fighting ransomware · ransomware is a type of malware which restricts access to the computer...

15

FIGHTING RANSOMWARE Ștefan Tănase, Senior Security Researcher, Kaspersky Lab Bucharest, Romania

Upload: others

Post on 01-Aug-2020

3 views

Category:

Documents

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: FIGHTING RANSOMWARE · Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in

FIGHTING

RANSOMWARE

Ștefan Tănase, Senior Security Researcher, Kaspersky Lab Bucharest,

Romania

Page 2: FIGHTING RANSOMWARE · Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in

2 |

Before we start Let me introduce myself!

Page 3: FIGHTING RANSOMWARE · Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in

3 |

GReAT

Elite threats research group.

Established in 2008, the Kaspersky Lab Global Research and Analysis Team

provides leadership in anti-threat intelligence, research and innovation.

Focus: APTs, critical infrastructure threats, banking threats, sophisticated attacks.

Page 4: FIGHTING RANSOMWARE · Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in

4 |

About myself

Ștefan Tănase - Senior Security Researcher

Joined Kaspersky Lab in 2007,

based in Bucharest, Romania.

Expert in web security, web-based

threats and sophisticated attacks.

Honeypots, web crawlers,

distributed computing, AI.

Often speaking at IT security conferences such as SAS, VB, RSA, AVAR

or IDC.

Page 5: FIGHTING RANSOMWARE · Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in

5 |

What is ransomware?

Page 6: FIGHTING RANSOMWARE · Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in

6 |

Definition

Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in order for the restriction to be removed. Some forms of ransomware encrypt files on the system's hard drive (cryptoviral extortion, a threat originally envisioned by Adam Young and Moti Yung), while some may simply lock the system and display messages intended to coax the user into paying. Source: wikipedia.org

1. System Lockers 2. Data Encoders

Page 7: FIGHTING RANSOMWARE · Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in

7 |

Why ransomware?

Page 8: FIGHTING RANSOMWARE · Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in

8 |

Ransomware: Cryptors vs Lockers

NOW BEFORE

5 years

LOCKERS CRYPTORS

Page 9: FIGHTING RANSOMWARE · Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in

9 |

Gpcode: 1st ransomware

Gpcode marked the beginning of a

new era in cyber crime

Origin: Russia

December 2004: the first variant of Gpcode

June 2005: new wave of attacks in Russia with more than 25 variants

January 2006: RSA 56 bit encryption

6 June 2006: the key length to 330 bit

7 June 2006: new variant with a key 660 bit

Page 10: FIGHTING RANSOMWARE · Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in

10 |

Cryzip/Mayarchive: forced archiving

Another blackmail technique

Creates password-protected ZIP files

Password exceed 10 characters

Ransom request $ 300

Page 11: FIGHTING RANSOMWARE · Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in

11 |

Krotten: screen blocker

Development of blackmail technique

The Trojan modifies the system registry to limit user actions

Blocking access to the registry editor and task manager

Prevent the closing of browsers

Blocks access to Files and Folders

Changes the menu contents "Start"

Blocks the launch of the prompt DOS command, etc.

Page 12: FIGHTING RANSOMWARE · Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in

12 |

Gpcode: the return

New wave of infection

June 2008: Using RSA 1024 bit

Data decryption not possible with data-recovery software such as PhotoRec

November 2010: new variants are RSA-1024 and AES-256

Page 13: FIGHTING RANSOMWARE · Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in

13 |

Fake messages lockers

Internet surfing victims

Locking full screen (or Browser) and shows a request for ransom

Geographically personalized

Personal information displayed (IP address, country, city, ISP, etc.)

Ransom request € 100

Page 14: FIGHTING RANSOMWARE · Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in

14 |

MBR ransomware

Overwrites the master boot record and demands a ransom to retrieve a password and restore the original

After 3 incorrect passwords, the machine is restarted and the same message appears

The data is not actually encrypted

Ransom request $100

Page 15: FIGHTING RANSOMWARE · Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in

15 |

OSX ransomware

Proof of Concept

No encrypted file

This ransomware encrypts its own files but does not affect those of the user

Displaying a ransom demand but the feature are inoperative

Stopping Ransomware and Polymorphic Malware Solution Brief · Malware needs an attack vector to establish its presence on an endpoint. After presence is established, malware stays

THE MSP’S GUIDE TO PROTECTING CLIENTS FROM ......Understanding the Ransomware Epidemic Ransomware, a malware that infects computers and restricts access to files in exchange for

The Best Ways to Stop Malware and Ransomware That No …

The Ongoing Malware Threat: How Malware Infects Websites and

Technical Report for “Offline” Ransomware · Technical Report for “Offline” Ransomware Stanislav Skuratovich Malware Reverse Engineering Team 20/10/2015 Overview The ransomware

