTECHNICA.COM/SECURITY/2016/03/BIG-NAME-SITES-HIT-BY-RASH-OF-MALICIOUS-ADS-SPREADING- CRYPTO-RANSOMWARE/ • HTTPS://EN.WIKIPEDIA.ORG/WIKI/MALVERTISING • HTTP://WWW.TRIPWIRE.COM/STATE-OF-SECURITY/LATEST-SECURITY-NEWS/HALF-OF-AMERICAN-RANSOMWARE- VICTIMS-HAVE-PAID-THE-RANSOM-REVEALS-STUDY/ • HTTP://WWW.LATIMES.COM/BUSINESS/TECHNOLOGY/LA-ME-LN-HOLLYWOOD-HOSPITAL-BITCOIN-20160217- STORY.HTML • HTTP://GO.CYPHORT.COM/RS/181-NTN-682/IMAGES/MALVERTISING-REPORT-15-RP.PDF • HTTPS://WWW.BOSTONGLOBE.COM/BUSINESS/2015/04/06/TEWKSBURY-POLICE-PAY-BITCOIN-RANSOM- HACKERS/PKCE1GBTOFU52P31F9FM5L/STORY.HTML • HTTPS://SECURITYLEDGER.COM/2015/10/FBIS-ADVICE-ON-CRYPTOLOCKER-JUST-PAY-THE-RANSOM/ • HTTP://WWW.PCWORLD.COM/ARTICLE/3046626/SECURITY/PETYA-RANSOMWARE-OVERWRITES-MBRS-LOCKING- USERS-OUT-OF-THEIR-COMPUTERS.HTML • HTTP://WWW.BLEEPINGCOMPUTER.COM/NEWS/SECURITY/TESLACRYPT-4-0-RELEASED-WITH-BUG-FIXES-AND- STOPS-ADDING-EXTENSIONS/ • HTTP://WWW.NEWSWEEK.COM/HOW-COUNTER-RANSOMWARE-ATTACK-442779 • HTTPS://WWW.KENT.EDU/IS/SECUREIT/APRIL-2015-VICTIMS-RANSOMWARE • HTTP://BLOG.TALOSINTEL.COM/2016/03/SAMSAM-RANSOMWARE.HTML?M=1 • HTTPS://THREATPOST.COM/NEW-SERVER-SIDE-RANSOMWARE-HITTING-HOSPITALS/117059/ • HTTP://THEHACKERNEWS.COM/2015/01/POLICE-RANSOMWARE-SUICIDE.HTML • HTTPS://WWW.US-CERT.GOV/NCAS/ALERTS/TA16-091A • HTTPS://THREATPOST.COM/LOCKY-VARIANT-CHANGES-C2-COMMUNICATION-FOUND-IN-NUCLEAR-EK/117196/ • HTTPS://EN.M.WIKIPEDIA.ORG/WIKI/RANSOMWARE • HTTP://MOBILE.REUTERS.COM/ARTICLE/IDUSKCN0X502K

More Related Content

PDF
Ransomware: History, Analysis, & Mitigation - PDF
byAndy Thompson
 
PPTX
Advantage Technology - Ransomware and the NIST Cybersecurity Framework
byJack Shaffer
 
PPTX
Ransomware: Mitigation Through Preparation
byHostway|HOSTING
 
PPTX
Ransomware - Impact, Evolution, Prevention
byMohammad Yahya
 
PPTX
Ransomware: Emergence of the Cyber-Extortion Menace
byZubair Baig
 
PPTX
Ransomware: How to avoid a crypto crisis at your IT business
byCalyptix Security
 
PPTX
Ransomware the clock is ticking
byManoj Kumar Mishra
 
PPTX
Blackhat USA 2014 - The New Scourge of Ransomware
byJohn Bambenek
 
Ransomware: History, Analysis, & Mitigation - PDF
byAndy Thompson
 
Advantage Technology - Ransomware and the NIST Cybersecurity Framework
byJack Shaffer
 
Ransomware: Mitigation Through Preparation
byHostway|HOSTING
 
Ransomware - Impact, Evolution, Prevention
byMohammad Yahya
 
Ransomware: Emergence of the Cyber-Extortion Menace
byZubair Baig
 
Ransomware: How to avoid a crypto crisis at your IT business
byCalyptix Security
 
Ransomware the clock is ticking
byManoj Kumar Mishra
 
Blackhat USA 2014 - The New Scourge of Ransomware
byJohn Bambenek
 

What's hot

PDF
Analysing Ransomware
byNapier University
 
PDF
Wannacry | Technical Insight and Lessons Learned
byThomas Roccia
 
PPTX
WannaCry ransomware outbreak - what you need to know
bySymantec Security Response
 
