SlideShare ist ein Scribd-Unternehmen logo

3Es of Ransomware

•Als PPTX, PDF herunterladen•
•
Sunil Kumar
Sunil Kumar

n|u Pune Meet December 2016

Internet
1 von 23
3Es of Ransomware Economy  Evolution  Evaluation
Who am I? • Threat Researcher for money. • Interested in • Things commonly considered criminal. • Reach me • @_badbot • badboy16a@gmail.com
Ransomware “Never before in the history of human kind have people across the world been subjected to extortion on a massive scale as they are today.”
Why this? • $445 Billion • The amount cybercrime will cost the global economy in 2016. The primary driver of loss will be ransomware. • +300% • The increase in ransomware attacks from Q1 of 2016 compared to Q1 2015. That’s as many as 4,000 ransomware attacks per day. • 60 Seconds • The time it takes a hacker to compromise a computer with ransomware.
Components
Economy • About 1,425% ROI for 30 days campaign. • Investment : $5,900 USD • Delivery • Infection • C&C • Earnings: $90,000 USD • 10% infection • 0.5% payment • $300 Ransom • Profit: $84,100
Economy • About 39% of enterprises were attacked, ~40% paid to the attackers. • $209 million payments in the first three months of 2016. • Estimated to be a $1 billion a year
Evolution
Evolution • AIDS/PC Cyborg : 1989 • Author: Joseph L. Popp • Delivery: 20,000 infected floppies. • Target: Attendees of WHO conference on AIDS. • Payout: $189 USD to PO Box in Panama. • Behavior: Encrypted file names and hide directories after 90 reboots.
Evolution • GPCoder : 2005 • Discovered and Researched by Kaspersky Lab. • First use of PKI. • RC4 + RSA. • Original file is Deleted. • Payout: $100-$200 in E-Gold/Liberty Reserve account. • StopGPCode was released to recover files.
Evolution • WinLock : 2010 • System Locker. • Ransom: 1 premium SMS of ~$10. • Displaying porn. • Unnamed : 2011 • System Locker. • Imitated Windows Activation Dialog. • Asked to call fake activation support phone.
Evolution • Reveton: 2012 • System Locker • Accused user’s of having illegal material. • Threatened action from FBI if “fine” is not paid. • Based on Zeus and Citadel. • Kotver : 2013 • System Lokcer • Waits for certain actions.
Evolution • CryptoLocker : 2013 • Return of encryption. • Generated 2048 bit RSA key pair. • Uploaded private key to server. • Asked payment in Bitcoin. • Taken down by government in 2014. • At least $3 million extortion.
Evolution • CryptoWall: 2014 • Used TOR from v1.0. • Distributed via malvertising. • Used digitally signed payload. • Estimated losses of $18 million by June 2015. • Locky: 2015 • Ransomware for hire. • Adds .locky extension to encrypted files • Mostly distributed via spam emails. • Attachments with macros.
Evaluation
Infection : Dropper • Attachment with macro • Macro activation. • Scripts • js/jse • vbs/vbe • wsf • ps1 • HTML • HTA
Infection : Payload • EXE • Custom Packers • Installer Package • DLL • Python • Fs0ciety • PS1 • PowerWare • Cerber
Setup • No Recovery • vssadmin delete shadows /for=d: /all • WMIC.exe "shadowcopy delete“ • Bcdedit.exe "/set {default} recoveryenabled no“ • Bcdedit.exe "/set {default} bootstatuspolicy ignoreallfailures • Registry Entries • Autorun • key+IV • TypeHandler • Encryption Key • UUID • SerialNumber
Encryption • Targets • File Types • doc, xls, ppt, jpg… • Disks • Extensions • locky, crypt, locked, [random]… • Exclusions • Program Files • Windows • .exe, .dll, .sys
Ransom • Display Note • MessageBox • Window • Wallpaper • Image • HTML/TEXT/URL • Content • Encryption Algorithm • Amount • SystemID/UserID • URL for bitcoin transfer • Proof of decryption
Recovery • Decryption/Eradication Tools • Kaspersky • WildFire, Shade, Rakhni, SMASH, CoinVault, XORIST… • TrendMicro • CryptXXX(1,2,3,4,5), Crysis, TeslaCrypt, Cerber V1, Nemucod… • https://www.nomoreransom.org/decryption-tools.html • Recovery tools • Photorec
Education • Avoid ransomware • Don’t click • Unplug immediately • Don’t pay • Backup • Disconnected • Full Snapshots • Offline restoration • Update
Question?

