SlideShare a Scribd company logo

Ransomware: Emergence of the Cyber-Extortion Menace

•Download as PPTX, PDF•
•
Zubair Baig
Zubair Baig

A talk given at the ECU Security Conference - 2015

Science
1 of 29
Security Research Institute Edith Cowan University Ransomware Emergence of the Cyber-Extortion Menace Nikolai Hampton1 and Zubair A. Baig1,2 School of Computer and Security Science1, Security Research Institute2 Edith Cowan University Perth, Australia nikolaih@our.ecu.edu.au, z.baig@ecu.edu.au December, 2015
Security Research Institute Edith Cowan University Ransomware – What is it? Ransomware: (noun)… “Ransomware is a type of malware that prevents or limits users from accessing their system. This type of malware forces its victims to pay the ransom through certain online payment methods in order to grant access to their systems, or to get their data back.” (TrendMicro, n.d.)
Security Research Institute Edith Cowan University It’s a hot topic…
Security Research Institute Edith Cowan University Some history • PC CYBORG (AIDS) Ransomware emerged in 1989. Distributed on floppy disks… Source: https://commons.wikimedia.org/wiki/File:Floppy_disk_2009_G1.jpg Anyone remember these?
Security Research Institute Edith Cowan University Some history • PC CYBORG (AIDS Disk) – Emerged in 1989. Distributed on floppy disks – Installed from Trojan software – Lay dormant to allow time for propagation – Used operating basic encryption and operating system quirks to “scramble” and hide files – Demanded a “License Payment” to be sent via cheque to a post office box in Panama
Security Research Institute Edith Cowan University Some history • PC CYBORG (AIDS) - 1989 – Not very successful – Technology was lagging behind the idea
Security Research Institute Edith Cowan University Some history • Malware continued to develop 1990s – 2000s – Identity theft – Phishing scams, stealing passwords – Bot Nets – Networks of compromised PCs – Adware …but where was ransomware?
Security Research Institute Edith Cowan University Some history Where’s Ransomware 1990s-2000s Very small percent of Malware! Too complicated, how to get money? Too risky, how to stay hidden? Too weak, how to “Denial of Service” an uncontrolled PC? Occasional “fake” ransom, or Anti Virus, easily defeated / removed Occasional “locker” that affected boot process, easily defeated / removed (CC) BitDefender España (2010) Source: https://www.flickr.com/photos/bitdefenderes/4292753852 Source: http://www.acma.gov.au/~/media/mediacomms/Social%20Media/Images/Ransomware%20Screenshot%20jpg.jpg Australian Communication and MediaAuthority (2013)
Security Research Institute Edith Cowan University Why is it important now? • In 2010, something changed… Google search trends “ransomware” searches 2008 to 2015 • In 2012, something changed, a lot!
Security Research Institute Edith Cowan University Reality Check - Perspective Google search trends “ransomware” searches 2008 to 2015 Google search trends “ransomware” searches vs “malware” searches 2008 to 2015
Security Research Institute Edith Cowan University So it’s just a pest? • At the moment yes, but it’s getting a lot of coverage.
Security Research Institute Edith Cowan University Why is it important now? • Technology has caught up to the idea! Step 1: Idea! Ransom money from people! Step 3: Profit… Step 2: Use technology to enable the idea! Image: Jodi Meadows (2011), Flickr https://www.flickr.com/photos/69585952@N00/
Security Research Institute Edith Cowan University The perfect storm • Technology has caught up to the idea! – CTB Locker: Curve, TOR, Bitcoin  Strong encryption  Anonymity  Untraceable crypto-cash payments
Security Research Institute Edith Cowan University So, here we are – our research Ransomware Emergence of the Cyber-Extortion Menace
Security Research Institute Edith Cowan University Aim • Understand the ransomware threat… • Lay the foundation for extrapolating future ransomware development • Focus on the ransomware payload separately from the dropper • Extend existing research and ideas Young, A., & Yung, M. (1996). Cryptovirology: Extortion-Based Security Threats and Countermeasures.
Security Research Institute Edith Cowan University What we did… • Propose a nomenclature for ransomware “traits” • Record the history and traits of ransomware strains over time • Developed a ransomware traits database • Chart the inclusion / exclusion of traits over time • Examine which traits have conferred benefits – Impact – Longevity – Profitability (for the attackers)
Security Research Institute Edith Cowan University What we did…
Security Research Institute Edith Cowan University What we did… • An overview of ransomware examined: – Twenty-nine variants – Nine ransomware families (PC Cyborg, GPCode, Reveton, CryptoLocker, CryptoDefense,CryptoWall, CTB-Locker, TeslaCrypt) – Twenty-two traits examined (Encrypts, Strong Cypher, PKI, Autonomous, TOR…)
Security Research Institute Edith Cowan University Results Complete√ X O Broken Partial Traits Expressed
Security Research Institute Edith Cowan University Results • Increasing use of security technology over time.. 0 2 4 6 8 10 12 14 < 2004 2004-2005 2006-2007 2008-2009 2010-2011 2012-2013 2014+ Ransomware strains surveyed and use of new technologies # of strains surveyed Bitcoin Uptake TOR Uptake
Security Research Institute Edith Cowan University Evolution of GPCode’s encryption GPCode 2004 Used one byte encryption key, easily defeated Electronic payments GPCode.ac (June 2005) Implemented RSA Public Key Cryptography (PKI) Very weak key (56bit RSA modulus = 7 bit symmetric key) GPCode.ad (April 2006) Longer RSA keys but still poor PKI implementation GPCode.ag (June 2006) Finally, a strong RSA key (660 bit = ~60 bit symmetric) Cracked by Kaspersky, probably a coding error in .ag GPCode.ak (June 2008) Properly implemented 1024 bit RSA key Failed due to implementation of wrong “cipher” RC4, vulnerable to cryptanalysis GPCode.ax (December 2010) – A copycat… Unbreakable encryption … but still can be stopped (it has flaws)
Security Research Institute Edith Cowan University Evolution of Command and Control • GPCode (2004) – No C&C (C2) Server, just “did its thing” – Contact malware producer via email for unlock code • Reveton (2012) – Doesn’t encrypt but uses C2 server for ‘unlock’ • Cryptolocker (2013) – Uses C2 server, to retrieve RSA public key (much more secure) – Pseudo Random “Domain Generation Algorithm” (DGA) to avoid easy takedowns (contacts garbage URLs: xxgrradvvzcfyx.biz) • Cryptowall (2014) – Uses C2 server on TOR – hidden and anonymous network! – Improved DGA to make takedown even harder
Security Research Institute Edith Cowan University New command and control Compromised System Encrypted I2P‘darknet’link AnonymousC2 Server Upload infected PC details (registration) Acknowledgement Initialisation Download encryption key request Public key response Request for ransom image and text resources Image and decryption text instructions Dataencryption/ destruction begins Keyverificationandimport usingWindowscryptoAPIs CryptoWall execution I2Pproxy connection to C2 server I2P proxy Malspam or Angler EK Dropper * * Angler Exploit Kit may use single phase malware installation without dropper ! ! ! ! ! ! potential contact points for attack disruption © Ni kol ai Hampt on, 2015 - Thi s wor k i s l i cens ed under CC BY ( ht t p: / / cr eat i vecommons . or g/ l i cens es / by/ 3. 0/ )
Security Research Institute Edith Cowan University What does it mean? • Ransomware is evolving • Responding to new defences • Profit Virus Image CC BY 2.0 Flickr: NIAID https://www.flickr.com/photos/niaid/
Security Research Institute Edith Cowan University Breaking broken news • CryptoWall 4.0 – New traits (filename scrambling) – Obliterates restore points – Improved network security evasion
Security Research Institute Edith Cowan University What can users do? • Classic Defense-In-Depth approach – Multi Layer – Device Protection – Network Protection • Backups – Still good, but…
Security Research Institute Edith Cowan University Future work and questions? • Opportunity to apply some funky statistics – Through trait impact analysis – BIA/Longevity/Destructiveness Index • Machine learning (pattern recognition) • Improve the naming and reporting of ransomware • Collective collaboration
Security Research Institute Edith Cowan University Conclusion • We examined the ransomware threat and the emergence of traits over the last 26 years • We were able to identify evolutionary patterns in most strains • Given the changing risk/reward structure it’s hard to believe this isn’t going to get much bigger • This shows it is a threat we can not dismiss
Security Research Institute Edith Cowan University Thanks for your time! ?