Malware Infects Baseline Analysis

Ransomware: A Billion Dollars a Year Cyber Crime · Ransomware: A Billion Dollars a Year Cyber Crime Ransomware is a form of malware that renders a computer, or personal data stored

Ransomware in the Wild - Atlantic.Net · 888-618-DATA (3282) [email protected] Ransomware in the Wild 3 Ransomware is an increasingly common type of malware that infects vulnerable

MANAGING CYBER RISKS IN A PUBLIC SECTOR ENVIRONMENT · Ransomware is a specific type of malware that poses a significant threat. After ransomware infects a target system, it uses

Atasi Seragan Malware Ransomware Wannacryptnews.gunadarma.ac.id/wp-content/uploads/2017/05/Langkah-Mitigasi... · 1 LANGKAH-LANGKAH ASI Atasi Seragan Malware Ransomware Wannacrypt

Business Scams · money from unknowing computer users, businesses and banks. Ransomware is the next level of malware, which restricts access to the computer system that it infects,

Ransomware - peakresources.com...•Ransomware is Malware -Malicious software that encrypts and holds data/systems hostage for a ransom payment. •Organizations will use Bitcoin or

White Paper The Ongoing Malware Threat: How Malware Infects

THREE WAYS TO PROTECT AGAINST RANSOMWARE · Ransomware is a class of malware which restricts access to the computer system that it infects, and demands a ransom ... analysis, heuristics,

Ransomware - útok - Jiří Znoj - znoj.cz · PDF file · 2017-05-13Malvertisement •Malware advertisement •Exploit kit. Ransomware - propagace Spam emaily •Botnety •Obchod

RANSOMWARE...Ransomware 3 Malware yang melakukan serangan pemerasan cryptoviral dari cryptovirology yang memblokir akses ke data komputer sampai uang tebusan dibayarkan dan

How to Protect Your Networks from Ransomare… · Protecting Your Networks from Ransomware . Protecting Your Networks from Ransomware . Ransomware is the fastest growing malware threat,

Defeating Ransomware with Isla Web Malware Isolationinterchangegroup.com/files/IC_Cyberinc-ransomware-white_paper.pdfThe Isla Web Malware Isolation System ... Phishing attacks generally

WHAT IS RANSOMWARE AND HOW TO PROTECT …4 How ransomware infects your PC Attacks are becoming more widespread. Cyber criminals are always trying to find new and different ways to

Evaluation Metric for Crypto-Ransomware Detection Using ... · Crypto Encryption Evaluation Machine learning Metric Ransomware Detection ABSTRACT Ransomware is a type of malware that

RANSOMWARE - Europol€¦ · THE MALWARE THAT HOLDS YOUR DATA HOSTAGE FOR A PRICE RANSOMWARE PROTECT YOURSELF INFECTED? WHAT TO DO NEXT HOW DOES IT SPREAD? Ransomware prevents or

Email keeps getting us pwned - Avoiding Ransomware and malware

Best practices for escaping ransomware · Record ransomware volumes in 2017 • According to the Malwarebytes' 2017 State of Malware Report, ransomware attacks against consumers went

Genetic Malware Analysis for Threat Intelligence · Malware Family Classiﬁcation Understanding if a threat is a generic malware, ransomware, or a nation-state sponsored attack,

Ransomware, Malware and Viruses; How to Protect Yourself

VARONIS WHITEPAPER...RANSOMWARE 101 Ransomware is a type of malware that infects computers and restricts users’ access to their files by encrypting the file data. To release the

VARONIS WHITEPAPER: Ransomware Guide · Ransomware Guide Overview Ransomware – malware that encrypts a victim’s data, extorting a ransom to be paid within a short time frame or

Fraud Mitigation Strategies for Business · •Ransomware •Email Account Ransom •Webcam Image Extortion. Ransomware 14 Ransomware is a form of malware that restricts the target

Understanding and Responding to Ransomware Attacks · Understanding and Responding to Ransomware Attacks Ransomware is a malware, which prevents users from accessing the system or

Molly and Max say beware of Malware! · Ransomware is mostly spread through crafty spam emails. It infects digital devices stopping access to files unless the user pays a ransom to

WannaCry Ransomware - NKSC · WannaCry Ransomware 3 Malware names Wana Decrypt0r, WCry, WannaCry, WannaCrypt, and WanaCrypt0r Management summary WannaCry is a unique form of ransomware

Understanding internal structure of the SNAKE … Ransomware Analysis...MBSD Blog Understanding internal structure of the SNAKE (EKANS) ransomware Takashi Yoshikawa Senior Malware

Benchmarking Deception Technologies - FireCompass · Malware (including ransomware): Deception solutions can help prevent the spread of malware/ransomware by luring the malware to

Ransomware Teslacrypt Uncovered - Malware Analysis

Splunk Insights for Ransomware - ecs-dk.arrow.com · Splunk Insights for Ransomware is the ... What risk does ransomware or a large scale malware attack ... • Vulnerability and