SlideShare ist ein Scribd-Unternehmen logo

Ransomware: Emergence of the Cyber-Extortion Menace

•Als PPTX, PDF herunterladen•
•
Zubair Baig
Zubair Baig

A talk given at the ECU Security Conference - 2015

Wissenschaft
1 von 29
Security Research Institute Edith Cowan University Ransomware Emergence of the Cyber-Extortion Menace Nikolai Hampton1 and Zubair A. Baig1,2 School of Computer and Security Science1, Security Research Institute2 Edith Cowan University Perth, Australia nikolaih@our.ecu.edu.au, z.baig@ecu.edu.au December, 2015
Security Research Institute Edith Cowan University Ransomware – What is it? Ransomware: (noun)… “Ransomware is a type of malware that prevents or limits users from accessing their system. This type of malware forces its victims to pay the ransom through certain online payment methods in order to grant access to their systems, or to get their data back.” (TrendMicro, n.d.)
Security Research Institute Edith Cowan University It’s a hot topic…
Security Research Institute Edith Cowan University Some history • PC CYBORG (AIDS) Ransomware emerged in 1989. Distributed on floppy disks… Source: https://commons.wikimedia.org/wiki/File:Floppy_disk_2009_G1.jpg Anyone remember these?
Security Research Institute Edith Cowan University Some history • PC CYBORG (AIDS Disk) – Emerged in 1989. Distributed on floppy disks – Installed from Trojan software – Lay dormant to allow time for propagation – Used operating basic encryption and operating system quirks to “scramble” and hide files – Demanded a “License Payment” to be sent via cheque to a post office box in Panama
Security Research Institute Edith Cowan University Some history • PC CYBORG (AIDS) - 1989 – Not very successful – Technology was lagging behind the idea
Security Research Institute Edith Cowan University Some history • Malware continued to develop 1990s – 2000s – Identity theft – Phishing scams, stealing passwords – Bot Nets – Networks of compromised PCs – Adware …but where was ransomware?
Security Research Institute Edith Cowan University Some history Where’s Ransomware 1990s-2000s Very small percent of Malware! Too complicated, how to get money? Too risky, how to stay hidden? Too weak, how to “Denial of Service” an uncontrolled PC? Occasional “fake” ransom, or Anti Virus, easily defeated / removed Occasional “locker” that affected boot process, easily defeated / removed (CC) BitDefender España (2010) Source: https://www.flickr.com/photos/bitdefenderes/4292753852 Source: http://www.acma.gov.au/~/media/mediacomms/Social%20Media/Images/Ransomware%20Screenshot%20jpg.jpg Australian Communication and MediaAuthority (2013)
Security Research Institute Edith Cowan University Why is it important now? • In 2010, something changed… Google search trends “ransomware” searches 2008 to 2015 • In 2012, something changed, a lot!
Security Research Institute Edith Cowan University Reality Check - Perspective Google search trends “ransomware” searches 2008 to 2015 Google search trends “ransomware” searches vs “malware” searches 2008 to 2015
Security Research Institute Edith Cowan University So it’s just a pest? • At the moment yes, but it’s getting a lot of coverage.
Security Research Institute Edith Cowan University Why is it important now? • Technology has caught up to the idea! Step 1: Idea! Ransom money from people! Step 3: Profit… Step 2: Use technology to enable the idea! Image: Jodi Meadows (2011), Flickr https://www.flickr.com/photos/69585952@N00/
Security Research Institute Edith Cowan University The perfect storm • Technology has caught up to the idea! – CTB Locker: Curve, TOR, Bitcoin  Strong encryption  Anonymity  Untraceable crypto-cash payments
Security Research Institute Edith Cowan University So, here we are – our research Ransomware Emergence of the Cyber-Extortion Menace
Security Research Institute Edith Cowan University Aim • Understand the ransomware threat… • Lay the foundation for extrapolating future ransomware development • Focus on the ransomware payload separately from the dropper • Extend existing research and ideas Young, A., & Yung, M. (1996). Cryptovirology: Extortion-Based Security Threats and Countermeasures.
Security Research Institute Edith Cowan University What we did… • Propose a nomenclature for ransomware “traits” • Record the history and traits of ransomware strains over time • Developed a ransomware traits database • Chart the inclusion / exclusion of traits over time • Examine which traits have conferred benefits – Impact – Longevity – Profitability (for the attackers)
Security Research Institute Edith Cowan University What we did…
Security Research Institute Edith Cowan University What we did… • An overview of ransomware examined: – Twenty-nine variants – Nine ransomware families (PC Cyborg, GPCode, Reveton, CryptoLocker, CryptoDefense,CryptoWall, CTB-Locker, TeslaCrypt) – Twenty-two traits examined (Encrypts, Strong Cypher, PKI, Autonomous, TOR…)
Security Research Institute Edith Cowan University Results Complete√ X O Broken Partial Traits Expressed
Security Research Institute Edith Cowan University Results • Increasing use of security technology over time.. 0 2 4 6 8 10 12 14 < 2004 2004-2005 2006-2007 2008-2009 2010-2011 2012-2013 2014+ Ransomware strains surveyed and use of new technologies # of strains surveyed Bitcoin Uptake TOR Uptake
Security Research Institute Edith Cowan University Evolution of GPCode’s encryption GPCode 2004 Used one byte encryption key, easily defeated Electronic payments GPCode.ac (June 2005) Implemented RSA Public Key Cryptography (PKI) Very weak key (56bit RSA modulus = 7 bit symmetric key) GPCode.ad (April 2006) Longer RSA keys but still poor PKI implementation GPCode.ag (June 2006) Finally, a strong RSA key (660 bit = ~60 bit symmetric) Cracked by Kaspersky, probably a coding error in .ag GPCode.ak (June 2008) Properly implemented 1024 bit RSA key Failed due to implementation of wrong “cipher” RC4, vulnerable to cryptanalysis GPCode.ax (December 2010) – A copycat… Unbreakable encryption … but still can be stopped (it has flaws)
Security Research Institute Edith Cowan University Evolution of Command and Control • GPCode (2004) – No C&C (C2) Server, just “did its thing” – Contact malware producer via email for unlock code • Reveton (2012) – Doesn’t encrypt but uses C2 server for ‘unlock’ • Cryptolocker (2013) – Uses C2 server, to retrieve RSA public key (much more secure) – Pseudo Random “Domain Generation Algorithm” (DGA) to avoid easy takedowns (contacts garbage URLs: xxgrradvvzcfyx.biz) • Cryptowall (2014) – Uses C2 server on TOR – hidden and anonymous network! – Improved DGA to make takedown even harder
Security Research Institute Edith Cowan University New command and control Compromised System Encrypted I2P‘darknet’link AnonymousC2 Server Upload infected PC details (registration) Acknowledgement Initialisation Download encryption key request Public key response Request for ransom image and text resources Image and decryption text instructions Dataencryption/ destruction begins Keyverificationandimport usingWindowscryptoAPIs CryptoWall execution I2Pproxy connection to C2 server I2P proxy Malspam or Angler EK Dropper * * Angler Exploit Kit may use single phase malware installation without dropper ! ! ! ! ! ! potential contact points for attack disruption © Ni kol ai Hampt on, 2015 - Thi s wor k i s l i cens ed under CC BY ( ht t p: / / cr eat i vecommons . or g/ l i cens es / by/ 3. 0/ )
Security Research Institute Edith Cowan University What does it mean? • Ransomware is evolving • Responding to new defences • Profit Virus Image CC BY 2.0 Flickr: NIAID https://www.flickr.com/photos/niaid/
Security Research Institute Edith Cowan University Breaking broken news • CryptoWall 4.0 – New traits (filename scrambling) – Obliterates restore points – Improved network security evasion
Security Research Institute Edith Cowan University What can users do? • Classic Defense-In-Depth approach – Multi Layer – Device Protection – Network Protection • Backups – Still good, but…
Security Research Institute Edith Cowan University Future work and questions? • Opportunity to apply some funky statistics – Through trait impact analysis – BIA/Longevity/Destructiveness Index • Machine learning (pattern recognition) • Improve the naming and reporting of ransomware • Collective collaboration
Security Research Institute Edith Cowan University Conclusion • We examined the ransomware threat and the emergence of traits over the last 26 years • We were able to identify evolutionary patterns in most strains • Given the changing risk/reward structure it’s hard to believe this isn’t going to get much bigger • This shows it is a threat we can not dismiss
Security Research Institute Edith Cowan University Thanks for your time! ?