Recommended

Ransomware: How to avoid a crypto crisis at your IT business
Ransomware: How to avoid a crypto crisis at your IT businessRansomware: How to avoid a crypto crisis at your IT business
Ransomware: How to avoid a crypto crisis at your IT business
Calyptix Security
 
Ransomware - The Growing Threat
Ransomware - The Growing ThreatRansomware - The Growing Threat
Ransomware - The Growing Threat
Nick Miller
 
Malware's Most Wanted: CryptoLocker—The Ransomware Trojan
Malware's Most Wanted: CryptoLocker—The Ransomware TrojanMalware's Most Wanted: CryptoLocker—The Ransomware Trojan
Malware's Most Wanted: CryptoLocker—The Ransomware Trojan
Cyphort
 
Blackhat USA 2014 - The New Scourge of Ransomware
Blackhat USA 2014 - The New Scourge of RansomwareBlackhat USA 2014 - The New Scourge of Ransomware
Blackhat USA 2014 - The New Scourge of Ransomware
John Bambenek
 
Ransomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, PreventionRansomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, Prevention
Mohammad Yahya
 
Ransomware: History, Analysis, & Mitigation - PDF
Ransomware: History, Analysis, & Mitigation - PDFRansomware: History, Analysis, & Mitigation - PDF
Ransomware: History, Analysis, & Mitigation - PDF
Andy Thompson
 
Ransomware: Mitigation Through Preparation
Ransomware: Mitigation Through PreparationRansomware: Mitigation Through Preparation
Ransomware: Mitigation Through Preparation
Hostway|HOSTING
 
Ransomware
RansomwareRansomware
Ransomware
Akshita Pillai
 

Recommended

Ransomware: How to avoid a crypto crisis at your IT business
Ransomware: How to avoid a crypto crisis at your IT businessRansomware: How to avoid a crypto crisis at your IT business
Ransomware: How to avoid a crypto crisis at your IT business
Calyptix Security
 
Ransomware - The Growing Threat
Ransomware - The Growing ThreatRansomware - The Growing Threat
Ransomware - The Growing Threat
Nick Miller
 
Malware's Most Wanted: CryptoLocker—The Ransomware Trojan
Malware's Most Wanted: CryptoLocker—The Ransomware TrojanMalware's Most Wanted: CryptoLocker—The Ransomware Trojan
Malware's Most Wanted: CryptoLocker—The Ransomware Trojan
Cyphort
 
Blackhat USA 2014 - The New Scourge of Ransomware
Blackhat USA 2014 - The New Scourge of RansomwareBlackhat USA 2014 - The New Scourge of Ransomware
Blackhat USA 2014 - The New Scourge of Ransomware
John Bambenek
 
Ransomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, PreventionRansomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, Prevention
Mohammad Yahya
 
Ransomware: History, Analysis, & Mitigation - PDF
Ransomware: History, Analysis, & Mitigation - PDFRansomware: History, Analysis, & Mitigation - PDF
Ransomware: History, Analysis, & Mitigation - PDF
Andy Thompson
 
Ransomware: Mitigation Through Preparation
Ransomware: Mitigation Through PreparationRansomware: Mitigation Through Preparation
Ransomware: Mitigation Through Preparation
Hostway|HOSTING
 
Ransomware
RansomwareRansomware
Ransomware
Akshita Pillai
 
WHITE PAPER▶ The Evolution of Ransomware
WHITE PAPER▶ The Evolution of RansomwareWHITE PAPER▶ The Evolution of Ransomware
WHITE PAPER▶ The Evolution of Ransomware
Symantec
 