PPTX
MMW April 2016 Ransomware Resurgence
byCyphort
 
PPT
Hackers are innocent
bydanish3
 
PDF
CSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
byNCCOMMS
 
PDF
WHITE PAPER▶ The Evolution of Ransomware
bySymantec
 
PPT
Ransomware: Prevention, privacy and your options post-breach
byGowling WLG
 
PDF
Why are you still getting CryptoLocker?
byAaron Lancaster
 
PPTX
Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.
byCyphort
 
PPTX
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL
byCyphort
 
PPTX
Malware's Most Wanted: CryptoLocker—The Ransomware Trojan
byCyphort
 
PPTX
GreyNoise - Lowering Signal To Noise
byAndrew Morris
 
PPTX
EverSec + Cyphort: Big Trends in Cybersecurity
byCyphort
 
PDF
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
byClearDATACloud
 
PPTX
"There's a pot of Bitcoins behind the ransomware rainbow"
byChristiaan Beek
 
PDF
How to Protect Your Organization from the Ransomware Epidemic
byTripwire
 
PPTX
Ransomware 2017: New threats emerge
bySymantec Security Response
 
PDF
IT Security landscape and the latest threats and trends
bySophos Benelux
 
PDF
What is wanna cry ransomware attack
byi-engage
 
Analysing Ransomware
byNapier University
 
Wannacry | Technical Insight and Lessons Learned
byThomas Roccia
 
WannaCry ransomware outbreak - what you need to know
bySymantec Security Response
 
MMW April 2016 Ransomware Resurgence
byCyphort
 
Hackers are innocent
bydanish3
 
CSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
byNCCOMMS
 
WHITE PAPER▶ The Evolution of Ransomware
bySymantec
 
Ransomware: Prevention, privacy and your options post-breach
byGowling WLG
 
Why are you still getting CryptoLocker?
byAaron Lancaster
 
Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.
byCyphort
 
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL
byCyphort
 
Malware's Most Wanted: CryptoLocker—The Ransomware Trojan
byCyphort
 
GreyNoise - Lowering Signal To Noise
byAndrew Morris
 
EverSec + Cyphort: Big Trends in Cybersecurity
byCyphort
 
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
byClearDATACloud
 
"There's a pot of Bitcoins behind the ransomware rainbow"
byChristiaan Beek
 
How to Protect Your Organization from the Ransomware Epidemic
byTripwire
 
Ransomware 2017: New threats emerge
bySymantec Security Response
 
IT Security landscape and the latest threats and trends
bySophos Benelux
 
What is wanna cry ransomware attack
byi-engage
 

Viewers also liked

PDF
[2013 CodeEngn Conference 08] Homeless - Android 악성앱 필터링 시스템
byCode Engn
 
PDF
[2010 CodeEngn Conference 04] hahah - Defcon 18 CTF 문제풀이
byCode Engn
 
PDF
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis KO
byCode Engn
 
PPTX
Warning.or.kr 취약점 분석
bymangonamu
 
PDF
[2012 CodeEngn Conference 07] nesk - Defcon 20th : 본선 CTF 문제풀이
byCode Engn
 
PDF
(FICON2015) #1 어떻게 대응할 것인가?
byplainbit
 
PPTX
엑셀왕국
bySeungYeon Jeong
 
PPTX
해킹과 보안
by창열 최
 
PDF
[2014 CodeEngn Conference 11] 최우석 - 자바스크립트 난독화 너네 뭐니?
byCode Engn
 
PDF
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study KO
byCode Engn
 
PPTX
Programming skills 1부
byJiHyung Lee
 
PDF
Demystifying Cloud Security
byBen Clay, CSP (IoT - Expert)
 
PDF
Christmas CTF 보안대회 수상팀 문제풀이서(팀명:쀼쀼뺘뺘)
byNAVER D2
 
PDF
[2013 CodeEngn Conference 09] proneer - Malware Tracker
byCode Engn
 
PDF
(FICON2015) #2 어떻게 조사할 것인가?
byplainbit
 
PDF
Log parser&webshell detection
byIlsun Choi
 
PDF
[2012 CodeEngn Conference 07] manGoo - Exploit Writing Technique의 발전과 최신 트랜드
byCode Engn
 
PDF
(FICON2015) #5 보안담당자가 겪는 실무적 이슈와 법률적 검토
byplainbit
 
PPTX
05 pe 헤더(pe header)
byIlsun Choi
 
PPTX
개영한줄영작_Giving Advice on Debugging
byNasol Kim
 
[2013 CodeEngn Conference 08] Homeless - Android 악성앱 필터링 시스템
byCode Engn
 
[2010 CodeEngn Conference 04] hahah - Defcon 18 CTF 문제풀이
byCode Engn
 
[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis KO
byCode Engn
 
Warning.or.kr 취약점 분석
bymangonamu
 
[2012 CodeEngn Conference 07] nesk - Defcon 20th : 본선 CTF 문제풀이
byCode Engn
 
(FICON2015) #1 어떻게 대응할 것인가?
byplainbit
 
엑셀왕국
bySeungYeon Jeong
 
해킹과 보안
by창열 최
 
[2014 CodeEngn Conference 11] 최우석 - 자바스크립트 난독화 너네 뭐니?
byCode Engn
 
[2014 CodeEngn Conference 11] 박세한 - IE 1DAY Case Study KO
byCode Engn
 
Programming skills 1부
byJiHyung Lee
 
Demystifying Cloud Security
byBen Clay, CSP (IoT - Expert)
 
Christmas CTF 보안대회 수상팀 문제풀이서(팀명:쀼쀼뺘뺘)
byNAVER D2
 
[2013 CodeEngn Conference 09] proneer - Malware Tracker
byCode Engn
 
(FICON2015) #2 어떻게 조사할 것인가?
byplainbit
 
Log parser&webshell detection
byIlsun Choi
 
[2012 CodeEngn Conference 07] manGoo - Exploit Writing Technique의 발전과 최신 트랜드
byCode Engn
 