Empfohlen

Ransomware: How to avoid a crypto crisis at your IT business
Ransomware: How to avoid a crypto crisis at your IT businessRansomware: How to avoid a crypto crisis at your IT business
Ransomware: How to avoid a crypto crisis at your IT businessCalyptix Security
 
Ransomware - The Growing Threat
Ransomware - The Growing ThreatRansomware - The Growing Threat
Ransomware - The Growing ThreatNick Miller
 
Malware's Most Wanted: CryptoLocker—The Ransomware Trojan
Malware's Most Wanted: CryptoLocker—The Ransomware TrojanMalware's Most Wanted: CryptoLocker—The Ransomware Trojan
Malware's Most Wanted: CryptoLocker—The Ransomware TrojanCyphort
 
Blackhat USA 2014 - The New Scourge of Ransomware
Blackhat USA 2014 - The New Scourge of RansomwareBlackhat USA 2014 - The New Scourge of Ransomware
Blackhat USA 2014 - The New Scourge of RansomwareJohn Bambenek
 
Ransomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, PreventionRansomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, PreventionMohammad Yahya
 
Ransomware: History, Analysis, & Mitigation - PDF
Ransomware: History, Analysis, & Mitigation - PDFRansomware: History, Analysis, & Mitigation - PDF
Ransomware: History, Analysis, & Mitigation - PDFAndy Thompson
 
Ransomware: Mitigation Through Preparation
Ransomware: Mitigation Through PreparationRansomware: Mitigation Through Preparation
Ransomware: Mitigation Through PreparationHostway|HOSTING
 
Ransomware
RansomwareRansomware
RansomwareAkshita Pillai
 

Empfohlen

Ransomware: How to avoid a crypto crisis at your IT business
Ransomware: How to avoid a crypto crisis at your IT businessRansomware: How to avoid a crypto crisis at your IT business
Ransomware: How to avoid a crypto crisis at your IT businessCalyptix Security
 
Ransomware - The Growing Threat
Ransomware - The Growing ThreatRansomware - The Growing Threat
Ransomware - The Growing ThreatNick Miller
 
Malware's Most Wanted: CryptoLocker—The Ransomware Trojan
Malware's Most Wanted: CryptoLocker—The Ransomware TrojanMalware's Most Wanted: CryptoLocker—The Ransomware Trojan
Malware's Most Wanted: CryptoLocker—The Ransomware TrojanCyphort
 
Blackhat USA 2014 - The New Scourge of Ransomware
Blackhat USA 2014 - The New Scourge of RansomwareBlackhat USA 2014 - The New Scourge of Ransomware
Blackhat USA 2014 - The New Scourge of RansomwareJohn Bambenek
 
Ransomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, PreventionRansomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, PreventionMohammad Yahya
 
Ransomware: History, Analysis, & Mitigation - PDF
Ransomware: History, Analysis, & Mitigation - PDFRansomware: History, Analysis, & Mitigation - PDF
Ransomware: History, Analysis, & Mitigation - PDFAndy Thompson
 
Ransomware: Mitigation Through Preparation
Ransomware: Mitigation Through PreparationRansomware: Mitigation Through Preparation
Ransomware: Mitigation Through PreparationHostway|HOSTING
 
Ransomware
RansomwareRansomware
RansomwareAkshita Pillai
 
WHITE PAPER▶ The Evolution of Ransomware
WHITE PAPER▶ The Evolution of RansomwareWHITE PAPER▶ The Evolution of Ransomware
WHITE PAPER▶ The Evolution of RansomwareSymantec
 