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Roger Hagedorn
 
Ransomware hostage rescue manual
Ransomware hostage rescue manualRansomware hostage rescue manual
Ransomware hostage rescue manual
Roel Palmaers
 
Ransomware
Ransomware Ransomware
Ransomware
Armor
 
Advantage Technology - Ransomware and the NIST Cybersecurity Framework
Advantage Technology - Ransomware and the NIST Cybersecurity FrameworkAdvantage Technology - Ransomware and the NIST Cybersecurity Framework
Advantage Technology - Ransomware and the NIST Cybersecurity Framework
Jack Shaffer
 
Ransomware attacks 2017
Ransomware attacks 2017Ransomware attacks 2017
Ransomware attacks 2017
Thesis Scientist Private Limited
 
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CKSymantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec
 
The rise of malware(ransomware)
The rise of malware(ransomware)The rise of malware(ransomware)
The rise of malware(ransomware)
phexcom1
 
Analysing Ransomware
Analysing RansomwareAnalysing Ransomware
Analysing Ransomware
Napier University
 
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
ClearDATACloud
 
Ransomware by lokesh
Ransomware by lokeshRansomware by lokesh
Ransomware by lokesh
Lokesh Bysani
 
What is wanna cry ransomware attack
What is wanna cry ransomware attackWhat is wanna cry ransomware attack
What is wanna cry ransomware attack
i-engage
 
"There's a pot of Bitcoins behind the ransomware rainbow"
"There's a pot of Bitcoins behind the ransomware rainbow""There's a pot of Bitcoins behind the ransomware rainbow"
"There's a pot of Bitcoins behind the ransomware rainbow"
Christiaan Beek
 
Ransomware Attack
Ransomware AttackRansomware Attack
Ransomware Attack
doiss delhi
 
What is Ransomware? A Quick Guide
What is Ransomware? A Quick GuideWhat is Ransomware? A Quick Guide
What is Ransomware? A Quick Guide
Sarah Roberts
 
Enterprise security: ransomware in enterprise and corporate entities
Enterprise security: ransomware in enterprise and corporate entitiesEnterprise security: ransomware in enterprise and corporate entities
Enterprise security: ransomware in enterprise and corporate entities
Quick Heal Technologies Ltd.
 
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Andrew Morris
 
CSF18 - Guarding Against the Unknown - Rafael Narezzi
CSF18 - Guarding Against the Unknown - Rafael NarezziCSF18 - Guarding Against the Unknown - Rafael Narezzi
CSF18 - Guarding Against the Unknown - Rafael Narezzi
NCCOMMS
 
CSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
CSF18 - The Digital Threat of the Decade (Century) - Sasha KranjacCSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
CSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
NCCOMMS
 
How to stay protected against ransomware
How to stay protected against ransomwareHow to stay protected against ransomware
How to stay protected against ransomware
Sophos Benelux
 
Info sec 12 v1 2
Info sec 12 v1 2Info sec 12 v1 2
Info sec 12 v1 2
Prof John Walker FRSA Purveyor Dark Intelligence
 
Cyber handbook enterprise v1.6
Cyber handbook enterprise v1.6Cyber handbook enterprise v1.6
Cyber handbook enterprise v1.6
hymasakhamuri
 

More Related Content

What's hot

WHITE PAPER▶ The Evolution of Ransomware
WHITE PAPER▶ The Evolution of RansomwareWHITE PAPER▶ The Evolution of Ransomware
WHITE PAPER▶ The Evolution of Ransomware
Symantec
 
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Roger Hagedorn
 
Ransomware hostage rescue manual
Ransomware hostage rescue manualRansomware hostage rescue manual
Ransomware hostage rescue manual
Roel Palmaers
 
Ransomware
Ransomware Ransomware
Ransomware
Armor
 
Advantage Technology - Ransomware and the NIST Cybersecurity Framework
Advantage Technology - Ransomware and the NIST Cybersecurity FrameworkAdvantage Technology - Ransomware and the NIST Cybersecurity Framework
Advantage Technology - Ransomware and the NIST Cybersecurity Framework
Jack Shaffer
 
Ransomware attacks 2017
Ransomware attacks 2017Ransomware attacks 2017
Ransomware attacks 2017
Thesis Scientist Private Limited
 
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CKSymantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec
 
The rise of malware(ransomware)
The rise of malware(ransomware)The rise of malware(ransomware)
The rise of malware(ransomware)
phexcom1
 
Analysing Ransomware
Analysing RansomwareAnalysing Ransomware
Analysing Ransomware
Napier University
 
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
ClearDATACloud
 
Ransomware by lokesh
Ransomware by lokeshRansomware by lokesh
Ransomware by lokesh
Lokesh Bysani
 
What is wanna cry ransomware attack
What is wanna cry ransomware attackWhat is wanna cry ransomware attack
What is wanna cry ransomware attack
i-engage
 
"There's a pot of Bitcoins behind the ransomware rainbow"
"There's a pot of Bitcoins behind the ransomware rainbow""There's a pot of Bitcoins behind the ransomware rainbow"
"There's a pot of Bitcoins behind the ransomware rainbow"
Christiaan Beek
 
Ransomware Attack
Ransomware AttackRansomware Attack
Ransomware Attack
doiss delhi
 
What is Ransomware? A Quick Guide
What is Ransomware? A Quick GuideWhat is Ransomware? A Quick Guide
What is Ransomware? A Quick Guide
Sarah Roberts
 
Enterprise security: ransomware in enterprise and corporate entities
Enterprise security: ransomware in enterprise and corporate entitiesEnterprise security: ransomware in enterprise and corporate entities
Enterprise security: ransomware in enterprise and corporate entities
Quick Heal Technologies Ltd.
 
