Global CCISO Forum Ondrej Krehel | The Era of Cyber Extortion and Ransomware for EC Council

1. THE ERA OF CYBER
EXTORTION AND
RANSOMWARE
www.LIFARS.com

2. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 2
About Us
Ondrej Krehel
CEO/Founder CISSP, CEH, CEI, EnCE
LIFARS LLC
Connect With Us
@LIFARSLLC
OndrejKrehel/
WWW.LIFARS.com
212-222-7061

3. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 3
Types of Cyber Extortion
 Ransomware
 Service disruption - DDoS
 Sextortion
 Executives and officers
 Teenagers and mobile
 Payroll data and systems
 Cryptocurrencies and bitcoin

4. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 4
Ransomware

5. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 5
Ransomware “Special”
 Survey in the end
 Failed decryption of data – RAID systems
 Secondary intrusion and Ransomware
 Employees and tax data
 Single points of failure
 Recovery plan with partners
 Incident or just Ransomware?

6. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 6
Let There Be Code
“Let There Be Code”

7. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 7
Rise of SamSam Ransomware
“Is my JBoss / EAP Server Vulnerable to
Samas Ransomware?”
Redhat / June 24, 2016
“FBI wants U.S. business to help as
cyber extortion gains urgency”
Reuters / May 28, 2016

8. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 8
SamSam 2018

9. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 9
SamSam
Pen-testing/
Attack Sever
Scans networks to find
possible entry point to
exploit
Use stolen login
credentials
Deploy malware files
with PSEXEC tool
Delete shadow files via
vssadmin.exe
Install Trojan:MSL/Sam as
Install Ransom:MSIL/Sam
as

10. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 10
Ransomware Tracker

11. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 11
How Expensive Hacking for Hire Is

12. SEXTORTION

13. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page
Real Stories
13

14. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 14
Sextortion – Real Cases

15. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 15
Sextortion – Real Cases
Add a victim on Facebook and message them to video chat
to get sexual video, Facebook friends information, etc.

16. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 16
Sextortion – Real Cases

17. OTHER EXTORTIONS

18. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 18
Fake LinkedIn Profile – Real Cases
LinkedIn page with real name, picture, & job title

19. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 19
xDedic - Buy and Sell Hacked Companies
 Underground marketplace
which facilitates the selling &
purchasing of RDP servers
 Has tech support, custom tools,
“friendly admins”
 Scam protection
 Over 70,000 servers available
for sale
 From governments to
corporations, ISPs, telcos,
universities and more

20. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 20
How to buy & sell hacked servers all over the world
Criminal hacks
into a server
Offers access to the
server for sale on xDedic
Over 70 thousand hacked
servers from 173 countries
checked for RDP
configuration, memory,
software, browsing history,
anti virus and more
Cybercriminal
buys the server
Uses it For
Malware campaign, DDoS
attack, Phishing, Social
engineering, cyber
espionage, to gain
foothold for an APT attack
* Then resells server access on xDedic

21. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 21
Hacking Websites

22. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 22
xDedic – Real Cases
A stolen Paypal Account by
an xDedic
A sample file that runs an RDP
configuring executable for an xDedic

23. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page
xDedic – Real Cases
23

24. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 24
Compromised IP Addresses

25. Cryptocurrencies and Extortion

26. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 26
DDoS in Cryptocurrencies

27. INCIDENT RESPONSE REMDIATION

28. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 28
Assessment Tools
 How do you know that you are hacked?
 What to do when you or your company is hacked?
 How does one recover and remediate situation?
 Do you have the right tools to minimize your cyber
risk?

29. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 29
How Do You Know When You Are Hacked?
“Hackers made Iran’s nuclear
computers blast AC/DC”
THE VERGE / August 7, 2014

30. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 30
What Should You Do When You Are Hacked?

31. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 31
How To Remediate

32. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 32
Do You Have The Right Tools To Minimize
Your Cyber Risk
Protect
DetectAnalyze
Respond
• Security Assessment Program
• Penetration Testing
• Threat Assessment Test
• Managed Response and Security
• Threat Intelligence and Monitoring
• Advisory and Training
• Security Awareness Training
• Incident Response Plan
• Ransomware Forensics
• Digital Forensics

33. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 33
Resources
 U.S. Secret Service Electronic Crimes Task Force
https://www.secretservice.gov/investigation/
 Internet Crimes Complaint Center (IC3)
https://www.ic3.gov/default.aspx
 United States Computer Emergency Readiness Team (US-
CERT) https://www.us-cert.gov/
 National Cyber Security Alliance (NCSA)
https://staysafeonline.org/
 LIFARS blog and Newsletter https://lifars.com/cyber-news/ and
https://lifars.com/blog/

34. © 2018 LIFARS, LLC All Rights Reserved www.LIFARS.co
m
Page 34
Summary
 Create a Zero Trust Zone
 Develop Trusted Partner Relationships: Vendors & Law
Enforcement
 Ransomware Forensics
 Complete Cyber Extortion Solution
 Ask Experts – Readiness Assessment
 Think about Low Probability Options with High Impact
 Constant Education, Training, & Practice
 Recovery Plan
 Unknown Unknowns

35. QUESTIONS?

36. THANK YOU
|
www.LIFARS.com
Subscribe to
our
Newsletter