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Roger Hagedorn
 
Ransomware hostage rescue manual
Ransomware hostage rescue manualRansomware hostage rescue manual
Ransomware hostage rescue manualRoel Palmaers
 
Ransomware
Ransomware Ransomware
Ransomware Armor
 
Advantage Technology - Ransomware and the NIST Cybersecurity Framework
Advantage Technology - Ransomware and the NIST Cybersecurity FrameworkAdvantage Technology - Ransomware and the NIST Cybersecurity Framework
Advantage Technology - Ransomware and the NIST Cybersecurity FrameworkJack Shaffer
 
Ransomware attacks 2017
Ransomware attacks 2017Ransomware attacks 2017
Ransomware attacks 2017Thesis Scientist Private Limited
 
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CKSymantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CKSymantec
 
The rise of malware(ransomware)
The rise of malware(ransomware)The rise of malware(ransomware)
The rise of malware(ransomware)phexcom1
 
Analysing Ransomware
Analysing RansomwareAnalysing Ransomware
Analysing RansomwareNapier University
 
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...ClearDATACloud
 
Ransomware by lokesh
Ransomware by lokeshRansomware by lokesh
Ransomware by lokeshLokesh Bysani
 
What is wanna cry ransomware attack
What is wanna cry ransomware attackWhat is wanna cry ransomware attack
What is wanna cry ransomware attacki-engage
 
"There's a pot of Bitcoins behind the ransomware rainbow"
"There's a pot of Bitcoins behind the ransomware rainbow""There's a pot of Bitcoins behind the ransomware rainbow"
"There's a pot of Bitcoins behind the ransomware rainbow"Christiaan Beek
 
Ransomware Attack
Ransomware AttackRansomware Attack
Ransomware Attackdoiss delhi
 
What is Ransomware? A Quick Guide
What is Ransomware? A Quick GuideWhat is Ransomware? A Quick Guide
What is Ransomware? A Quick GuideSarah Roberts
 
Enterprise security: ransomware in enterprise and corporate entities
Enterprise security: ransomware in enterprise and corporate entitiesEnterprise security: ransomware in enterprise and corporate entities
Enterprise security: ransomware in enterprise and corporate entitiesQuick Heal Technologies Ltd.
 
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...Andrew Morris
 
CSF18 - Guarding Against the Unknown - Rafael Narezzi
CSF18 - Guarding Against the Unknown - Rafael NarezziCSF18 - Guarding Against the Unknown - Rafael Narezzi
CSF18 - Guarding Against the Unknown - Rafael NarezziNCCOMMS
 
CSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
CSF18 - The Digital Threat of the Decade (Century) - Sasha KranjacCSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
CSF18 - The Digital Threat of the Decade (Century) - Sasha KranjacNCCOMMS
 
How to stay protected against ransomware
How to stay protected against ransomwareHow to stay protected against ransomware
How to stay protected against ransomwareSophos Benelux
 
Info sec 12 v1 2
Info sec 12 v1 2Info sec 12 v1 2
Info sec 12 v1 2Prof John Walker FRSA Purveyor Dark Intelligence
 
Cyber handbook enterprise v1.6
Cyber handbook enterprise v1.6Cyber handbook enterprise v1.6
Cyber handbook enterprise v1.6hymasakhamuri
 

Weitere ähnliche Inhalte

Was ist angesagt?

WHITE PAPER▶ The Evolution of Ransomware
WHITE PAPER▶ The Evolution of RansomwareWHITE PAPER▶ The Evolution of Ransomware
WHITE PAPER▶ The Evolution of RansomwareSymantec
 
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Roger Hagedorn
 
Ransomware hostage rescue manual
Ransomware hostage rescue manualRansomware hostage rescue manual
Ransomware hostage rescue manualRoel Palmaers
 
Ransomware
Ransomware Ransomware
Ransomware Armor
 
Advantage Technology - Ransomware and the NIST Cybersecurity Framework
Advantage Technology - Ransomware and the NIST Cybersecurity FrameworkAdvantage Technology - Ransomware and the NIST Cybersecurity Framework
Advantage Technology - Ransomware and the NIST Cybersecurity FrameworkJack Shaffer
 
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CKSymantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CKSymantec
 
The rise of malware(ransomware)
The rise of malware(ransomware)The rise of malware(ransomware)
The rise of malware(ransomware)phexcom1
 
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...ClearDATACloud
 
Ransomware by lokesh
Ransomware by lokeshRansomware by lokesh
Ransomware by lokeshLokesh Bysani
 
What is wanna cry ransomware attack
What is wanna cry ransomware attackWhat is wanna cry ransomware attack
What is wanna cry ransomware attacki-engage
 
"There's a pot of Bitcoins behind the ransomware rainbow"
"There's a pot of Bitcoins behind the ransomware rainbow""There's a pot of Bitcoins behind the ransomware rainbow"
"There's a pot of Bitcoins behind the ransomware rainbow"Christiaan Beek
 
Ransomware Attack
Ransomware AttackRansomware Attack
Ransomware Attackdoiss delhi
 
What is Ransomware? A Quick Guide
What is Ransomware? A Quick GuideWhat is Ransomware? A Quick Guide
What is Ransomware? A Quick GuideSarah Roberts
 
Enterprise security: ransomware in enterprise and corporate entities
Enterprise security: ransomware in enterprise and corporate entitiesEnterprise security: ransomware in enterprise and corporate entities
Enterprise security: ransomware in enterprise and corporate entitiesQuick Heal Technologies Ltd.
 
