Presented by Sivasubramanian Nambivelu at Conference on Cyber Security and Education

1. RISE OF CRYPTO
RANSOMWARE

2. About Me
Sivasubramanian Nambivelu
@sivanambivelu
sivanambivelu
Threat researcher, Incident
handler, Security analyst,
Security consultant, ISO 27001
Lead auditor

3. Agenda
• What is Ransomware?
• What is Crypto Ransomware?
• Famous Ransomwares
• Evasion Techniques
• How to avoid Ransomware

5. What is Ransomware?
• Loss of access
• Fear
• Demands money
• Old
• Revenue generation

6. Reveton
Source: http://malware.dontneedcoffee.com/2015/02/RevetonWinter2015.html

7. What is Crypto Ransomware?
http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=502676

8. GPCode or PGP Coder
https://securelist.com/blog/virus-watch/29909/malicious-encryption-programs/

9. Timeline
2004 | 2006 | 2012 | 2013 | Sep | Dec | 2014 | Mar | Aug | 2015 | Jan | Feb | Apr | May
GPCode
GPCode
MayArchive
Cryzip
Decrypt
Protect
CryptoLocker
CryptoLocker
2.0
Crypto
Defense
SimpLocker
TorrentLocker
CTB Locker
Cryptographic
locker
Ransomweb
TeslaCrypt
CryptoFortress
Tox
AlphaCrypt

10. CryptoLocker
• Born September
2013
• 500,000 infections
• USD 27 million
• Home users,
Businesses, Public
agencies
• Advanced Encryption
Standard

11. CryptoLocker
Step 1 Step 2

12. CryptoLocker Take Down
Source: http://www.geek.com/microsoft/operation-tovar-takes-down-infamous-botnet-and-ransomware-1595573/

13. TOR hidden services

14. Payment Channels

15. CryptoLocker Copycats
• CryptoWall
• CTB Locker
• TeslaCrypt
• CryptoFortress

16. Mode of operation
Step6
Step 2

17. Method of execution
1. Drops executable in users %AppData% and
%LocalAppData% folder
2. Create registry keys to maintain persistence
3. Search for specific file types
4. Performs encryption
5. Deletes Volume Shadow copies
6. Displays ransom note

18. Evasion Techniques
Process level
CreateProcess
WriteProcessMemory
CreateRemoteThread
IP address
taskmgr, procexp, regedit,
msconfig, cmd.exe

19. Evasion Techniques
Network level
RC4
TOR
I2P
HTTPS
http://www.malware-traffic-analysis.net/2015/07/20/

20. Evasion Techniques
Binary level
Obfuscated
GetCurrentProcess()
IsDebuggerPresent()
OutputDebugString()
Source: http://researchcenter.paloaltonetworks.com/2015/10/latest-teslacrypt-ransomware-borrows-code-from-carberp-trojan/

21. Encryption Methods
• Custom algorithm
• AES + Electronic Codebook (ECB) + RSA
• AES + Cipher Block Chaining (CBC) + RSA
• AES + ECDH + RSA

22. File Access Request

23. User Access Control

24. Future of Crypto Ransomware
Source: http://thehackernews.com/2015/08/ransomware-android-smartwatch.html

25. Defending your business
• User awareness
• Unsolicited email attachments
• Threat Intelligence feeds to follow blacklist IPs
• Anomalies in network traffic
• File system and registry key changes
• Limit access and periodic backup

26. Thank you…