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Andrew Morris
 
CSF18 - Guarding Against the Unknown - Rafael Narezzi
CSF18 - Guarding Against the Unknown - Rafael NarezziCSF18 - Guarding Against the Unknown - Rafael Narezzi
CSF18 - Guarding Against the Unknown - Rafael Narezzi
NCCOMMS
 
CSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
CSF18 - The Digital Threat of the Decade (Century) - Sasha KranjacCSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
CSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
NCCOMMS
 
How to stay protected against ransomware
How to stay protected against ransomwareHow to stay protected against ransomware
How to stay protected against ransomware
Sophos Benelux
 

What's hot (20)

WHITE PAPER▶ The Evolution of Ransomware
WHITE PAPER▶ The Evolution of RansomwareWHITE PAPER▶ The Evolution of Ransomware
WHITE PAPER▶ The Evolution of Ransomware
 
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
 
Ransomware hostage rescue manual
Ransomware hostage rescue manualRansomware hostage rescue manual
Ransomware hostage rescue manual
 
Ransomware
Ransomware Ransomware
Ransomware
 
Advantage Technology - Ransomware and the NIST Cybersecurity Framework
Advantage Technology - Ransomware and the NIST Cybersecurity FrameworkAdvantage Technology - Ransomware and the NIST Cybersecurity Framework
Advantage Technology - Ransomware and the NIST Cybersecurity Framework
 
Ransomware attacks 2017
Ransomware attacks 2017Ransomware attacks 2017
Ransomware attacks 2017
 
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CKSymantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
 
The rise of malware(ransomware)
The rise of malware(ransomware)The rise of malware(ransomware)
The rise of malware(ransomware)
 
Analysing Ransomware
Analysing RansomwareAnalysing Ransomware
Analysing Ransomware
 
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
 
Ransomware by lokesh
Ransomware by lokeshRansomware by lokesh
Ransomware by lokesh
 
What is wanna cry ransomware attack
What is wanna cry ransomware attackWhat is wanna cry ransomware attack
What is wanna cry ransomware attack
 
"There's a pot of Bitcoins behind the ransomware rainbow"
"There's a pot of Bitcoins behind the ransomware rainbow""There's a pot of Bitcoins behind the ransomware rainbow"
"There's a pot of Bitcoins behind the ransomware rainbow"
 
Ransomware Attack
Ransomware AttackRansomware Attack
Ransomware Attack
 
What is Ransomware? A Quick Guide
What is Ransomware? A Quick GuideWhat is Ransomware? A Quick Guide
What is Ransomware? A Quick Guide
 
Enterprise security: ransomware in enterprise and corporate entities
Enterprise security: ransomware in enterprise and corporate entitiesEnterprise security: ransomware in enterprise and corporate entities
Enterprise security: ransomware in enterprise and corporate entities
 
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
 
CSF18 - Guarding Against the Unknown - Rafael Narezzi
CSF18 - Guarding Against the Unknown - Rafael NarezziCSF18 - Guarding Against the Unknown - Rafael Narezzi
CSF18 - Guarding Against the Unknown - Rafael Narezzi
 
CSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
CSF18 - The Digital Threat of the Decade (Century) - Sasha KranjacCSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
CSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
 
How to stay protected against ransomware
How to stay protected against ransomwareHow to stay protected against ransomware
How to stay protected against ransomware
 

Similar to Ransomware: Emergence of the Cyber-Extortion Menace

Info sec 12 v1 2
Info sec 12 v1 2Info sec 12 v1 2
Info sec 12 v1 2
Prof John Walker FRSA Purveyor Dark Intelligence
 
Cyber handbook enterprise v1.6
Cyber handbook enterprise v1.6Cyber handbook enterprise v1.6
Cyber handbook enterprise v1.6
hymasakhamuri
 
Stop Watering Holes, Spear-Phishing and Drive-by Downloads
Stop Watering Holes, Spear-Phishing and Drive-by DownloadsStop Watering Holes, Spear-Phishing and Drive-by Downloads
Stop Watering Holes, Spear-Phishing and Drive-by DownloadsInvincea, Inc.
 
Scot Secure 2015
Scot Secure 2015Scot Secure 2015
Scot Secure 2015
Ray Bugg
 
2014: Mid-Year Threat Review
2014: Mid-Year Threat Review2014: Mid-Year Threat Review
2014: Mid-Year Threat Review
ESET
 
Future-proofing maritime ports against emerging cyber-physical threats
Future-proofing maritime ports against emerging cyber-physical threatsFuture-proofing maritime ports against emerging cyber-physical threats
Future-proofing maritime ports against emerging cyber-physical threats
Steven SIM Kok Leong
 
Lessons learnt from the 2012 cyber security audit of Western Australian State...
Lessons learnt from the 2012 cyber security audit of Western Australian State...Lessons learnt from the 2012 cyber security audit of Western Australian State...
Lessons learnt from the 2012 cyber security audit of Western Australian State...
Edith Cowan University
 
Functional and Behavioral Analysis of Different Type of Ransomware.pptx
Functional and Behavioral Analysis of Different Type of Ransomware.pptxFunctional and Behavioral Analysis of Different Type of Ransomware.pptx
Functional and Behavioral Analysis of Different Type of Ransomware.pptx
tarkovtarkovski
 
Tisa-Social Network and Mobile Security
Tisa-Social Network and Mobile SecurityTisa-Social Network and Mobile Security
Tisa-Social Network and Mobile SecurityPrathan Phongthiproek
 
Social and mobile tisa protalk 2 2554
Social and mobile tisa protalk 2 2554Social and mobile tisa protalk 2 2554
Social and mobile tisa protalk 2 2554TISA
 
NetWitness
NetWitnessNetWitness
NetWitness
TechBiz Forense Digital
 
Solnet dev secops meetup
Solnet dev secops meetupSolnet dev secops meetup
Solnet dev secops meetup
pbink
 
Behind the Curtain: Exposing Advanced Threats
Behind the Curtain: Exposing Advanced ThreatsBehind the Curtain: Exposing Advanced Threats
Behind the Curtain: Exposing Advanced Threats
Cisco Canada
 
Welcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat IntelligenceWelcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat Intelligence
Andreas Sfakianakis
 
UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...
UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...
UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...
APNIC
 
festival ICT 2013: Gli attacchi mirati e la Difesa Personalizzata Trend Micro
festival ICT 2013: Gli attacchi mirati e la Difesa Personalizzata Trend Microfestival ICT 2013: Gli attacchi mirati e la Difesa Personalizzata Trend Micro
festival ICT 2013: Gli attacchi mirati e la Difesa Personalizzata Trend Microfestival ICT 2016
 
[Bucharest] Attack is easy, let's talk defence
[Bucharest] Attack is easy, let's talk defence[Bucharest] Attack is easy, let's talk defence
[Bucharest] Attack is easy, let's talk defence
OWASP EEE
 
Developing a Protection Profile for Smart TV
Developing a Protection Profile for Smart TVDeveloping a Protection Profile for Smart TV
Developing a Protection Profile for Smart TV
Seungjoo Kim
 

Similar to Ransomware: Emergence of the Cyber-Extortion Menace (20)

Info sec 12 v1 2
Info sec 12 v1 2Info sec 12 v1 2
Info sec 12 v1 2
 
Cyber handbook enterprise v1.6
Cyber handbook enterprise v1.6Cyber handbook enterprise v1.6
Cyber handbook enterprise v1.6
 
Stop Watering Holes, Spear-Phishing and Drive-by Downloads
Stop Watering Holes, Spear-Phishing and Drive-by DownloadsStop Watering Holes, Spear-Phishing and Drive-by Downloads
Stop Watering Holes, Spear-Phishing and Drive-by Downloads
 
Scot Secure 2015
Scot Secure 2015Scot Secure 2015
Scot Secure 2015
 
2014: Mid-Year Threat Review
2014: Mid-Year Threat Review2014: Mid-Year Threat Review
2014: Mid-Year Threat Review
 
Future-proofing maritime ports against emerging cyber-physical threats
Future-proofing maritime ports against emerging cyber-physical threatsFuture-proofing maritime ports against emerging cyber-physical threats
Future-proofing maritime ports against emerging cyber-physical threats
 
Lessons learnt from the 2012 cyber security audit of Western Australian State...
Lessons learnt from the 2012 cyber security audit of Western Australian State...Lessons learnt from the 2012 cyber security audit of Western Australian State...
Lessons learnt from the 2012 cyber security audit of Western Australian State...
 
Functional and Behavioral Analysis of Different Type of Ransomware.pptx
Functional and Behavioral Analysis of Different Type of Ransomware.pptxFunctional and Behavioral Analysis of Different Type of Ransomware.pptx
Functional and Behavioral Analysis of Different Type of Ransomware.pptx
 
Tisa-Social Network and Mobile Security
Tisa-Social Network and Mobile SecurityTisa-Social Network and Mobile Security
Tisa-Social Network and Mobile Security
 
Social and mobile tisa protalk 2 2554
Social and mobile tisa protalk 2 2554Social and mobile tisa protalk 2 2554
Social and mobile tisa protalk 2 2554
 
Tisa social and mobile security
Tisa social and mobile securityTisa social and mobile security
Tisa social and mobile security
 
NetWitness
NetWitnessNetWitness
NetWitness
 
Solnet dev secops meetup
Solnet dev secops meetupSolnet dev secops meetup
Solnet dev secops meetup
 
Behind the Curtain: Exposing Advanced Threats
Behind the Curtain: Exposing Advanced ThreatsBehind the Curtain: Exposing Advanced Threats
Behind the Curtain: Exposing Advanced Threats
 
Welcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat IntelligenceWelcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat Intelligence
 
UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...
UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...
UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...
 
Super1
Super1Super1
Super1
 
festival ICT 2013: Gli attacchi mirati e la Difesa Personalizzata Trend Micro
festival ICT 2013: Gli attacchi mirati e la Difesa Personalizzata Trend Microfestival ICT 2013: Gli attacchi mirati e la Difesa Personalizzata Trend Micro
festival ICT 2013: Gli attacchi mirati e la Difesa Personalizzata Trend Micro
 
[Bucharest] Attack is easy, let's talk defence
[Bucharest] Attack is easy, let's talk defence[Bucharest] Attack is easy, let's talk defence
[Bucharest] Attack is easy, let's talk defence
 
Developing a Protection Profile for Smart TV
Developing a Protection Profile for Smart TVDeveloping a Protection Profile for Smart TV
Developing a Protection Profile for Smart TV
 

Recently uploaded

Body fluids_tonicity_dehydration_hypovolemia_hypervolemia.pptx
Body fluids_tonicity_dehydration_hypovolemia_hypervolemia.pptxBody fluids_tonicity_dehydration_hypovolemia_hypervolemia.pptx
Body fluids_tonicity_dehydration_hypovolemia_hypervolemia.pptx
muralinath2
 
Nucleic Acid-its structural and functional complexity.
Nucleic Acid-its structural and functional complexity.Nucleic Acid-its structural and functional complexity.
Nucleic Acid-its structural and functional complexity.
Nistarini College, Purulia (W.B) India
 
Richard's entangled aventures in wonderland
Richard's entangled aventures in wonderlandRichard's entangled aventures in wonderland
Richard's entangled aventures in wonderland
Richard Gill
 
In silico drugs analogue design: novobiocin analogues.pptx
In silico drugs analogue design: novobiocin analogues.pptxIn silico drugs analogue design: novobiocin analogues.pptx
In silico drugs analogue design: novobiocin analogues.pptx
AlaminAfendy1
 
GBSN- Microbiology (Lab 3) Gram Staining
GBSN- Microbiology (Lab 3) Gram StainingGBSN- Microbiology (Lab 3) Gram Staining
GBSN- Microbiology (Lab 3) Gram Staining
Areesha Ahmad
 
filosofia boliviana introducción jsjdjd.pptx
filosofia boliviana introducción jsjdjd.pptxfilosofia boliviana introducción jsjdjd.pptx
filosofia boliviana introducción jsjdjd.pptx
IvanMallco1
 
platelets- lifespan -Clot retraction-disorders.pptx
platelets- lifespan -Clot retraction-disorders.pptxplatelets- lifespan -Clot retraction-disorders.pptx
platelets- lifespan -Clot retraction-disorders.pptx
muralinath2
 