Empfohlen

Ransomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, PreventionRansomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, PreventionMohammad Yahya
 
Ransomware: History, Analysis, & Mitigation - PDF
Ransomware: History, Analysis, & Mitigation - PDFRansomware: History, Analysis, & Mitigation - PDF
Ransomware: History, Analysis, & Mitigation - PDFAndy Thompson
 
Ransomware: Mitigation Through Preparation
Ransomware: Mitigation Through PreparationRansomware: Mitigation Through Preparation
Ransomware: Mitigation Through PreparationHostway|HOSTING
 
Ransomware the clock is ticking
Ransomware the clock is tickingRansomware the clock is ticking
Ransomware the clock is tickingManoj Kumar Mishra
 
Malware's Most Wanted: CryptoLocker—The Ransomware Trojan
Malware's Most Wanted: CryptoLocker—The Ransomware TrojanMalware's Most Wanted: CryptoLocker—The Ransomware Trojan
Malware's Most Wanted: CryptoLocker—The Ransomware TrojanCyphort
 
Ransomware: How to avoid a crypto crisis at your IT business
Ransomware: How to avoid a crypto crisis at your IT businessRansomware: How to avoid a crypto crisis at your IT business
Ransomware: How to avoid a crypto crisis at your IT businessCalyptix Security
 
Ransomware
RansomwareRansomware
RansomwareChaitali Sharma
 
Ransomware
Ransomware Ransomware
Ransomware Armor
 

Empfohlen

Ransomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, PreventionRansomware - Impact, Evolution, Prevention
Ransomware - Impact, Evolution, PreventionMohammad Yahya
 
Ransomware: History, Analysis, & Mitigation - PDF
Ransomware: History, Analysis, & Mitigation - PDFRansomware: History, Analysis, & Mitigation - PDF
Ransomware: History, Analysis, & Mitigation - PDFAndy Thompson
 
Ransomware: Mitigation Through Preparation
Ransomware: Mitigation Through PreparationRansomware: Mitigation Through Preparation
Ransomware: Mitigation Through PreparationHostway|HOSTING
 
Ransomware the clock is ticking
Ransomware the clock is tickingRansomware the clock is ticking
Ransomware the clock is tickingManoj Kumar Mishra
 
Malware's Most Wanted: CryptoLocker—The Ransomware Trojan
Malware's Most Wanted: CryptoLocker—The Ransomware TrojanMalware's Most Wanted: CryptoLocker—The Ransomware Trojan
Malware's Most Wanted: CryptoLocker—The Ransomware TrojanCyphort
 
Ransomware: How to avoid a crypto crisis at your IT business
Ransomware: How to avoid a crypto crisis at your IT businessRansomware: How to avoid a crypto crisis at your IT business
Ransomware: How to avoid a crypto crisis at your IT businessCalyptix Security
 
Ransomware
RansomwareRansomware
RansomwareChaitali Sharma
 
Ransomware
Ransomware Ransomware
Ransomware Armor
 
Ransomware: Emergence of the Cyber-Extortion Menace
Ransomware: Emergence of the Cyber-Extortion MenaceRansomware: Emergence of the Cyber-Extortion Menace
Ransomware: Emergence of the Cyber-Extortion MenaceZubair Baig
 
Ransomware - The Growing Threat
Ransomware - The Growing ThreatRansomware - The Growing Threat
Ransomware - The Growing ThreatNick Miller
 
Ransomware: History, Analysis, & Mitigation
Ransomware: History, Analysis, & MitigationRansomware: History, Analysis, & Mitigation
Ransomware: History, Analysis, & MitigationWhiskeyNeon
 
Ransomware hostage rescue manual
Ransomware hostage rescue manualRansomware hostage rescue manual
Ransomware hostage rescue manualRoel Palmaers
 
