Security Hole #18 - Cryptolocker Ransomware
•Download as PPTX, PDF•
0 likes•170 views
Presentation in SoftServe's Security Hole #18 about cryptolocker ransomware, how they work, distribution methods, possible remediation scenarios. Short story about one of our client, who got infected with cryptolocker on 1C database server, our incident forensics and recommendations hot to stay secure
Recommended
More Related Content
Viewers also liked
Viewers also liked (16)
Similar to Security Hole #18 - Cryptolocker Ransomware
Similar to Security Hole #18 - Cryptolocker Ransomware (20)
More from Igor Beliaiev
More from Igor Beliaiev (6)
Recently uploaded
Recently uploaded (20)
Security Hole #18 - Cryptolocker Ransomware
- 1. dddd
- 2. What people think hackers do?
- 3. What hackers actually do?
- 5. Statistics
- 6. Ransomware
- 7. • Searches for files with certain extensions: doc, docx, wps, xls, xlsx, ppt, pptx, pdf, jpg, dng, psd, raw, cer, crt, pfx, wallet … • Doesn’t touch system directories • Encrypts files with a 2048-bit RSA key pair • Paying the ransom results in decryption of the files • No way to decrypt the files without the private key • Ransomware done right! Crypto Lockers
- 11. Big companies under attack
- 12. Locky
- 14. Statistics
- 15. “Traffic today has varied between 1 new endpoint each second, to up to 5 per second. I estimate by the end of the day well over 100,000 new endpoints will be infected with Locky, making this a genuine major cybersecurity incident — 3 days in, approximately a quarter of million PCs will be infected”. February 17, 2016
- 16. Pay or not to pay? “The ransomware is that good,” said Joseph Bonavolonta, the Assistant Special Agent in Charge of the FBI’s CYBER and Counterintelligence Program in its Boston office. “To be honest, we often advise people just to pay the ransom.”
- 18. Motto – “be opened to the world”
- 19. One of cases
- 20. One of cases
- 21. Hacker database
- 22. Hacked account
- 23. TOP login names
- 24. More then 11days, 68 ip, 21 countries 94.23.170.170 45.32.83.236 89.184.84.84 195.154.209.174 190.10.9.246 212.83.168.145 193.34.8.158 178.22.50.250 109.237.89.107 46.175.191.254 104.45.28.180 96.11.19.194 12.139.34.20 97.65.80.4 94.136.45.239 46.98.123.93 74.208.153.91 62.205.128.83 76.79.234.170 212.48.66.50 195.138.198.199 94.158.46.227 178.238.92.22 212.57.114.159 109.107.232.75 89.179.244.173 78.37.97.102 91.223.180.250 78.85.33.136 89.151.134.231 163.158.144.184 77.232.25.22 172.245.123.14 188.247.66.213 92.253.126.26 134.249.149.96 176.36.19.10 5.53.117.49 113.160.199.25 74.208.112.162 83.110.216.111 80.82.64.117 91.218.19.12 85.238.100.202 64.38.204.98 61.182.72.16 185.28.110.35 199.189.254.245 179.111.212.254 37.152.8.236 39.109.19.1 37.122.210.243 91.243.29.89 195.70.37.67 211.141.150.55 198.74.113.208 217.73.91.183 24.97.22.154 195.175.104.78 81.176.239.250 14.147.145.218 78.63.234.219 93.75.39.135 190.10.8.29 5.134.114.154
- 25. Deanonymization?
- 26. Deanonymization?
- 28. How to stay secure? Software updates and patches Security Awareness Low privilege access Backups Antivirus/Antispam
- 29. How to secure your 1C with RDP? • Regural backups. • Regural EXTERNAL backups • Access control for own IP addresses/networks. • VPN/IPSec • Password policy • Antibruteforce policy • Don’t use usuals logins (admin/alex/manager).
- 30. Skype: ghost-bel
- 31. OWASP Lviv Team