Seminar of U.V. Spectroscopy by SAMIR PANDA
Seminar of U.V. Spectroscopy by SAMIR PANDA Seminar of U.V. Spectroscopy by SAMIR PANDA
Seminar of U.V. Spectroscopy by SAMIR PANDA
SAMIR PANDA
 
What is greenhouse gasses and how many gasses are there to affect the Earth.
What is greenhouse gasses and how many gasses are there to affect the Earth.What is greenhouse gasses and how many gasses are there to affect the Earth.
What is greenhouse gasses and how many gasses are there to affect the Earth.
moosaasad1975
 
Circulatory system_ Laplace law. Ohms law.reynaults law,baro-chemo-receptors-...
Circulatory system_ Laplace law. Ohms law.reynaults law,baro-chemo-receptors-...Circulatory system_ Laplace law. Ohms law.reynaults law,baro-chemo-receptors-...
Circulatory system_ Laplace law. Ohms law.reynaults law,baro-chemo-receptors-...
muralinath2
 
Comparing Evolved Extractive Text Summary Scores of Bidirectional Encoder Rep...
Comparing Evolved Extractive Text Summary Scores of Bidirectional Encoder Rep...Comparing Evolved Extractive Text Summary Scores of Bidirectional Encoder Rep...
Comparing Evolved Extractive Text Summary Scores of Bidirectional Encoder Rep...
University of Maribor
 
Citrus Greening Disease and its Management
Citrus Greening Disease and its ManagementCitrus Greening Disease and its Management
Citrus Greening Disease and its Management
subedisuryaofficial
 
Structures and textures of metamorphic rocks
Structures and textures of metamorphic rocksStructures and textures of metamorphic rocks
Structures and textures of metamorphic rocks
kumarmathi863
 
GBSN - Microbiology (Lab 4) Culture Media
GBSN - Microbiology (Lab 4) Culture MediaGBSN - Microbiology (Lab 4) Culture Media
GBSN - Microbiology (Lab 4) Culture Media
Areesha Ahmad
 
EY - Supply Chain Services 2018_template.pptx
EY - Supply Chain Services 2018_template.pptxEY - Supply Chain Services 2018_template.pptx
EY - Supply Chain Services 2018_template.pptx
AlguinaldoKong
 
THE IMPORTANCE OF MARTIAN ATMOSPHERE SAMPLE RETURN.
THE IMPORTANCE OF MARTIAN ATMOSPHERE SAMPLE RETURN.THE IMPORTANCE OF MARTIAN ATMOSPHERE SAMPLE RETURN.
THE IMPORTANCE OF MARTIAN ATMOSPHERE SAMPLE RETURN.
Sérgio Sacani
 
Hemostasis_importance& clinical significance.pptx
Hemostasis_importance& clinical significance.pptxHemostasis_importance& clinical significance.pptx
Hemostasis_importance& clinical significance.pptx
muralinath2
 
4. An Overview of Sugarcane White Leaf Disease in Vietnam.pdf
4. An Overview of Sugarcane White Leaf Disease in Vietnam.pdf4. An Overview of Sugarcane White Leaf Disease in Vietnam.pdf
4. An Overview of Sugarcane White Leaf Disease in Vietnam.pdf
ssuserbfdca9
 
Unveiling the Energy Potential of Marshmallow Deposits.pdf
Unveiling the Energy Potential of Marshmallow Deposits.pdfUnveiling the Energy Potential of Marshmallow Deposits.pdf
Unveiling the Energy Potential of Marshmallow Deposits.pdf
Erdal Coalmaker
 
Lab report on liquid viscosity of glycerin
Lab report on liquid viscosity of glycerinLab report on liquid viscosity of glycerin
Lab report on liquid viscosity of glycerin
ossaicprecious19
 

Recently uploaded (20)

Body fluids_tonicity_dehydration_hypovolemia_hypervolemia.pptx
Body fluids_tonicity_dehydration_hypovolemia_hypervolemia.pptxBody fluids_tonicity_dehydration_hypovolemia_hypervolemia.pptx
Body fluids_tonicity_dehydration_hypovolemia_hypervolemia.pptx
 
Nucleic Acid-its structural and functional complexity.
Nucleic Acid-its structural and functional complexity.Nucleic Acid-its structural and functional complexity.
Nucleic Acid-its structural and functional complexity.
 
Richard's entangled aventures in wonderland
Richard's entangled aventures in wonderlandRichard's entangled aventures in wonderland
Richard's entangled aventures in wonderland
 
In silico drugs analogue design: novobiocin analogues.pptx
In silico drugs analogue design: novobiocin analogues.pptxIn silico drugs analogue design: novobiocin analogues.pptx
In silico drugs analogue design: novobiocin analogues.pptx
 
GBSN- Microbiology (Lab 3) Gram Staining
GBSN- Microbiology (Lab 3) Gram StainingGBSN- Microbiology (Lab 3) Gram Staining
GBSN- Microbiology (Lab 3) Gram Staining
 
filosofia boliviana introducción jsjdjd.pptx
filosofia boliviana introducción jsjdjd.pptxfilosofia boliviana introducción jsjdjd.pptx
filosofia boliviana introducción jsjdjd.pptx
 
platelets- lifespan -Clot retraction-disorders.pptx
platelets- lifespan -Clot retraction-disorders.pptxplatelets- lifespan -Clot retraction-disorders.pptx
platelets- lifespan -Clot retraction-disorders.pptx
 
Seminar of U.V. Spectroscopy by SAMIR PANDA
Seminar of U.V. Spectroscopy by SAMIR PANDA Seminar of U.V. Spectroscopy by SAMIR PANDA
Seminar of U.V. Spectroscopy by SAMIR PANDA
 
What is greenhouse gasses and how many gasses are there to affect the Earth.
What is greenhouse gasses and how many gasses are there to affect the Earth.What is greenhouse gasses and how many gasses are there to affect the Earth.
What is greenhouse gasses and how many gasses are there to affect the Earth.
 