(FICON2015) #5 보안담당자가 겪는 실무적 이슈와 법률적 검토
byplainbit
 
05 pe 헤더(pe header)
byIlsun Choi
 
개영한줄영작_Giving Advice on Debugging
byNasol Kim
 

Similar to Ransomware: History, Analysis, & Mitigation

PPTX
Ransomware Attack.pptx
byIkramSabir4
 
PPTX
Ransomware
byAkshita Pillai
 
PDF
Ransomware (1).pdf
byHiYeti1
 
PPTX
Ransomware
byDevAkabari
 
PDF
Ransomware - Rameez Shahzada
byRAMEEZ SHAHZADA
 
PPTX
HR's Critical Role in Protecting Company Data
byParsons Behle & Latimer
 
PDF
Ransomware ly
byLisa Young
 
PPTX
Ransomware attack
byAmna
 
PDF
Ransomware hostage rescue manual
byRoel Palmaers
 
PDF
wp-understanding-ransomware-strategies-defeat
byRobert Leong
 
PPTX
Meeting02_RoT.pptx
byothmanomar13
 
PDF
Combating RANSOMWare
byUmer Saeed
 
PPTX
3Es of Ransomware
bySunil Kumar
 
PDF
AtlSecCon 2016
byEarl Carter
 
PDF
3. Ransomware (cyber awareness series)
byIsaac Feliciano
 
PDF
Your money or your files
byRoel Palmaers
 
PDF
Ransomware is Coming to a Desktop Near You
byCybereason
 
PPTX
Ransomware - what is it, how to protect against it
byZoltan Balazs
 
PDF
Ransomware Trends 2017 & Mitigation Techniques
byAvinash Sinha
 
PPTX
Presentation of Cyber terrorism, Bitcoins & Ransomware
byHemraj Singh Chouhan
 
Ransomware Attack.pptx
byIkramSabir4
 
Ransomware
byAkshita Pillai
 
Ransomware (1).pdf
byHiYeti1
 
Ransomware
byDevAkabari
 
Ransomware - Rameez Shahzada
byRAMEEZ SHAHZADA
 
HR's Critical Role in Protecting Company Data
byParsons Behle & Latimer
 
Ransomware ly
byLisa Young
 
Ransomware attack
byAmna
 
Ransomware hostage rescue manual
byRoel Palmaers
 
wp-understanding-ransomware-strategies-defeat
byRobert Leong
 
Meeting02_RoT.pptx
byothmanomar13
 
Combating RANSOMWare
byUmer Saeed
 
3Es of Ransomware
bySunil Kumar
 
AtlSecCon 2016
byEarl Carter
 
3. Ransomware (cyber awareness series)
byIsaac Feliciano
 
Your money or your files
byRoel Palmaers
 
Ransomware is Coming to a Desktop Near You
byCybereason
 
Ransomware - what is it, how to protect against it
byZoltan Balazs
 
Ransomware Trends 2017 & Mitigation Techniques
byAvinash Sinha
 
Presentation of Cyber terrorism, Bitcoins & Ransomware
byHemraj Singh Chouhan
 

Recently uploaded

PDF
Zero Trust & Defense-in-Depth: The Future of Critical Infrastructure Security
byYasir Naveed Riaz
 
PDF
The major tech developments for 2026 by Pluralsight, a research and training ...
byChris Skinner
 
PDF
Decoding the DNA: The Digital Networks Act, the Open Internet, and IP interco...
byCSUC - Consorci de Serveis Universitaris de Catalunya
 
PDF
TrustArc Webinar - Looking Ahead: The 2026 Privacy Landscape
byTrustArc
 
PDF
December Patch Tuesday
byIvanti
 
PDF
Knowing and Doing: Knowledge graphs, AI, and work
bymarainglezakis1
 
PDF
TrustArc Webinar - Assessing AI Risk with Confidence
byTrustArc
 
PDF
Session 1 - Solving Semi-Structured Documents with Document Understanding
byDianaGray10
 
PPTX
Combining Induction and Transduction for Abstract Reasoning.pptx
byallen578468
 
PPTX
The Landscape of Computer Software Development Companies
byYash Singh
 
PDF
Innovative AI Solutions for Business Growth.pdf
byVox Works
 
PDF
Top Cybersecurity Threats 2025 Guide by Sureshdas
byPrintersassist
 
PPTX
The Future of IT Service Management AI Automation & Beyond.pptx
byChetu
 
PDF
Agentic Automation for Testers – A Hands-On Deep Dive
byUiPathCommunity
 
PDF
Generative AI in 2026: Hype, Bubble, Winter or The Real Deal?
byDr. Tathagat Varma
 
PDF
Generative AI in UiPath: Mastering the Generative Extractor for Intelligent D...
byDianaGray10
 
PPTX
RISE with SAP for Automotive - S4 HANA Value.pptx
byAmira Jemi
 
DOCX
Introduction to the World of Computers (Hardware & Software)
byALIABBAS ABASOV
 
PDF
Ransomware_Resilience_Strategic_Playbook.pdf
byAfonso Henrique Rodrigues Alves
 
PDF
8 LLM Surveys https://tinyurl.com/bdz8e6fp
byBob Marcus
 
Zero Trust & Defense-in-Depth: The Future of Critical Infrastructure Security
byYasir Naveed Riaz
 
The major tech developments for 2026 by Pluralsight, a research and training ...
byChris Skinner
 
Decoding the DNA: The Digital Networks Act, the Open Internet, and IP interco...
byCSUC - Consorci de Serveis Universitaris de Catalunya
 