Ransomware by lokesh
Ransomware by lokeshRansomware by lokesh
Ransomware by lokeshLokesh Bysani
 
Documento Cisco su Ransomware: come affrontarlo
Documento Cisco su Ransomware: come affrontarloDocumento Cisco su Ransomware: come affrontarlo
Documento Cisco su Ransomware: come affrontarloMaticmind
 
Ransomeware
RansomewareRansomeware
RansomewareAbul Hossain Ripon
 
The rise of malware(ransomware)
The rise of malware(ransomware)The rise of malware(ransomware)
The rise of malware(ransomware)phexcom1
 
Analysing Ransomware
Analysing RansomwareAnalysing Ransomware
Analysing RansomwareNapier University
 
র‌্যানসমওয়্যার
র‌্যানসমওয়্যার র‌্যানসমওয়্যার
র‌্যানসমওয়্যার Titas Sarker
 
Security Threat Presentation
Security Threat PresentationSecurity Threat Presentation
Security Threat PresentationRobert Giannini
 
Ransomware 2017: New threats emerge
Ransomware 2017: New threats emergeRansomware 2017: New threats emerge
Ransomware 2017: New threats emergeSymantec Security Response
 
Cynet
CynetCynet
CynetYanivTaieb
 
Ransomware History and Monitoring Tips
Ransomware History and Monitoring TipsRansomware History and Monitoring Tips
Ransomware History and Monitoring TipsNetFort
 
Emerging Phishing Trends and Effectiveness of the Anti-Phishing Landing Page
Emerging Phishing Trends and Effectiveness of the Anti-Phishing Landing PageEmerging Phishing Trends and Effectiveness of the Anti-Phishing Landing Page
Emerging Phishing Trends and Effectiveness of the Anti-Phishing Landing PageCybersecurity Education and Research Centre
 
WannaCry Ransomware
WannaCry Ransomware WannaCry Ransomware
WannaCry RansomwareZoho Corporation
 
WannaCry / Wannacrypt Ransomware
WannaCry / Wannacrypt RansomwareWannaCry / Wannacrypt Ransomware
WannaCry / Wannacrypt RansomwareAyoub Rouzi
 
Step FWD IT_Ransomware-Guide
Step FWD IT_Ransomware-GuideStep FWD IT_Ransomware-Guide
Step FWD IT_Ransomware-Guidechrismannering
 
Wannacry
WannacryWannacry
WannacryGunther Clauwaert
 
Ransomware: Wannacry
Ransomware: WannacryRansomware: Wannacry
Ransomware: WannacryMikel Solabarrieta
 
Buffer overflow null
Buffer overflow nullBuffer overflow null
Buffer overflow nullnullowaspmumbai
 
Http2 Security Perspective
Http2 Security PerspectiveHttp2 Security Perspective
Http2 Security PerspectiveSunil Kumar
 

Weitere ähnliche Inhalte

Was ist angesagt?

Ransomware: Emergence of the Cyber-Extortion Menace
Ransomware: Emergence of the Cyber-Extortion MenaceRansomware: Emergence of the Cyber-Extortion Menace
Ransomware: Emergence of the Cyber-Extortion MenaceZubair Baig
 
Ransomware - The Growing Threat
Ransomware - The Growing ThreatRansomware - The Growing Threat
Ransomware - The Growing ThreatNick Miller
 
Ransomware: History, Analysis, & Mitigation
Ransomware: History, Analysis, & MitigationRansomware: History, Analysis, & Mitigation
Ransomware: History, Analysis, & MitigationWhiskeyNeon
 
Ransomware hostage rescue manual
Ransomware hostage rescue manualRansomware hostage rescue manual
Ransomware hostage rescue manualRoel Palmaers
 
Ransomware by lokesh
Ransomware by lokeshRansomware by lokesh
Ransomware by lokeshLokesh Bysani
 
Documento Cisco su Ransomware: come affrontarlo
Documento Cisco su Ransomware: come affrontarloDocumento Cisco su Ransomware: come affrontarlo
Documento Cisco su Ransomware: come affrontarloMaticmind
 
The rise of malware(ransomware)
The rise of malware(ransomware)The rise of malware(ransomware)
The rise of malware(ransomware)phexcom1
 