Circulatory system_ Laplace law. Ohms law.reynaults law,baro-chemo-receptors-...
Circulatory system_ Laplace law. Ohms law.reynaults law,baro-chemo-receptors-...Circulatory system_ Laplace law. Ohms law.reynaults law,baro-chemo-receptors-...
Circulatory system_ Laplace law. Ohms law.reynaults law,baro-chemo-receptors-...
 
Comparing Evolved Extractive Text Summary Scores of Bidirectional Encoder Rep...
Comparing Evolved Extractive Text Summary Scores of Bidirectional Encoder Rep...Comparing Evolved Extractive Text Summary Scores of Bidirectional Encoder Rep...
Comparing Evolved Extractive Text Summary Scores of Bidirectional Encoder Rep...
 
Citrus Greening Disease and its Management
Citrus Greening Disease and its ManagementCitrus Greening Disease and its Management
Citrus Greening Disease and its Management
 
Structures and textures of metamorphic rocks
Structures and textures of metamorphic rocksStructures and textures of metamorphic rocks
Structures and textures of metamorphic rocks
 
GBSN - Microbiology (Lab 4) Culture Media
GBSN - Microbiology (Lab 4) Culture MediaGBSN - Microbiology (Lab 4) Culture Media
GBSN - Microbiology (Lab 4) Culture Media
 
EY - Supply Chain Services 2018_template.pptx
EY - Supply Chain Services 2018_template.pptxEY - Supply Chain Services 2018_template.pptx
EY - Supply Chain Services 2018_template.pptx
 
THE IMPORTANCE OF MARTIAN ATMOSPHERE SAMPLE RETURN.
THE IMPORTANCE OF MARTIAN ATMOSPHERE SAMPLE RETURN.THE IMPORTANCE OF MARTIAN ATMOSPHERE SAMPLE RETURN.
THE IMPORTANCE OF MARTIAN ATMOSPHERE SAMPLE RETURN.
 
Hemostasis_importance& clinical significance.pptx
Hemostasis_importance& clinical significance.pptxHemostasis_importance& clinical significance.pptx
Hemostasis_importance& clinical significance.pptx
 
4. An Overview of Sugarcane White Leaf Disease in Vietnam.pdf
4. An Overview of Sugarcane White Leaf Disease in Vietnam.pdf4. An Overview of Sugarcane White Leaf Disease in Vietnam.pdf
4. An Overview of Sugarcane White Leaf Disease in Vietnam.pdf
 
Unveiling the Energy Potential of Marshmallow Deposits.pdf
Unveiling the Energy Potential of Marshmallow Deposits.pdfUnveiling the Energy Potential of Marshmallow Deposits.pdf
Unveiling the Energy Potential of Marshmallow Deposits.pdf
 
Lab report on liquid viscosity of glycerin
Lab report on liquid viscosity of glycerinLab report on liquid viscosity of glycerin
Lab report on liquid viscosity of glycerin
 