TrustArc Webinar - Looking Ahead: The 2026 Privacy Landscape
byTrustArc
 
December Patch Tuesday
byIvanti
 
Knowing and Doing: Knowledge graphs, AI, and work
bymarainglezakis1
 
TrustArc Webinar - Assessing AI Risk with Confidence
byTrustArc
 
Session 1 - Solving Semi-Structured Documents with Document Understanding
byDianaGray10
 
Combining Induction and Transduction for Abstract Reasoning.pptx
byallen578468
 
The Landscape of Computer Software Development Companies
byYash Singh
 
Innovative AI Solutions for Business Growth.pdf
byVox Works
 
Top Cybersecurity Threats 2025 Guide by Sureshdas
byPrintersassist
 
The Future of IT Service Management AI Automation & Beyond.pptx
byChetu
 
Agentic Automation for Testers – A Hands-On Deep Dive
byUiPathCommunity
 
Generative AI in 2026: Hype, Bubble, Winter or The Real Deal?
byDr. Tathagat Varma
 
Generative AI in UiPath: Mastering the Generative Extractor for Intelligent D...
byDianaGray10
 
RISE with SAP for Automotive - S4 HANA Value.pptx
byAmira Jemi
 
Introduction to the World of Computers (Hardware & Software)
byALIABBAS ABASOV
 
Ransomware_Resilience_Strategic_Playbook.pdf
byAfonso Henrique Rodrigues Alves
 
8 LLM Surveys https://tinyurl.com/bdz8e6fp
byBob Marcus
 

Ransomware: History, Analysis, & Mitigation

  • 1.
    RANSOMWARE: HISTORY, ANALYSIS, &MITIGATION RAINMAKER @R41NM4KR
  • 2.
    • CUSTOMER SUCCESSTECHNICAL ADVISOR – CYBERARK SOFTWARE • B.S. MIS – UNIVERSITY OF TEXAS • COMPTIA A+ & SEC+ • VMWARE VCA-DCV • (ISC)2 SSCP & CISSP • MARRIED, FATHER OF 2 GIRLS. • MEMBER OF SHADOW SYSTEMS HACKER COLLECTIVE • MEMBER OF DALLAS HACKERS ASSOCIATION WHOAMI – RAINMAKER
  • 3.
    AGENDA • OVERVIEW • INTHE NEWS • TIMELINE • TECHNICAL ANALYSIS • ANALYSIS OF CLIENT INFECTION • COMMAND & CONTROL (C2) ARCHITECTURE SETUP/DESIGN • EVOLVED RANSOMWARE • MITIGATION TECHNIQUES • FINAL THOUGHTS
  • 5.
    RANSOMWARE DEFINED… • LEVERAGINGSOFTWARE TO INHIBITS USE OF THE SYSTEM. • APPLIES EXTORTION ON THE ASSUMPTION THAT THE DATA IS IMPORTANT ENOUGH TO THE USER THEY ARE WILLING TO PAY FOR RECOVERY. • THERE IS NO GUARANTEE OF ACTUAL RECOVERY, EVEN AFTER PAYMENT IS MADE.
  • 6.
    RANSOMWARE VICTIMS • ONLYA QUARTER OF AMERICAN HOMES BACK UP THEIR DATA ON A REGULAR BASIS. • ACCORDING TO TRIPWIRE.COM, HALF OF ALL AMERICAN RANSOMWARE VICTIMS HAVE PAID THE RANSOM. • ACCORDING TO TREND MICRO AROUND 30% OF BUSINESSES END UP PAYING THE RANSOM. Much larger ransoms have been demanded into the millions. Some organizations refuse to pay and suffer the consequences. Others do not disclose they have actually paid the ransom.
  • 7.
    RANSOMS PAID • HOLLYWOODPRESBYTERIAN MEDICAL CENTER • 40 BTC (~$17,000 USD) RANSOM PAID. • HORRY COUNTY SCHOOL DISTRICT, SOUTH CAROLINA • 20 BTC (~$8,000 USD) • TEWKSBURY POLICE DEPARTMENT • 1 BTC (~$500 USD) • SWANSEA POLICE DEPARTMENT • 2 BTC (~$750 USD) • VILLAGE OF ILION, NEW YORK • $800 USD
  • 8.
    RECENT RANSOMWARE NEWS •METHODIST HOSPITAL KENTUCKY • MARCH 22 • DECLARES ‘INTERNAL STATE OF EMERGENCY’ AFTER RANSOMWARE INFECTION • MEDSTAR HEALTH SYSTEMS COMPLETELY SHUT DOWN • MARCH 28TH • 10 HOSPITALS, 250 OUTPATIENT FACILITIES. • 45 BTC ~ $19,000 RANSOM. • APRIL 7TH – ADOBE ISSUES EMERGENCY UPDATE. • FLASH 0-DAY USED TO DISTRIBUTE RANSOMWARE
  • 9.
    MALVERTISING VICTIMS • UP325% FROM 2014-2015 • RECENTLY AS OF MARCH 15TH, 2016 • COMPANIES OUTSOURCE THEIR ADVERTISING THROUGH ADVERTISING NETWORKS • TAINTED ADS WITH THE ANGLER TOOLKIT. • NYTIMES, BBC, MSN, AOL, ANSWERS.COM, ZEROHEDGE, INFOLINKS, MY.XFINITY, NFL, REALTOR.COM, THEWEATHERNETWORK, THEHILL, AND NEWSWEEKALL SERVED UP RANSOMWARE. • OTHER VICTIMS INCLUDE: • SPOTIFY, TMZ, SKYPE, EBAY, DRUDGE REPORT, AND MANY MANY MANY OTHERS.