র‌্যানসমওয়্যার
র‌্যানসমওয়্যার র‌্যানসমওয়্যার
র‌্যানসমওয়্যার Titas Sarker
 
Security Threat Presentation
Security Threat PresentationSecurity Threat Presentation
Security Threat PresentationRobert Giannini
 
Ransomware History and Monitoring Tips
Ransomware History and Monitoring TipsRansomware History and Monitoring Tips
Ransomware History and Monitoring TipsNetFort
 
WannaCry / Wannacrypt Ransomware
WannaCry / Wannacrypt RansomwareWannaCry / Wannacrypt Ransomware
WannaCry / Wannacrypt RansomwareAyoub Rouzi
 
Step FWD IT_Ransomware-Guide
Step FWD IT_Ransomware-GuideStep FWD IT_Ransomware-Guide
Step FWD IT_Ransomware-Guidechrismannering
 

Was ist angesagt? (20)

Ransomware: Emergence of the Cyber-Extortion Menace
Ransomware: Emergence of the Cyber-Extortion MenaceRansomware: Emergence of the Cyber-Extortion Menace
Ransomware: Emergence of the Cyber-Extortion Menace
 
Ransomware - The Growing Threat
Ransomware - The Growing ThreatRansomware - The Growing Threat
Ransomware - The Growing Threat
 
Ransomware: History, Analysis, & Mitigation
Ransomware: History, Analysis, & MitigationRansomware: History, Analysis, & Mitigation
Ransomware: History, Analysis, & Mitigation
 
Ransomware hostage rescue manual
Ransomware hostage rescue manualRansomware hostage rescue manual
Ransomware hostage rescue manual
 
Ransomware by lokesh
Ransomware by lokeshRansomware by lokesh
Ransomware by lokesh
 
Documento Cisco su Ransomware: come affrontarlo
Documento Cisco su Ransomware: come affrontarloDocumento Cisco su Ransomware: come affrontarlo
Documento Cisco su Ransomware: come affrontarlo
 
Ransomeware
RansomewareRansomeware
Ransomeware
 
The rise of malware(ransomware)
The rise of malware(ransomware)The rise of malware(ransomware)
The rise of malware(ransomware)
 
Analysing Ransomware
Analysing RansomwareAnalysing Ransomware
Analysing Ransomware
 
র‌্যানসমওয়্যার
র‌্যানসমওয়্যার র‌্যানসমওয়্যার
র‌্যানসমওয়্যার
 
Security Threat Presentation
Security Threat PresentationSecurity Threat Presentation
Security Threat Presentation
 
Ransomware 2017: New threats emerge
Ransomware 2017: New threats emergeRansomware 2017: New threats emerge
Ransomware 2017: New threats emerge
 
Cynet
CynetCynet
Cynet
 
Ransomware History and Monitoring Tips
Ransomware History and Monitoring TipsRansomware History and Monitoring Tips
Ransomware History and Monitoring Tips
 
Emerging Phishing Trends and Effectiveness of the Anti-Phishing Landing Page
Emerging Phishing Trends and Effectiveness of the Anti-Phishing Landing PageEmerging Phishing Trends and Effectiveness of the Anti-Phishing Landing Page
Emerging Phishing Trends and Effectiveness of the Anti-Phishing Landing Page
 
WannaCry Ransomware
WannaCry Ransomware WannaCry Ransomware
WannaCry Ransomware
 
WannaCry / Wannacrypt Ransomware
WannaCry / Wannacrypt RansomwareWannaCry / Wannacrypt Ransomware
WannaCry / Wannacrypt Ransomware
 
Step FWD IT_Ransomware-Guide
Step FWD IT_Ransomware-GuideStep FWD IT_Ransomware-Guide
Step FWD IT_Ransomware-Guide
 
Wannacry
WannacryWannacry
Wannacry
 
Ransomware: Wannacry
Ransomware: WannacryRansomware: Wannacry
Ransomware: Wannacry
 

Andere mochten auch

Http2 Security Perspective
Http2 Security PerspectiveHttp2 Security Perspective
Http2 Security PerspectiveSunil Kumar
 
Security certifications
Security certificationsSecurity certifications
Security certificationsManas Deep
 