Ransomware: Emergence of the Cyber-Extortion Menace

  • 1. Security Research Institute Edith Cowan University Ransomware Emergence of the Cyber-Extortion Menace Nikolai Hampton1 and Zubair A. Baig1,2 School of Computer and Security Science1, Security Research Institute2 Edith Cowan University Perth, Australia nikolaih@our.ecu.edu.au, z.baig@ecu.edu.au December, 2015
  • 2. Security Research Institute Edith Cowan University Ransomware – What is it? Ransomware: (noun)… “Ransomware is a type of malware that prevents or limits users from accessing their system. This type of malware forces its victims to pay the ransom through certain online payment methods in order to grant access to their systems, or to get their data back.” (TrendMicro, n.d.)
  • 3. Security Research Institute Edith Cowan University It’s a hot topic…
  • 4. Security Research Institute Edith Cowan University Some history • PC CYBORG (AIDS) Ransomware emerged in 1989. Distributed on floppy disks… Source: https://commons.wikimedia.org/wiki/File:Floppy_disk_2009_G1.jpg Anyone remember these?
  • 5. Security Research Institute Edith Cowan University Some history • PC CYBORG (AIDS Disk) – Emerged in 1989. Distributed on floppy disks – Installed from Trojan software – Lay dormant to allow time for propagation – Used operating basic encryption and operating system quirks to “scramble” and hide files – Demanded a “License Payment” to be sent via cheque to a post office box in Panama
  • 6. Security Research Institute Edith Cowan University Some history • PC CYBORG (AIDS) - 1989 – Not very successful – Technology was lagging behind the idea
  • 7. Security Research Institute Edith Cowan University Some history • Malware continued to develop 1990s – 2000s – Identity theft – Phishing scams, stealing passwords – Bot Nets – Networks of compromised PCs – Adware …but where was ransomware?
  • 8. Security Research Institute Edith Cowan University Some history Where’s Ransomware 1990s-2000s Very small percent of Malware! Too complicated, how to get money? Too risky, how to stay hidden? Too weak, how to “Denial of Service” an uncontrolled PC? Occasional “fake” ransom, or Anti Virus, easily defeated / removed Occasional “locker” that affected boot process, easily defeated / removed (CC) BitDefender España (2010) Source: https://www.flickr.com/photos/bitdefenderes/4292753852 Source: http://www.acma.gov.au/~/media/mediacomms/Social%20Media/Images/Ransomware%20Screenshot%20jpg.jpg Australian Communication and MediaAuthority (2013)
  • 9. Security Research Institute Edith Cowan University Why is it important now? • In 2010, something changed… Google search trends “ransomware” searches 2008 to 2015 • In 2012, something changed, a lot!
  • 10. Security Research Institute Edith Cowan University Reality Check - Perspective Google search trends “ransomware” searches 2008 to 2015 Google search trends “ransomware” searches vs “malware” searches 2008 to 2015
  • 11. Security Research Institute Edith Cowan University So it’s just a pest? • At the moment yes, but it’s getting a lot of coverage.
  • 12. Security Research Institute Edith Cowan University Why is it important now? • Technology has caught up to the idea! Step 1: Idea! Ransom money from people! Step 3: Profit… Step 2: Use technology to enable the idea! Image: Jodi Meadows (2011), Flickr https://www.flickr.com/photos/69585952@N00/
  • 13. Security Research Institute Edith Cowan University The perfect storm • Technology has caught up to the idea! – CTB Locker: Curve, TOR, Bitcoin  Strong encryption  Anonymity  Untraceable crypto-cash payments
  • 14. Security Research Institute Edith Cowan University So, here we are – our research Ransomware Emergence of the Cyber-Extortion Menace
  • 15. Security Research Institute Edith Cowan University Aim • Understand the ransomware threat… • Lay the foundation for extrapolating future ransomware development • Focus on the ransomware payload separately from the dropper • Extend existing research and ideas Young, A., & Yung, M. (1996). Cryptovirology: Extortion-Based Security Threats and Countermeasures.
  • 16. Security Research Institute Edith Cowan University What we did… • Propose a nomenclature for ransomware “traits” • Record the history and traits of ransomware strains over time • Developed a ransomware traits database • Chart the inclusion / exclusion of traits over time • Examine which traits have conferred benefits – Impact – Longevity – Profitability (for the attackers)
  • 17. Security Research Institute Edith Cowan University What we did…
  • 18. Security Research Institute Edith Cowan University What we did… • An overview of ransomware examined: – Twenty-nine variants – Nine ransomware families (PC Cyborg, GPCode, Reveton, CryptoLocker, CryptoDefense,CryptoWall, CTB-Locker, TeslaCrypt) – Twenty-two traits examined (Encrypts, Strong Cypher, PKI, Autonomous, TOR…)
  • 19. Security Research Institute Edith Cowan University Results Complete√ X O Broken Partial Traits Expressed
  • 20. Security Research Institute Edith Cowan University Results • Increasing use of security technology over time.. 0 2 4 6 8 10 12 14 < 2004 2004-2005 2006-2007 2008-2009 2010-2011 2012-2013 2014+ Ransomware strains surveyed and use of new technologies # of strains surveyed Bitcoin Uptake TOR Uptake
  • 21. Security Research Institute Edith Cowan University Evolution of GPCode’s encryption GPCode 2004 Used one byte encryption key, easily defeated Electronic payments GPCode.ac (June 2005) Implemented RSA Public Key Cryptography (PKI) Very weak key (56bit RSA modulus = 7 bit symmetric key) GPCode.ad (April 2006) Longer RSA keys but still poor PKI implementation GPCode.ag (June 2006) Finally, a strong RSA key (660 bit = ~60 bit symmetric) Cracked by Kaspersky, probably a coding error in .ag GPCode.ak (June 2008) Properly implemented 1024 bit RSA key Failed due to implementation of wrong “cipher” RC4, vulnerable to cryptanalysis GPCode.ax (December 2010) – A copycat… Unbreakable encryption … but still can be stopped (it has flaws)
  • 22. Security Research Institute Edith Cowan University Evolution of Command and Control • GPCode (2004) – No C&C (C2) Server, just “did its thing” – Contact malware producer via email for unlock code • Reveton (2012) – Doesn’t encrypt but uses C2 server for ‘unlock’ • Cryptolocker (2013) – Uses C2 server, to retrieve RSA public key (much more secure) – Pseudo Random “Domain Generation Algorithm” (DGA) to avoid easy takedowns (contacts garbage URLs: xxgrradvvzcfyx.biz) • Cryptowall (2014) – Uses C2 server on TOR – hidden and anonymous network! – Improved DGA to make takedown even harder
  • 23. Security Research Institute Edith Cowan University New command and control Compromised System Encrypted I2P‘darknet’link AnonymousC2 Server Upload infected PC details (registration) Acknowledgement Initialisation Download encryption key request Public key response Request for ransom image and text resources Image and decryption text instructions Dataencryption/ destruction begins Keyverificationandimport usingWindowscryptoAPIs CryptoWall execution I2Pproxy connection to C2 server I2P proxy Malspam or Angler EK Dropper * * Angler Exploit Kit may use single phase malware installation without dropper ! ! ! ! ! ! potential contact points for attack disruption © Ni kol ai Hampt on, 2015 - Thi s wor k i s l i cens ed under CC BY ( ht t p: / / cr eat i vecommons . or g/ l i cens es / by/ 3. 0/ )
  • 24. Security Research Institute Edith Cowan University What does it mean? • Ransomware is evolving • Responding to new defences • Profit Virus Image CC BY 2.0 Flickr: NIAID https://www.flickr.com/photos/niaid/
  • 25. Security Research Institute Edith Cowan University Breaking broken news • CryptoWall 4.0 – New traits (filename scrambling) – Obliterates restore points – Improved network security evasion
  • 26. Security Research Institute Edith Cowan University What can users do? • Classic Defense-In-Depth approach – Multi Layer – Device Protection – Network Protection • Backups – Still good, but…
  • 27. Security Research Institute Edith Cowan University Future work and questions? • Opportunity to apply some funky statistics – Through trait impact analysis – BIA/Longevity/Destructiveness Index • Machine learning (pattern recognition) • Improve the naming and reporting of ransomware • Collective collaboration
  • 28. Security Research Institute Edith Cowan University Conclusion • We examined the ransomware threat and the emergence of traits over the last 26 years • We were able to identify evolutionary patterns in most strains • Given the changing risk/reward structure it’s hard to believe this isn’t going to get much bigger • This shows it is a threat we can not dismiss
  • 29. Security Research Institute Edith Cowan University Thanks for your time! ?

Editor's Notes

  1. This diagram explains it better than I ever could