  • 10.
    A BRIEF HISTORYOF RANSOMWARE
  • 11.
    THE FIRST RANSOMWARE: THEAIDS VIRUS • DISCOVERED IN 1989 • REPLACED AUTOEXEC.BAT • AFTER 90 DAYS, ENCRYPTED FILE NAMES ON C:/ • ASKED TO ‘RENEW THE LICENSE’ • $189 TO A PO BOX IN PANAMA • DR. JOSEPH POPP WAS ARRESTED BY SCOTLAND YARD LATER THAT YEAR AND CHARGED WITH BLACKMAIL
  • 12.
  • 13.
    INTERNET ERA RANSOMWARE:FBI LOCKSCREEN • CIRCA 2011 • REVETON TROJAN FAMILY • IMPERSONATES NATIONAL LAW ENFORCEMENT • LOCKS OUT OF PC • EASILY REMOVED • BOOT TO SAFEMODE • REMOVE REGISTRY KEY
  • 14.
    CRYPTO-CURRENCY • BITCOIN • ANONYMOUS •SECURE • INSTANT • NOT REGULATED • PERFECT FOR EXTORTION!
  • 15.
  • 16.
    CRYPTOLOCKER • STARTED TOAPPEAR AROUND SEPTEMBER 2013 • DELIVERED MAINLY THOUGH THE GAMOVERZEUS (GOZ) P2P BOTNET • USED DOMAIN GENERATED ALGORYTHMS (DGA) • PRODUCE THOUSANDS OF DOMAINS • ONLY 1 OR 2 WERE REAL Example: Faoefijawjfaslekf9ejaklja[.]ru Bitcoin Price
  • 17.
    CRYPTOLOCKER…A DEEPER LOOK. •INFECTED LOCAL DRIVES AND NETWORK STORAGE • AES-2048 ASYMMETRICAL ENCRYPTION • DE-FACTO NAME FOR EVERY ‘CRYPTO’ INFECTION TODAY
  • 18.
    CRYPTOLOCKER CONTINUED… • MID2014 GOZ IS SHUT DOWN. • DOWN GOES CRYPTOLOCKER • KEYS RECOVERED FROM C2C ALLOW FOR DECRYPTION. • NEW VARIANTS EMERGE SHORTLY THEREAFTER
  • 19.
  • 20.
    TORRENTLOCKER • MAINLY SEENIN AUSTRALIA & NEW ZEALAND. • PHISHING DISGUISED AS RED- LIGHT TICKETS AND TAX NOTICES.
  • 21.
    TORRENTLOCKER: A COMMON NAMING CONVENTION •"(AUS|NSW)"-"(POST|GOV)"."(COM|ORG|NET|ETC) • EXAMPLE: ENFORCEMENT-AUS-GOV.ORG • EXAMPLE: NSW-POST.COM • EASY TO BLOCK TOP LEVEL DOMAIN (TLD)
  • 22.
  • 23.
    ALPHA/TESLACRYPT • INITIALLY • ATTACKEDGAMERS (GAME RELATED FILE EXTENSIONS) • DGA BASED DOMAINS FOR C2 • EXAMPLE: ASDFWEF23SDF.COM • EVOLVED • EXPANDED FILE EXTENSIONS • COMPROMISED DOMAINS FOR C2 • EXPLOIT KITS AND NOW SPAM
  • 24.
    ALPHA/TESLACRYPT • V1.0 USEDSYMMETRIC AES KEYS • TALOS GROUP RELEASED TESLADECRYPT • V2.0+ USED ASYMMETRIC KEYS • STILL IN THE WILD • V4.1 DISCOVERED APRIL 22, 2016
  • 25.
  • 26.
    CRYPTOWALL • EXPLODED INEND OF 2014 • COMPROMISED SERVERS & EXPLOIT KITS • USED ANONYMOUS TOR & I2P
  • 27.
    2016 The Year ofRansomware
  • 28.
  • 29.
    LOCKY • HUGE IN2016. • SPREADING MOSTLY THOUGH SPAM • DAY 1 – OVER 5 MIL. • SPAM CAMPAIGN SIMILAR TO DRYDEX FINANCIAL TROJAN. • APRIL 5TH - V2.0 NOW LEVERAGING THE NUCLEAR EXPLOIT KIT AND C2 COMMUNICATION METHOD
  • 30.
  • 31.
  • 32.
    THE DR WILLSEE YOU NOW…AFTER PAYING THE RANSOM • TO DATE, ONLY HOSPITALS HAVE BEEN TARGETED WITH THESE TWO MALWARE SAMPLES. • EXPLOITS KNOWN VULNERABILITIES IN UNPATCHED SERVERS. • SPECIFICALLY JBOSS. • 3.2 MILLION SERVERS VULNERABLE. • ONCE IN, LATERALLY MOVES TO CAUSE THE MOST AMOUNT OF DESTRUCTION Samas/Samsam/MSIL.B/C
  • 33.
  • 34.
    • DISCLOSED MARCH23, 2016 • MASQUERADES AS A JOB APPLICATION • LINKS TO A SHARED DROPBOX FOLDER CONTAINING SELF EXTRACTING ARCHIVE CONTAINING APPLICANT RESUME AND FAKE PHOTO • REWRITES SYSTEMS MBR AND FORCES BSOD. • FAKE “CHECK DISK” RUNS AND ENCRYPTS MASTER FILE TABLE. LATEST TRENDS Petya – The MBR Encryptor
  • 35.
    • DISCLOSED MARCH25TH, 2016 • DISGUISED IN SPAM AS AN “INVOICE” • LEVERAGES MS WORD AND NATIVE POWERSHELL. • DOES NOT PULL DOWN ANY ADDITIONAL BINARIES, AND LEVERAGES POWERSHELL (ALREADY ON THE SYSTEM AND APPROVED TO BE THERE) TO DO THE DIRTY WORK. LATEST TRENDS PowerWare – Using your own tools against you.
  • 36.
    • DISCLOSED MARCH23, 2016 • RANSOM PAYMENT OF $150 • SERIOUS ABOUT ITS THREATS • EVERY HOUR IT DELETES 100 FILES PERMANENTLY. • EVERY REBOOT IT DELETES 1000 FILES. • DECRYPTER AVAILABLE NOW. LATEST TRENDS Jigsaw – I want to play a game.