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...Andrew Morris
 
CSF18 - Guarding Against the Unknown - Rafael Narezzi
CSF18 - Guarding Against the Unknown - Rafael NarezziCSF18 - Guarding Against the Unknown - Rafael Narezzi
CSF18 - Guarding Against the Unknown - Rafael NarezziNCCOMMS
 
CSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
CSF18 - The Digital Threat of the Decade (Century) - Sasha KranjacCSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
CSF18 - The Digital Threat of the Decade (Century) - Sasha KranjacNCCOMMS
 
How to stay protected against ransomware
How to stay protected against ransomwareHow to stay protected against ransomware
How to stay protected against ransomwareSophos Benelux
 

Was ist angesagt? (20)

WHITE PAPER▶ The Evolution of Ransomware
WHITE PAPER▶ The Evolution of RansomwareWHITE PAPER▶ The Evolution of Ransomware
WHITE PAPER▶ The Evolution of Ransomware
 
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
 
Ransomware hostage rescue manual
Ransomware hostage rescue manualRansomware hostage rescue manual
Ransomware hostage rescue manual
 
Ransomware
Ransomware Ransomware
Ransomware
 
Advantage Technology - Ransomware and the NIST Cybersecurity Framework
Advantage Technology - Ransomware and the NIST Cybersecurity FrameworkAdvantage Technology - Ransomware and the NIST Cybersecurity Framework
Advantage Technology - Ransomware and the NIST Cybersecurity Framework
 
Ransomware attacks 2017
Ransomware attacks 2017Ransomware attacks 2017
Ransomware attacks 2017
 
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CKSymantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
Symantec Webinar | How to Detect Targeted Ransomware with MITRE ATT&CK
 
The rise of malware(ransomware)
The rise of malware(ransomware)The rise of malware(ransomware)
The rise of malware(ransomware)
 
Analysing Ransomware
Analysing RansomwareAnalysing Ransomware
Analysing Ransomware
 
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
5 Ways to Protect Your Healthcare Organization from a Ransomware Attack - HIM...
 
Ransomware by lokesh
Ransomware by lokeshRansomware by lokesh
Ransomware by lokesh
 
What is wanna cry ransomware attack
What is wanna cry ransomware attackWhat is wanna cry ransomware attack
What is wanna cry ransomware attack
 
"There's a pot of Bitcoins behind the ransomware rainbow"
"There's a pot of Bitcoins behind the ransomware rainbow""There's a pot of Bitcoins behind the ransomware rainbow"
"There's a pot of Bitcoins behind the ransomware rainbow"
 
Ransomware Attack
Ransomware AttackRansomware Attack
Ransomware Attack
 
What is Ransomware? A Quick Guide
What is Ransomware? A Quick GuideWhat is Ransomware? A Quick Guide
What is Ransomware? A Quick Guide
 
Enterprise security: ransomware in enterprise and corporate entities
Enterprise security: ransomware in enterprise and corporate entitiesEnterprise security: ransomware in enterprise and corporate entities
Enterprise security: ransomware in enterprise and corporate entities
 
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
Staying Ahead of Internet Background Exploitation - Microsoft BlueHat Israel ...
 
CSF18 - Guarding Against the Unknown - Rafael Narezzi
CSF18 - Guarding Against the Unknown - Rafael NarezziCSF18 - Guarding Against the Unknown - Rafael Narezzi
CSF18 - Guarding Against the Unknown - Rafael Narezzi
 
CSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
CSF18 - The Digital Threat of the Decade (Century) - Sasha KranjacCSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
CSF18 - The Digital Threat of the Decade (Century) - Sasha Kranjac
 
How to stay protected against ransomware
How to stay protected against ransomwareHow to stay protected against ransomware
How to stay protected against ransomware
 

Ähnlich wie Ransomware: Emergence of the Cyber-Extortion Menace

Cyber handbook enterprise v1.6
Cyber handbook enterprise v1.6Cyber handbook enterprise v1.6
Cyber handbook enterprise v1.6hymasakhamuri
 
Stop Watering Holes, Spear-Phishing and Drive-by Downloads
Stop Watering Holes, Spear-Phishing and Drive-by DownloadsStop Watering Holes, Spear-Phishing and Drive-by Downloads
Stop Watering Holes, Spear-Phishing and Drive-by DownloadsInvincea, Inc.
 
Scot Secure 2015
Scot Secure 2015Scot Secure 2015
Scot Secure 2015Ray Bugg
 
2014: Mid-Year Threat Review
2014: Mid-Year Threat Review2014: Mid-Year Threat Review
2014: Mid-Year Threat ReviewESET
 
Future-proofing maritime ports against emerging cyber-physical threats
Future-proofing maritime ports against emerging cyber-physical threatsFuture-proofing maritime ports against emerging cyber-physical threats
Future-proofing maritime ports against emerging cyber-physical threatsSteven SIM Kok Leong
 
Lessons learnt from the 2012 cyber security audit of Western Australian State...
Lessons learnt from the 2012 cyber security audit of Western Australian State...Lessons learnt from the 2012 cyber security audit of Western Australian State...
Lessons learnt from the 2012 cyber security audit of Western Australian State...Edith Cowan University
 
Functional and Behavioral Analysis of Different Type of Ransomware.pptx
Functional and Behavioral Analysis of Different Type of Ransomware.pptxFunctional and Behavioral Analysis of Different Type of Ransomware.pptx
Functional and Behavioral Analysis of Different Type of Ransomware.pptxtarkovtarkovski
 
Social and mobile tisa protalk 2 2554
Social and mobile tisa protalk 2 2554Social and mobile tisa protalk 2 2554
Social and mobile tisa protalk 2 2554TISA
 
Tisa-Social Network and Mobile Security
Tisa-Social Network and Mobile SecurityTisa-Social Network and Mobile Security
Tisa-Social Network and Mobile SecurityPrathan Phongthiproek
 
Solnet dev secops meetup
Solnet dev secops meetupSolnet dev secops meetup
Solnet dev secops meetuppbink
 
Behind the Curtain: Exposing Advanced Threats
Behind the Curtain: Exposing Advanced ThreatsBehind the Curtain: Exposing Advanced Threats
Behind the Curtain: Exposing Advanced ThreatsCisco Canada
 
Welcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat IntelligenceWelcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat IntelligenceAndreas Sfakianakis
 
UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...
UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...
UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...APNIC
 
festival ICT 2013: Gli attacchi mirati e la Difesa Personalizzata Trend Micro
festival ICT 2013: Gli attacchi mirati e la Difesa Personalizzata Trend Microfestival ICT 2013: Gli attacchi mirati e la Difesa Personalizzata Trend Micro
festival ICT 2013: Gli attacchi mirati e la Difesa Personalizzata Trend Microfestival ICT 2016
 
[Bucharest] Attack is easy, let's talk defence
[Bucharest] Attack is easy, let's talk defence[Bucharest] Attack is easy, let's talk defence
[Bucharest] Attack is easy, let's talk defenceOWASP EEE
 
Developing a Protection Profile for Smart TV
Developing a Protection Profile for Smart TVDeveloping a Protection Profile for Smart TV
Developing a Protection Profile for Smart TVSeungjoo Kim
 

Ähnlich wie Ransomware: Emergence of the Cyber-Extortion Menace (20)

Info sec 12 v1 2
Info sec 12 v1 2Info sec 12 v1 2
Info sec 12 v1 2
 
Cyber handbook enterprise v1.6
Cyber handbook enterprise v1.6Cyber handbook enterprise v1.6
Cyber handbook enterprise v1.6
 
Stop Watering Holes, Spear-Phishing and Drive-by Downloads
Stop Watering Holes, Spear-Phishing and Drive-by DownloadsStop Watering Holes, Spear-Phishing and Drive-by Downloads
Stop Watering Holes, Spear-Phishing and Drive-by Downloads
 
Scot Secure 2015
Scot Secure 2015Scot Secure 2015
Scot Secure 2015
 
2014: Mid-Year Threat Review
2014: Mid-Year Threat Review2014: Mid-Year Threat Review
2014: Mid-Year Threat Review
 
Future-proofing maritime ports against emerging cyber-physical threats
Future-proofing maritime ports against emerging cyber-physical threatsFuture-proofing maritime ports against emerging cyber-physical threats
Future-proofing maritime ports against emerging cyber-physical threats
 
Lessons learnt from the 2012 cyber security audit of Western Australian State...
Lessons learnt from the 2012 cyber security audit of Western Australian State...Lessons learnt from the 2012 cyber security audit of Western Australian State...
Lessons learnt from the 2012 cyber security audit of Western Australian State...
 
Functional and Behavioral Analysis of Different Type of Ransomware.pptx
Functional and Behavioral Analysis of Different Type of Ransomware.pptxFunctional and Behavioral Analysis of Different Type of Ransomware.pptx
Functional and Behavioral Analysis of Different Type of Ransomware.pptx
 
Social and mobile tisa protalk 2 2554
Social and mobile tisa protalk 2 2554Social and mobile tisa protalk 2 2554
Social and mobile tisa protalk 2 2554
 
Tisa social and mobile security
Tisa social and mobile securityTisa social and mobile security
Tisa social and mobile security
 
Tisa-Social Network and Mobile Security
Tisa-Social Network and Mobile SecurityTisa-Social Network and Mobile Security
Tisa-Social Network and Mobile Security
 
NetWitness
NetWitnessNetWitness
NetWitness
 
Solnet dev secops meetup
Solnet dev secops meetupSolnet dev secops meetup
Solnet dev secops meetup
 
Behind the Curtain: Exposing Advanced Threats
Behind the Curtain: Exposing Advanced ThreatsBehind the Curtain: Exposing Advanced Threats
Behind the Curtain: Exposing Advanced Threats
 
Welcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat IntelligenceWelcome to the world of Cyber Threat Intelligence
Welcome to the world of Cyber Threat Intelligence
 
UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...
UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...
UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...
 
Super1
Super1Super1
Super1
 
festival ICT 2013: Gli attacchi mirati e la Difesa Personalizzata Trend Micro
festival ICT 2013: Gli attacchi mirati e la Difesa Personalizzata Trend Microfestival ICT 2013: Gli attacchi mirati e la Difesa Personalizzata Trend Micro
festival ICT 2013: Gli attacchi mirati e la Difesa Personalizzata Trend Micro
 
[Bucharest] Attack is easy, let's talk defence
[Bucharest] Attack is easy, let's talk defence[Bucharest] Attack is easy, let's talk defence
[Bucharest] Attack is easy, let's talk defence
 
Developing a Protection Profile for Smart TV
Developing a Protection Profile for Smart TVDeveloping a Protection Profile for Smart TV
Developing a Protection Profile for Smart TV
 

Kürzlich hochgeladen

Human & Veterinary Respiratory Physilogy_DR.E.Muralinath_Associate Professor....
Human & Veterinary Respiratory Physilogy_DR.E.Muralinath_Associate Professor....Human & Veterinary Respiratory Physilogy_DR.E.Muralinath_Associate Professor....
Human & Veterinary Respiratory Physilogy_DR.E.Muralinath_Associate Professor....muralinath2
 
❤Jammu Kashmir Call Girls 8617697112 Personal Whatsapp Number 💦✅.
❤Jammu Kashmir Call Girls 8617697112 Personal Whatsapp Number 💦✅.❤Jammu Kashmir Call Girls 8617697112 Personal Whatsapp Number 💦✅.
❤Jammu Kashmir Call Girls 8617697112 Personal Whatsapp Number 💦✅.Nitya salvi
 
300003-World Science Day For Peace And Development.pptx
300003-World Science Day For Peace And Development.pptx300003-World Science Day For Peace And Development.pptx
300003-World Science Day For Peace And Development.pptxryanrooker
 
Pests of cotton_Sucking_Pests_Dr.UPR.pdf
Pests of cotton_Sucking_Pests_Dr.UPR.pdfPests of cotton_Sucking_Pests_Dr.UPR.pdf
Pests of cotton_Sucking_Pests_Dr.UPR.pdfPirithiRaju
 