Beginner talk physical security - manasdeep
Beginner talk physical security - manasdeepBeginner talk physical security - manasdeep
Beginner talk physical security - manasdeepManas Deep
 
Metasploit For Beginners
Metasploit For BeginnersMetasploit For Beginners
Metasploit For BeginnersRamnath Shenoy
 
Network discovery - Inside out by Aakash Goel
Network discovery - Inside out by Aakash GoelNetwork discovery - Inside out by Aakash Goel
Network discovery - Inside out by Aakash GoelOWASP Delhi
 

Andere mochten auch (9)

Buffer overflow null
Buffer overflow nullBuffer overflow null
Buffer overflow null
 
Http2 Security Perspective
Http2 Security PerspectiveHttp2 Security Perspective
Http2 Security Perspective
 
Security certifications
Security certificationsSecurity certifications
Security certifications
 
Web Application Firewall
Web Application FirewallWeb Application Firewall
Web Application Firewall
 
Secure coding in C#
Secure coding in C#Secure coding in C#
Secure coding in C#
 
Beginner talk physical security - manasdeep
Beginner talk physical security - manasdeepBeginner talk physical security - manasdeep
Beginner talk physical security - manasdeep
 
Owasp top 10
Owasp top 10 Owasp top 10
Owasp top 10
 
Metasploit For Beginners
Metasploit For BeginnersMetasploit For Beginners
Metasploit For Beginners
 
Network discovery - Inside out by Aakash Goel
Network discovery - Inside out by Aakash GoelNetwork discovery - Inside out by Aakash Goel
Network discovery - Inside out by Aakash Goel
 

Ähnlich wie 3Es of Ransomware

Cyber crimes Challenges in Global and Oman
Cyber crimes Challenges in Global and OmanCyber crimes Challenges in Global and Oman
Cyber crimes Challenges in Global and OmanMubarak Al Hadadi
 
CYBERCRIME AND MONEY LAUNDERING
CYBERCRIME AND MONEY LAUNDERINGCYBERCRIME AND MONEY LAUNDERING
CYBERCRIME AND MONEY LAUNDERINGJyotisheklingji
 
Insurance Cyber Risks Presentation
Insurance Cyber Risks PresentationInsurance Cyber Risks Presentation
Insurance Cyber Risks PresentationNeville Cartwright
 
Enterprise security: ransomware in enterprise and corporate entities
Enterprise security: ransomware in enterprise and corporate entitiesEnterprise security: ransomware in enterprise and corporate entities
Enterprise security: ransomware in enterprise and corporate entitiesQuick Heal Technologies Ltd.
 
Forensic And Cloud Computing
Forensic And Cloud ComputingForensic And Cloud Computing
Forensic And Cloud ComputingMitesh Katira
 
Business under cyberassault
Business under cyberassaultBusiness under cyberassault
Business under cyberassaultMohammad Husain
 
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Roger Hagedorn
 
Cyber Security Presentation "It Will Never Happen To Me"
Cyber Security Presentation "It Will Never Happen To Me" Cyber Security Presentation "It Will Never Happen To Me"
Cyber Security Presentation "It Will Never Happen To Me" Simon Salter
 
Cyber Security Presentation - IT Will Never Happen To Me
Cyber Security Presentation - IT Will Never Happen To MeCyber Security Presentation - IT Will Never Happen To Me
Cyber Security Presentation - IT Will Never Happen To MeSimon Salter
 
How to stay protected against ransomware
How to stay protected against ransomwareHow to stay protected against ransomware
How to stay protected against ransomwareSophos Benelux
 
Cybercrime trends in last five years
Cybercrime trends in last five yearsCybercrime trends in last five years
Cybercrime trends in last five yearsSABBY GILL
 
Cybercriminals focus on Cryptocurrency
Cybercriminals focus on CryptocurrencyCybercriminals focus on Cryptocurrency
Cybercriminals focus on CryptocurrencyAhmad El Tawil
 

Ähnlich wie 3Es of Ransomware (20)