  • 37.
  • 38.
  • 39.
    TYPICAL RANSOMWARE REQUEST •EXPLOIT KIT FIRES STARTING PROCESS • GEOLOCATION CALL • C2 EXCHANGE 18:24:25 wefasdif.facetrap.io 18:24:26 m.wordpress.com 18:24:38 ip-addr.es 18:24:45 travelsecretstoday.com 18:24:45 banzaiitreesofdallas.net 18:24:45 mrchinscyberfriends.org 18:27:04 api.uark.edu
  • 40.
    CHAIN OF EVENTS- A.K.A PATH OF PAIN • ANY ATTACK VECTORS INITIATES CHAIN • PHISHING • COMPROMISED SERVER • MALVERTISING
  • 41.
    THE RAW IPADDRESS • USED FOR GEOLOCATION • EXCLUDE CODE EXECUTION OR PERFORM DIFFERENT OPERATION BASED ON GLOBAL POSITION • CHINA, RUSSIA, IRAN, TYPICALLY IGNORED • ATTEMPT TO DISPLAY MESSAGE IN NATIVE LANGUAGE • UNIQUE IDENTIFIER • ADDED HASH WITH OTHER SYSTEM INFO. • (<REQUEST ID>|CAMPAIGN|<MD5>|<OS INFO>|IP ADDRESS) • CAN RESTRICT ONE INFECTION PER IP ADDRESS • IDENTIFY POSSIBLE ANALYSIS ATTEMPTS
  • 42.
  • 43.
    LINUX.ENCODER RANSOMWARE • TARGETSLINUX POWERED WEB SERVERS BY ENCRYPTING MYSQL, APACHE, AND HOME/ROOT FOLDERS ASSOCIATED WITH THE TARGET • ASKS FOR 1 BITCOIN TO DECRYPT CRUCIAL FILES. • 3 VERSIONS CURRENTLY. ALL HAVE BEEN ALREADY DECRYPTED • WRITTEN BY THIS GUY.
  • 44.
    OSX KERANGER • DISCOVEREDMARCH 4, 2016 • DOWNLOADED 6000 TIMES BEFORE IT WAS SHUT DOWN. • VARIANT OF LINUX.ENCODER & “EDUCATIONAL” HIDDEN TEAR RANSOMWARE • RECOMPILED INTO THE OPEN SOURCE BIT TORRENT CLIENT TRANSMISSION. • PUBLISHED ON THEIR SITE WITH UPDATED MD5 HASH. • TURKISH DEVELOPER KEY WAS USED TO BYPASS APPLE’S GATEKEEPER SECURITY FEATURE
  • 45.
    IOS “RANSOMWARE” • MAY2014 AUSTRALIAN IPHONE USERS WERE VICTIMS OF RANSOMWARE ATTACK. • ACTUALLY VICTIMS ICLOUD ACCOUNTS WERE PHISHED. • DEVICES WERE PUT IN LOST (LOCKED) MODE W/ RANSOM MESSAGE. • FAILURE TO PAY RESULTED IN WIPED DEVICE. • RUSSIAN OFFICIALS ARRESTED 2 PEOPLE A MONTH LATER.
  • 46.
    SIPLOCKR – 1STANDROID ENCRYPTING RANSOMWARE • DETECTED JUNE 1ST, 2014 • LOTS OF ANDROID SCREEN LOCKERS, BUT THIS WAS THE FIRST FILE ENCRYPTER. • ENCRYPTS *.JPG, *.JPEG, & *.PNG TO *.ENC • COMMUNICATES TO C2 VIA TOR NETWORK • DECRYPTER IS CURRENTLY AVAILABLE.
  • 47.
    ADULT PLAYER –EXTORTION AT ITS FINEST • MASQUERADES AS A PORN MOVIE PLAYER. • TAKES PHOTOS USING THE FRONT FACING CAMERA WHILE IN USE. • INITIATE LOCK SCREEN WITH PHOTOS AND RANSOM MESSAGE. • IF RANSOM IS NOT PAID, SEND MESSAGE AND PHOTOS TO ALL CONTACTS ON PHONE. • EASY TO FIX
  • 48.
  • 49.
    INTERNET OF THINGS •INSTITUTE FOR CRITICAL INFRASTRUCTURE TECHNOLOGY – “IOT PRESENTS AN INFINITE ATTACK SURFACE”. • WHAT’S NEXT? • PACEMAKERS • AUTOMOBILES • YOUR HOUSE?
  • 50.
  • 51.
    MITIGATION TECHNIQUES • BACKUPOFTEN • KEEP DISCONNECTED WHEN NOT IN USE • REVIEW AND RESTRICT ACCESS TO SHARED RESOURCES • DISCONNECT FROM NETWORK SHARES WHEN NOT IN USE. • TRAIN END-USERS ABOUT SOCIAL ENGINEERING TECHNIQUES. • PHISHING • PHISHING • PHISHING!
  • 52.
    MORE MITIGATION TECHNIQUES •ANTIVIRUS • ACTUALLY KEEP IT UPDATED. • PATCH THE OS AND SOFTWARE. • CAN’T EXPLOIT VULNERABILITIES THAT HAVE BEEN PATCHED. • PREVENT MALVERTISING/INJECTION • ADBLOCK/UBLOCK ORGIN/ADFENDER • NOSCRIPT • SANDBOXIE • END OF LIFE – IT’S CALLED THAT FOR A REASON
  • 53.
    EVEN MORE MITIGATIONTECHNIQUES • ONLY INSTALL SOFTWARE FROM TRUSTED SOURCES • FOLLOW THE PACK • APPLE STORE IS SAFE • BAD CODE STILL FALLS THROUGH • ANDROID MARKETPLACE STILL IFFY • YOU HAVE TO TRUST THE DEVELOPER • AVOID OPEN SOURCE SOFTWARE • VALIDATE HASHES FROM EXTERNAL SITES
  • 54.
    WILL THIS GUYEVER STOP? • INTRUSION PREVENTION SYSTEMS • ACTUALLY IMPLEMENT BLOCK MODE. • WEB CONTENT PROVIDERS HOST THEIR OWN AD CONTENT • PROBABLY UNREALISTIC, BUT IT’S A REAL POSSIBILITY FOR SMALL/MEDIUM BUSINESSES. • MACROS. • DO I REALLY HAVE TO SAY IT?