Proteomics: types, protein profiling steps etc.
Proteomics: types, protein profiling steps etc.Proteomics: types, protein profiling steps etc.
Proteomics: types, protein profiling steps etc.Silpa
 
module for grade 9 for distance learning
module for grade 9 for distance learningmodule for grade 9 for distance learning
module for grade 9 for distance learninglevieagacer
 
Bacterial Identification and Classifications
Bacterial Identification and ClassificationsBacterial Identification and Classifications
Bacterial Identification and ClassificationsAreesha Ahmad
 
Pests of mustard_Identification_Management_Dr.UPR.pdf
Pests of mustard_Identification_Management_Dr.UPR.pdfPests of mustard_Identification_Management_Dr.UPR.pdf
Pests of mustard_Identification_Management_Dr.UPR.pdfPirithiRaju
 
Call Girls Ahmedabad +917728919243 call me Independent Escort Service
Call Girls Ahmedabad +917728919243 call me Independent Escort ServiceCall Girls Ahmedabad +917728919243 call me Independent Escort Service
Call Girls Ahmedabad +917728919243 call me Independent Escort Serviceshivanisharma5244
 
Pests of cotton_Borer_Pests_Binomics_Dr.UPR.pdf
Pests of cotton_Borer_Pests_Binomics_Dr.UPR.pdfPests of cotton_Borer_Pests_Binomics_Dr.UPR.pdf
Pests of cotton_Borer_Pests_Binomics_Dr.UPR.pdfPirithiRaju
 
Conjugation, transduction and transformation
Conjugation, transduction and transformationConjugation, transduction and transformation
Conjugation, transduction and transformationAreesha Ahmad
 
Pulmonary drug delivery system M.pharm -2nd sem P'ceutics
Pulmonary drug delivery system M.pharm -2nd sem P'ceuticsPulmonary drug delivery system M.pharm -2nd sem P'ceutics
Pulmonary drug delivery system M.pharm -2nd sem P'ceuticssakshisoni2385
 
FAIRSpectra - Enabling the FAIRification of Analytical Science
FAIRSpectra - Enabling the FAIRification of Analytical ScienceFAIRSpectra - Enabling the FAIRification of Analytical Science
FAIRSpectra - Enabling the FAIRification of Analytical ScienceAlex Henderson
 
Asymmetry in the atmosphere of the ultra-hot Jupiter WASP-76 b
Asymmetry in the atmosphere of the ultra-hot Jupiter WASP-76 bAsymmetry in the atmosphere of the ultra-hot Jupiter WASP-76 b
Asymmetry in the atmosphere of the ultra-hot Jupiter WASP-76 bSérgio Sacani
 
COST ESTIMATION FOR A RESEARCH PROJECT.pptx
COST ESTIMATION FOR A RESEARCH PROJECT.pptxCOST ESTIMATION FOR A RESEARCH PROJECT.pptx
COST ESTIMATION FOR A RESEARCH PROJECT.pptxFarihaAbdulRasheed
 
Sector 62, Noida Call girls :8448380779 Model Escorts | 100% verified
Sector 62, Noida Call girls :8448380779 Model Escorts | 100% verifiedSector 62, Noida Call girls :8448380779 Model Escorts | 100% verified
Sector 62, Noida Call girls :8448380779 Model Escorts | 100% verifiedDelhi Call girls
 
Zoology 5th semester notes( Sumit_yadav).pdf
Zoology 5th semester notes( Sumit_yadav).pdfZoology 5th semester notes( Sumit_yadav).pdf
Zoology 5th semester notes( Sumit_yadav).pdfSumit Kumar yadav
 
9654467111 Call Girls In Raj Nagar Delhi Short 1500 Night 6000
9654467111 Call Girls In Raj Nagar Delhi Short 1500 Night 60009654467111 Call Girls In Raj Nagar Delhi Short 1500 Night 6000
9654467111 Call Girls In Raj Nagar Delhi Short 1500 Night 6000Sapana Sha
 

Kürzlich hochgeladen (20)

Human & Veterinary Respiratory Physilogy_DR.E.Muralinath_Associate Professor....
Human & Veterinary Respiratory Physilogy_DR.E.Muralinath_Associate Professor....Human & Veterinary Respiratory Physilogy_DR.E.Muralinath_Associate Professor....
Human & Veterinary Respiratory Physilogy_DR.E.Muralinath_Associate Professor....
 
Site Acceptance Test .
Site Acceptance Test .Site Acceptance Test .
Site Acceptance Test .
 
Clean In Place(CIP).pptx .
Clean In Place(CIP).pptx .Clean In Place(CIP).pptx .
Clean In Place(CIP).pptx .
 
❤Jammu Kashmir Call Girls 8617697112 Personal Whatsapp Number 💦✅.
❤Jammu Kashmir Call Girls 8617697112 Personal Whatsapp Number 💦✅.❤Jammu Kashmir Call Girls 8617697112 Personal Whatsapp Number 💦✅.
❤Jammu Kashmir Call Girls 8617697112 Personal Whatsapp Number 💦✅.
 
300003-World Science Day For Peace And Development.pptx
300003-World Science Day For Peace And Development.pptx300003-World Science Day For Peace And Development.pptx
300003-World Science Day For Peace And Development.pptx
 
Pests of cotton_Sucking_Pests_Dr.UPR.pdf
Pests of cotton_Sucking_Pests_Dr.UPR.pdfPests of cotton_Sucking_Pests_Dr.UPR.pdf
Pests of cotton_Sucking_Pests_Dr.UPR.pdf
 
Proteomics: types, protein profiling steps etc.
Proteomics: types, protein profiling steps etc.Proteomics: types, protein profiling steps etc.
Proteomics: types, protein profiling steps etc.
 
module for grade 9 for distance learning
module for grade 9 for distance learningmodule for grade 9 for distance learning
module for grade 9 for distance learning
 
Bacterial Identification and Classifications
Bacterial Identification and ClassificationsBacterial Identification and Classifications
Bacterial Identification and Classifications
 
