20160419 網路星期二：天啊，我的資料被誰加密了？
Report
Net Tuesday TaiwanFollow
May. 20, 2016•0 likes•2,684 views
2 likes
Be the first to like this
Show More
views
Total views
0
On Slideshare
0
From embeds
0
Number of embeds
0
Check these out next
![[ENG] Zombie browsers spiced with rootkit extensions - Hacktivity 2012](https://cdn.slidesharecdn.com/ss_thumbnails/hacktivityonly-121013141039-phpapp02-thumbnail.jpg?width=600&height=600&fit=bounds)
20160419 網路星期二：天啊，我的資料被誰加密了？
May. 20, 2016•0 likes•2,684 views
2 likes
Be the first to like this
Show More
views
Total views
0
On Slideshare
0
From embeds
0
Number of embeds
0
Download to read offline
Report
Internet
台北市某公司會計人員，誤點了免費中獎 iPhone 釣魚郵件，導致伺服器上的資料被勒索軟體CryptoLocker加密，結果當事人與主管都調離現職。 根據2015年金毒獎票選：「勒索軟體肆虐台灣」公認為今年最驚世駭俗的資安攻擊事件！ 勒索軟體 (ransomware) 的災情相當廣，大眾也苦無應對措施。往往單位內一個人中獎了，就會陷整個組織於極大的危險當中。 面對這樣的攻擊，除了自認倒楣給予贖金，好像沒有其他條路。有了一次，卻也難保沒有第二次。難道勒索病毒會是終結這個資訊時代的最終兵器嗎？還是讓大眾重視資安的一展明燈呢？ 應對攻擊最好的辦法，就是了解他。 這場講座會先介紹什麼是勒索軟體，它是怎麼進行攻擊的，以及我們該如何自保。 大家快來一起學學如何防範吧！
Net Tuesday TaiwanFollow
Recommended
Principles of Virality: a Portent U Webinar by Sara LingafelterSara Lingafelter
SEO Tales of Horror Turned Happy Endings with SEO Best PracticesGainesvillePR
NPTsBrandon Levene
Hackers are innocentdanish3
Social Zombies II: Your Friends Need More BrainsTom Eston
Keith J. Jones, Ph.D. - Crash Course malware analysisKeith Jones, PhD
20160419 網路星期二：天啊，我的資料被誰加密了？
- Allen Own allenown@devco.re
- http://en.wikipedia.org/wiki/Liebig's_law_of_the_minimum
- WHO WHY WHAT WHOM WHERE WHEN HOW HOW MUCH
- WHO
- WHY
- WHAT
- WHOM
- WHERE
- Ref: https://www.facebook.com/thehackernews/posts/1307041839309686
- WHEN
- HOW
- HOW MUCH
- HOW MUCH
- 黑色產業
- • Malware Malicious Software •
- • • • •
- • Virus • Worm • Backdoor • Exploit • Trojan • Rootkit • HackTool • Spyware • Macros • Scripts
- Virus • • • • CIH
- Worm • • • • Blaster
- Backdoor • • Web web shell
- Exploit • •
- Trojan • • • Keylog • Poison Ivy
- Rootkit • • • Sony BMG CD rootkit
- HackTool • • • • Nmap John the Ripper
- Spyware • • • • 3721
- Macro • Microsoft Office • • • Taiwan No.1
- Script • Script VBS JS BAT PHP Python •
- • • • •
- • • • • • •
- • • • USB • • E-mail •
- • – – • – • DLL Injection API Hooking
- • – UPX http://upx.sourceforge.net/ – ASPack http://www.aspack.com/ • – ASProtect http://www.aspack.com/ – Themida http://www.oreans.com/
- • – Registry – – Services – – Ini – Inf – DLL Hijacking – WMI –
- • • •
- • Gpcode.ak ._CRYPT READ ME!.txt
- Sysinternals • http://technet.microsoft.com/sysinternals • Process Explorer • Process Monitor • Autoruns • TCPView
- Process Explorer
- Process Monitor
- Autoruns
- TCPView
- Sandboxie • http://www.sandboxie.com/
- IDA Pro • http://www.hex-rays.com/idapro/
- Ollydbg • http://www.ollydbg.de/
- GFI Sandbox (CWSandbox) • http://www.threattrack.com/
- VirusTotal • http://www.virustotal.com/
- https://youtu.be/Sm5TbBKeFvU
- AABBC CDDEE password !@#%$ %^&# $^&^% AABBC CDDEE password !@#%$ %^&# $^&^%
- AABBC CDDEE !@#%$ %^&# $^&^% AABBC CDDEE !@#%$ %^&# $^&^%
- AABBC CDDEE !@#%$ %^&# $^&^% AABBC CDDEE !@#%$ %^&# $^&^% Public Key Private Key
- https://blockchain.info/address/19PYBCFK7UoR8PMhhoB8M4gwCPAPXUL3xr