  • 55.
    ADVANCED MITIGATION TECHNIQUES •PREVENT LATERAL MOVEMENT IN YOUR ENVIRONMENT. • NO PASSWORD REUSE. • FREQUENT PASSWORD ROTATION. • ENABLE LEAST PRIVILEGE • NOT EVERYONE NEEDS ADMINISTRATIVE RIGHTS. • EVEN BETTER, IMPLEMENT APPLICATION CONTROL • RESTRICT THE BINARIES FROM EVER EXECUTING • AC CAN PREVENT RANSOMWARE ENTIRELY • ISOLATE YOUR CRITICAL RESOURCES Ransomware no longer wants to infect a single machine. Isolate the infection.
  • 56.
  • 57.
    REASONS WHY YOUSHOULD PAY. • FBI SAYS, “EASIEST PATH IS TO PAY”. • IT’S IN THEIR BEST INTEREST TO DELIVER. • IT MIGHT BE CHEAPER.
  • 58.
    REASONS WHY YOUSHOULDN'T PAY. • IT MIGHT BE CHEAPER, BUT IT’S REALLY NOT. • DISCLOSURE IS NOT CHEAP. • THERE’S A TARGET ON YOUR BACK. • COPYCAT ATTACKS ARE REAL. • US-CERT SAYS SO. • THE CRIMINALS WIN.
  • 59.
    LAST SLIDE…I SWEAR “ANOUNCE OF PREVENTION IS WORTH A POUND OF CURE.”
  • 61.
    REFERENCES • HTTP://THEHACKERNEWS.COM/2016/03/WHAT-IS-MALVERTISING.HTML • HTTPS://EN.WIKIPEDIA.ORG/WIKI/AIDS_(TROJAN_HORSE) •HTTP://WWW.COINDESK.COM/FBI-MALWARE-VICTIMS-SHOULD-PAY-BITCOIN-RANSOMS/ • HTTPS://NAKEDSECURITY.SOPHOS.COM/2013/10/12/DESTRUCTIVE-MALWARE-CRYPTOLOCKER-ON-THE-LOOSE/ • HTTPS://BLOG.KASPERSKY.COM/RANSOMWARE_TARGETS_IOS_OSX/4903/ • HTTPS://THREATPOST.COM/ALLEGED-OLEG-PLISS-IPHONE-HACKERS-ARRESTED-IN-RUSSIA/106570/ • HTTP://THEHACKERNEWS.COM/2016/01/LINUX-RANSOMWARE-DECRYPTION.HTML • HTTP://WWW.SECURITYWEEK.COM/OS-X-RANSOMWARE-KERANGER-BASED-LINUXENCODER • HTTP://WWW.VIRUSRADAR.COM/EN/ANDROID_SIMPLOCKER.A/DESCRIPTION • HTTP://THEHACKERNEWS.COM/2013/07/ANDROID-RANSOMWARE-MALWARE-MOHIT-KUMAR-HACKER.HTML • HTTP://WWW.DOYNEWS.COM/TAGS/ADULT-PLAYER-ANDROID • HTTP://WWW.IBTIMES.CO.UK/ADULT-PLAYER-ANDROID-PORN-APP-BLACKMAILING-USERS-SECRET-PHOTOS- DEMANDS-RANSOM-1518808 • HTTPS://LABS.BITDEFENDER.COM/2016/03/KERANGER-IS-ACTUALLY-A-REWRITE-OF-LINUX-ENCODER/ • HTTPS://BLOG.AVAST.COM/2015/02/10/MOBILE-CRYPTO-RANSOMWARE-SIMPLOCKER-NOW-ON-STEROIDS/ • HTTPS://NAKEDSECURITY.SOPHOS.COM/2012/08/29/REVETON-RANSOMWARE-EXPOSED-EXPLAINED-AND- ELIMINATED/ • HTTP://ARSTECHNICA.COM/SECURITY/2016/03/BIG-NAME-SITES-HIT-BY-RASH-OF-MALICIOUS-ADS-SPREADING- CRYPTO-RANSOMWARE/ • HTTPS://EN.WIKIPEDIA.ORG/WIKI/MALVERTISING • HTTP://WWW.TRIPWIRE.COM/STATE-OF-SECURITY/LATEST-SECURITY-NEWS/HALF-OF-AMERICAN-RANSOMWARE- VICTIMS-HAVE-PAID-THE-RANSOM-REVEALS-STUDY/ • HTTP://WWW.LATIMES.COM/BUSINESS/TECHNOLOGY/LA-ME-LN-HOLLYWOOD-HOSPITAL-BITCOIN-20160217- STORY.HTML • HTTP://GO.CYPHORT.COM/RS/181-NTN-682/IMAGES/MALVERTISING-REPORT-15-RP.PDF • HTTPS://WWW.BOSTONGLOBE.COM/BUSINESS/2015/04/06/TEWKSBURY-POLICE-PAY-BITCOIN-RANSOM- HACKERS/PKCE1GBTOFU52P31F9FM5L/STORY.HTML • HTTPS://SECURITYLEDGER.COM/2015/10/FBIS-ADVICE-ON-CRYPTOLOCKER-JUST-PAY-THE-RANSOM/ • HTTP://WWW.PCWORLD.COM/ARTICLE/3046626/SECURITY/PETYA-RANSOMWARE-OVERWRITES-MBRS-LOCKING- USERS-OUT-OF-THEIR-COMPUTERS.HTML • HTTP://WWW.BLEEPINGCOMPUTER.COM/NEWS/SECURITY/TESLACRYPT-4-0-RELEASED-WITH-BUG-FIXES-AND- STOPS-ADDING-EXTENSIONS/ • HTTP://WWW.NEWSWEEK.COM/HOW-COUNTER-RANSOMWARE-ATTACK-442779 • HTTPS://WWW.KENT.EDU/IS/SECUREIT/APRIL-2015-VICTIMS-RANSOMWARE • HTTP://BLOG.TALOSINTEL.COM/2016/03/SAMSAM-RANSOMWARE.HTML?M=1 • HTTPS://THREATPOST.COM/NEW-SERVER-SIDE-RANSOMWARE-HITTING-HOSPITALS/117059/ • HTTP://THEHACKERNEWS.COM/2015/01/POLICE-RANSOMWARE-SUICIDE.HTML • HTTPS://WWW.US-CERT.GOV/NCAS/ALERTS/TA16-091A • HTTPS://THREATPOST.COM/LOCKY-VARIANT-CHANGES-C2-COMMUNICATION-FOUND-IN-NUCLEAR-EK/117196/ • HTTPS://EN.M.WIKIPEDIA.ORG/WIKI/RANSOMWARE • HTTP://MOBILE.REUTERS.COM/ARTICLE/IDUSKCN0X502K