Pests of mustard_Identification_Management_Dr.UPR.pdf
Pests of mustard_Identification_Management_Dr.UPR.pdfPests of mustard_Identification_Management_Dr.UPR.pdf
Pests of mustard_Identification_Management_Dr.UPR.pdf
 
Call Girls Ahmedabad +917728919243 call me Independent Escort Service
Call Girls Ahmedabad +917728919243 call me Independent Escort ServiceCall Girls Ahmedabad +917728919243 call me Independent Escort Service
Call Girls Ahmedabad +917728919243 call me Independent Escort Service
 
Pests of cotton_Borer_Pests_Binomics_Dr.UPR.pdf
Pests of cotton_Borer_Pests_Binomics_Dr.UPR.pdfPests of cotton_Borer_Pests_Binomics_Dr.UPR.pdf
Pests of cotton_Borer_Pests_Binomics_Dr.UPR.pdf
 
Conjugation, transduction and transformation
Conjugation, transduction and transformationConjugation, transduction and transformation
Conjugation, transduction and transformation
 
Pulmonary drug delivery system M.pharm -2nd sem P'ceutics
Pulmonary drug delivery system M.pharm -2nd sem P'ceuticsPulmonary drug delivery system M.pharm -2nd sem P'ceutics
Pulmonary drug delivery system M.pharm -2nd sem P'ceutics
 
FAIRSpectra - Enabling the FAIRification of Analytical Science
FAIRSpectra - Enabling the FAIRification of Analytical ScienceFAIRSpectra - Enabling the FAIRification of Analytical Science
FAIRSpectra - Enabling the FAIRification of Analytical Science
 
Asymmetry in the atmosphere of the ultra-hot Jupiter WASP-76 b
Asymmetry in the atmosphere of the ultra-hot Jupiter WASP-76 bAsymmetry in the atmosphere of the ultra-hot Jupiter WASP-76 b
Asymmetry in the atmosphere of the ultra-hot Jupiter WASP-76 b
 
COST ESTIMATION FOR A RESEARCH PROJECT.pptx
COST ESTIMATION FOR A RESEARCH PROJECT.pptxCOST ESTIMATION FOR A RESEARCH PROJECT.pptx
COST ESTIMATION FOR A RESEARCH PROJECT.pptx
 
Sector 62, Noida Call girls :8448380779 Model Escorts | 100% verified
Sector 62, Noida Call girls :8448380779 Model Escorts | 100% verifiedSector 62, Noida Call girls :8448380779 Model Escorts | 100% verified
Sector 62, Noida Call girls :8448380779 Model Escorts | 100% verified
 
Zoology 5th semester notes( Sumit_yadav).pdf
Zoology 5th semester notes( Sumit_yadav).pdfZoology 5th semester notes( Sumit_yadav).pdf
Zoology 5th semester notes( Sumit_yadav).pdf
 
9654467111 Call Girls In Raj Nagar Delhi Short 1500 Night 6000
9654467111 Call Girls In Raj Nagar Delhi Short 1500 Night 60009654467111 Call Girls In Raj Nagar Delhi Short 1500 Night 6000
9654467111 Call Girls In Raj Nagar Delhi Short 1500 Night 6000
 