Cybercrime
CybercrimeCybercrime
Cybercrime
 
Ransomware : A cyber crime without solution ? by Prashant Mali
Ransomware : A cyber crime without solution ? by Prashant MaliRansomware : A cyber crime without solution ? by Prashant Mali
Ransomware : A cyber crime without solution ? by Prashant Mali
 
Deep and Dark internet Safari, How to hire a hacker? Robbrecht van Amerongen
Deep and Dark internet Safari, How to hire a hacker? Robbrecht van AmerongenDeep and Dark internet Safari, How to hire a hacker? Robbrecht van Amerongen
Deep and Dark internet Safari, How to hire a hacker? Robbrecht van Amerongen
 
Brooks18
Brooks18Brooks18
Brooks18
 
Cyber crimes Challenges in Global and Oman
Cyber crimes Challenges in Global and OmanCyber crimes Challenges in Global and Oman
Cyber crimes Challenges in Global and Oman
 
AtlSecCon 2016
AtlSecCon 2016AtlSecCon 2016
AtlSecCon 2016
 
CYBERCRIME AND MONEY LAUNDERING
CYBERCRIME AND MONEY LAUNDERINGCYBERCRIME AND MONEY LAUNDERING
CYBERCRIME AND MONEY LAUNDERING
 
Cyber crimes
Cyber crimesCyber crimes
Cyber crimes
 
Insurance Cyber Risks Presentation
Insurance Cyber Risks PresentationInsurance Cyber Risks Presentation
Insurance Cyber Risks Presentation
 
Enterprise security: ransomware in enterprise and corporate entities
Enterprise security: ransomware in enterprise and corporate entitiesEnterprise security: ransomware in enterprise and corporate entities
Enterprise security: ransomware in enterprise and corporate entities
 
Forensic And Cloud Computing
Forensic And Cloud ComputingForensic And Cloud Computing
Forensic And Cloud Computing
 
Business under cyberassault
Business under cyberassaultBusiness under cyberassault
Business under cyberassault
 
News Bytes - December 2015
News Bytes - December 2015News Bytes - December 2015
News Bytes - December 2015
 
Private Date and PRYING Eyes - Talking Cybersecurity at After Work Network
Private Date and PRYING Eyes - Talking Cybersecurity at After Work NetworkPrivate Date and PRYING Eyes - Talking Cybersecurity at After Work Network
Private Date and PRYING Eyes - Talking Cybersecurity at After Work Network
 
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
Your Money or Your Data: Ransomware, Cyber Security and Today’s Threat Landsc...
 
Cyber Security Presentation "It Will Never Happen To Me"
Cyber Security Presentation "It Will Never Happen To Me" Cyber Security Presentation "It Will Never Happen To Me"
Cyber Security Presentation "It Will Never Happen To Me"
 
Cyber Security Presentation - IT Will Never Happen To Me
Cyber Security Presentation - IT Will Never Happen To MeCyber Security Presentation - IT Will Never Happen To Me
Cyber Security Presentation - IT Will Never Happen To Me
 
How to stay protected against ransomware
How to stay protected against ransomwareHow to stay protected against ransomware
How to stay protected against ransomware
 
Cybercrime trends in last five years
Cybercrime trends in last five yearsCybercrime trends in last five years
Cybercrime trends in last five years
 
Cybercriminals focus on Cryptocurrency
Cybercriminals focus on CryptocurrencyCybercriminals focus on Cryptocurrency
Cybercriminals focus on Cryptocurrency
 

Mehr von Sunil Kumar

Basics of Cryptography
Basics of CryptographyBasics of Cryptography
Basics of CryptographySunil Kumar
 
Memory forensics
Memory forensicsMemory forensics
Memory forensicsSunil Kumar
 
n|u Dharamsala Humla : Memory Forensic by Tenzin Chokden
n|u Dharamsala Humla : Memory Forensic by Tenzin Chokdenn|u Dharamsala Humla : Memory Forensic by Tenzin Chokden
n|u Dharamsala Humla : Memory Forensic by Tenzin ChokdenSunil Kumar
 
Jsonp null-meet-02-2015
Jsonp null-meet-02-2015Jsonp null-meet-02-2015
Jsonp null-meet-02-2015Sunil Kumar
 