Editor's Notes

  • #15  In July 2013, a 21-year-old man from Virginia, whose computer coincidentally did contain pornographic photographs of underaged girls with whom he had conducted sexualized communications, turned himself in to police after receiving and being deceived by ransomware purporting to be an FBI message accusing him of possessing child pornography. An investigation discovered the incriminating files, and the man was charged with child sexual abuse and possession of child pornography January 2015, A 17 year old boy from Windsor, Berkshire hanged himself after having been locked out of his system, thinking the police were pursuing him.
  • #34 Cisco/Talos security stated on Friday April 15th, that 4.2 million servers were still vulnerable to the jboss exploit responsible for the sam.sam string of ransomware.
  • #55 The Federal Financial Institutions Examination Council’s CyberSecurity Assessment Tool actually rates organizations with large amounts of open source software in their organizations.
  • #57 Directly from the CERT Advisory: Restrict users’ ability (permissions) to install and run unwanted software applications, and apply the principle of “Least Privilege” to all systems and services. Restricting these privileges may prevent malware from running or limit its capability to spread through the network. Use application whitelisting to help prevent malicious software and unapproved programs from running. Application whitelisting is one of the best security strategies as it allows only specified programs to run, while blocking all others, including malicious software.
  • #59 On October 21, 2015 at the Cyber Security Summit at Boston’s Back Bay Events Center, Joseph Bonavolonta, the Assistant Special Agent in Charge of the FBI’s CYBER and Counterintelligence Program in Boston stated, “The ransomware is that good. To be honest, we often advise people just to pay the ransom.”
  • #60 The United States Computer Emergency Readiness Team seems to disagree with the FBI in their March 31st Alert on Ransomware. “Paying the ransom does not guarantee the encrypted files will be released; it only guarantees that the malicious actors receive the victim’s money, and in some cases, their banking information,” the advisory says. “In addition, decrypting files does not mean the malware infection itself has been removed.”