Ransomware: Emergence of the Cyber-Extortion Menace

  • 1. Security Research Institute Edith Cowan University Ransomware Emergence of the Cyber-Extortion Menace Nikolai Hampton1 and Zubair A. Baig1,2 School of Computer and Security Science1, Security Research Institute2 Edith Cowan University Perth, Australia nikolaih@our.ecu.edu.au, z.baig@ecu.edu.au December, 2015
  • 2. Security Research Institute Edith Cowan University Ransomware – What is it? Ransomware: (noun)… “Ransomware is a type of malware that prevents or limits users from accessing their system. This type of malware forces its victims to pay the ransom through certain online payment methods in order to grant access to their systems, or to get their data back.” (TrendMicro, n.d.)
  • 3. Security Research Institute Edith Cowan University It’s a hot topic…
  • 4. Security Research Institute Edith Cowan University Some history • PC CYBORG (AIDS) Ransomware emerged in 1989. Distributed on floppy disks… Source: https://commons.wikimedia.org/wiki/File:Floppy_disk_2009_G1.jpg Anyone remember these?
  • 5. Security Research Institute Edith Cowan University Some history • PC CYBORG (AIDS Disk) – Emerged in 1989. Distributed on floppy disks – Installed from Trojan software – Lay dormant to allow time for propagation – Used operating basic encryption and operating system quirks to “scramble” and hide files – Demanded a “License Payment” to be sent via cheque to a post office box in Panama
  • 6. Security Research Institute Edith Cowan University Some history • PC CYBORG (AIDS) - 1989 – Not very successful – Technology was lagging behind the idea
  • 7. Security Research Institute Edith Cowan University Some history • Malware continued to develop 1990s – 2000s – Identity theft – Phishing scams, stealing passwords – Bot Nets – Networks of compromised PCs – Adware …but where was ransomware?
  • 8. Security Research Institute Edith Cowan University Some history Where’s Ransomware 1990s-2000s Very small percent of Malware! Too complicated, how to get money? Too risky, how to stay hidden? Too weak, how to “Denial of Service” an uncontrolled PC? Occasional “fake” ransom, or Anti Virus, easily defeated / removed Occasional “locker” that affected boot process, easily defeated / removed (CC) BitDefender España (2010) Source: https://www.flickr.com/photos/bitdefenderes/4292753852 Source: http://www.acma.gov.au/~/media/mediacomms/Social%20Media/Images/Ransomware%20Screenshot%20jpg.jpg Australian Communication and MediaAuthority (2013)
  • 9. Security Research Institute Edith Cowan University Why is it important now? • In 2010, something changed… Google search trends “ransomware” searches 2008 to 2015 • In 2012, something changed, a lot!
  • 10. Security Research Institute Edith Cowan University Reality Check - Perspective Google search trends “ransomware” searches 2008 to 2015 Google search trends “ransomware” searches vs “malware” searches 2008 to 2015
  • 11. Security Research Institute Edith Cowan University So it’s just a pest? • At the moment yes, but it’s getting a lot of coverage.
  • 12. Security Research Institute Edith Cowan University Why is it important now? • Technology has caught up to the idea! Step 1: Idea! Ransom money from people! Step 3: Profit… Step 2: Use technology to enable the idea! Image: Jodi Meadows (2011), Flickr https://www.flickr.com/photos/69585952@N00/
  • 13. Security Research Institute Edith Cowan University The perfect storm • Technology has caught up to the idea! – CTB Locker: Curve, TOR, Bitcoin  Strong encryption  Anonymity  Untraceable crypto-cash payments
  • 14. Security Research Institute Edith Cowan University So, here we are – our research Ransomware Emergence of the Cyber-Extortion Menace
  • 15. Security Research Institute Edith Cowan University Aim • Understand the ransomware threat… • Lay the foundation for extrapolating future ransomware development • Focus on the ransomware payload separately from the dropper • Extend existing research and ideas Young, A., & Yung, M. (1996). Cryptovirology: Extortion-Based Security Threats and Countermeasures.
  • 16. Security Research Institute Edith Cowan University What we did… • Propose a nomenclature for ransomware “traits” • Record the history and traits of ransomware strains over time • Developed a ransomware traits database • Chart the inclusion / exclusion of traits over time • Examine which traits have conferred benefits – Impact – Longevity – Profitability (for the attackers)
  • 17. Security Research Institute Edith Cowan University What we did…
  • 18. Security Research Institute Edith Cowan University What we did… • An overview of ransomware examined: – Twenty-nine variants – Nine ransomware families (PC Cyborg, GPCode, Reveton, CryptoLocker, CryptoDefense,CryptoWall, CTB-Locker, TeslaCrypt) – Twenty-two traits examined (Encrypts, Strong Cypher, PKI, Autonomous, TOR…)
  • 19. Security Research Institute Edith Cowan University Results Complete√ X O Broken Partial Traits Expressed
  • 20. Security Research Institute Edith Cowan University Results • Increasing use of security technology over time.. 0 2 4 6 8 10 12 14 < 2004 2004-2005 2006-2007 2008-2009 2010-2011 2012-2013 2014+ Ransomware strains surveyed and use of new technologies # of strains surveyed Bitcoin Uptake TOR Uptake
  • 21. Security Research Institute Edith Cowan University Evolution of GPCode’s encryption GPCode 2004 Used one byte encryption key, easily defeated Electronic payments GPCode.ac (June 2005) Implemented RSA Public Key Cryptography (PKI) Very weak key (56bit RSA modulus = 7 bit symmetric key) GPCode.ad (April 2006) Longer RSA keys but still poor PKI implementation GPCode.ag (June 2006) Finally, a strong RSA key (660 bit = ~60 bit symmetric) Cracked by Kaspersky, probably a coding error in .ag GPCode.ak (June 2008) Properly implemented 1024 bit RSA key Failed due to implementation of wrong “cipher” RC4, vulnerable to cryptanalysis GPCode.ax (December 2010) – A copycat… Unbreakable encryption … but still can be stopped (it has flaws)
  • 22. Security Research Institute Edith Cowan University Evolution of Command and Control • GPCode (2004) – No C&C (C2) Server, just “did its thing” – Contact malware producer via email for unlock code • Reveton (2012) – Doesn’t encrypt but uses C2 server for ‘unlock’ • Cryptolocker (2013) – Uses C2 server, to retrieve RSA public key (much more secure) – Pseudo Random “Domain Generation Algorithm” (DGA) to avoid easy takedowns (contacts garbage URLs: xxgrradvvzcfyx.biz) • Cryptowall (2014) – Uses C2 server on TOR – hidden and anonymous network! – Improved DGA to make takedown even harder
  • 23. Security Research Institute Edith Cowan University New command and control Compromised System Encrypted I2P‘darknet’link AnonymousC2 Server Upload infected PC details (registration) Acknowledgement Initialisation Download encryption key request Public key response Request for ransom image and text resources Image and decryption text instructions Dataencryption/ destruction begins Keyverificationandimport usingWindowscryptoAPIs CryptoWall execution I2Pproxy connection to C2 server I2P proxy Malspam or Angler EK Dropper * * Angler Exploit Kit may use single phase malware installation without dropper ! ! ! ! ! ! potential contact points for attack disruption © Ni kol ai Hampt on, 2015 - Thi s wor k i s l i cens ed under CC BY ( ht t p: / / cr eat i vecommons . or g/ l i cens es / by/ 3. 0/ )
  • 24. Security Research Institute Edith Cowan University What does it mean? • Ransomware is evolving • Responding to new defences • Profit Virus Image CC BY 2.0 Flickr: NIAID https://www.flickr.com/photos/niaid/
  • 25. Security Research Institute Edith Cowan University Breaking broken news • CryptoWall 4.0 – New traits (filename scrambling) – Obliterates restore points – Improved network security evasion
  • 26. Security Research Institute Edith Cowan University What can users do? • Classic Defense-In-Depth approach – Multi Layer – Device Protection – Network Protection • Backups – Still good, but…
  • 27. Security Research Institute Edith Cowan University Future work and questions? • Opportunity to apply some funky statistics – Through trait impact analysis – BIA/Longevity/Destructiveness Index • Machine learning (pattern recognition) • Improve the naming and reporting of ransomware • Collective collaboration
  • 28. Security Research Institute Edith Cowan University Conclusion • We examined the ransomware threat and the emergence of traits over the last 26 years • We were able to identify evolutionary patterns in most strains • Given the changing risk/reward structure it’s hard to believe this isn’t going to get much bigger • This shows it is a threat we can not dismiss
  • 29. Security Research Institute Edith Cowan University Thanks for your time! ?

Hinweis der Redaktion

  1. This diagram explains it better than I ever could