Dt5 varenni win_pcapdosdonts
Dt5 varenni win_pcapdosdontsDt5 varenni win_pcapdosdonts
Dt5 varenni win_pcapdosdontsSunil Kumar
 
Nullcon 2011- Behaviour Analysis with DBI
Nullcon 2011- Behaviour Analysis with DBINullcon 2011- Behaviour Analysis with DBI
Nullcon 2011- Behaviour Analysis with DBISunil Kumar
 

Mehr von Sunil Kumar (6)

Basics of Cryptography
Basics of CryptographyBasics of Cryptography
Basics of Cryptography
 
Memory forensics
Memory forensicsMemory forensics
Memory forensics
 
n|u Dharamsala Humla : Memory Forensic by Tenzin Chokden
n|u Dharamsala Humla : Memory Forensic by Tenzin Chokdenn|u Dharamsala Humla : Memory Forensic by Tenzin Chokden
n|u Dharamsala Humla : Memory Forensic by Tenzin Chokden
 
Jsonp null-meet-02-2015
Jsonp null-meet-02-2015Jsonp null-meet-02-2015
Jsonp null-meet-02-2015
 
Dt5 varenni win_pcapdosdonts
Dt5 varenni win_pcapdosdontsDt5 varenni win_pcapdosdonts
Dt5 varenni win_pcapdosdonts
 
Nullcon 2011- Behaviour Analysis with DBI
Nullcon 2011- Behaviour Analysis with DBINullcon 2011- Behaviour Analysis with DBI
Nullcon 2011- Behaviour Analysis with DBI
 

Kürzlich hochgeladen

Call Girls South Delhi Delhi reach out to us at ☎ 9711199012
Call Girls South Delhi Delhi reach out to us at ☎ 9711199012Call Girls South Delhi Delhi reach out to us at ☎ 9711199012
Call Girls South Delhi Delhi reach out to us at ☎ 9711199012rehmti665
 
Contact Rya Baby for Call Girls New Delhi
Contact Rya Baby for Call Girls New DelhiContact Rya Baby for Call Girls New Delhi
Contact Rya Baby for Call Girls New Delhimiss dipika
 
办理多伦多大学毕业证成绩单|购买加拿大UTSG文凭证书
办理多伦多大学毕业证成绩单|购买加拿大UTSG文凭证书办理多伦多大学毕业证成绩单|购买加拿大UTSG文凭证书
办理多伦多大学毕业证成绩单|购买加拿大UTSG文凭证书zdzoqco
 
Blepharitis inflammation of eyelid symptoms cause everything included along w...
Blepharitis inflammation of eyelid symptoms cause everything included along w...Blepharitis inflammation of eyelid symptoms cause everything included along w...
Blepharitis inflammation of eyelid symptoms cause everything included along w...Excelmac1
 
Font Performance - NYC WebPerf Meetup April '24
Font Performance - NYC WebPerf Meetup April '24Font Performance - NYC WebPerf Meetup April '24
Font Performance - NYC WebPerf Meetup April '24Paul Calvano
 
办理(UofR毕业证书)罗切斯特大学毕业证成绩单原版一比一
办理(UofR毕业证书)罗切斯特大学毕业证成绩单原版一比一办理(UofR毕业证书)罗切斯特大学毕业证成绩单原版一比一
办理(UofR毕业证书)罗切斯特大学毕业证成绩单原版一比一z xss
 
Call Girls Near The Suryaa Hotel New Delhi 9873777170
Call Girls Near The Suryaa Hotel New Delhi 9873777170Call Girls Near The Suryaa Hotel New Delhi 9873777170
Call Girls Near The Suryaa Hotel New Delhi 9873777170Sonam Pathan
 
定制(AUT毕业证书)新西兰奥克兰理工大学毕业证成绩单原版一比一
定制(AUT毕业证书)新西兰奥克兰理工大学毕业证成绩单原版一比一定制(AUT毕业证书)新西兰奥克兰理工大学毕业证成绩单原版一比一
定制(AUT毕业证书)新西兰奥克兰理工大学毕业证成绩单原版一比一Fs
 
定制(UAL学位证)英国伦敦艺术大学毕业证成绩单原版一比一
定制(UAL学位证)英国伦敦艺术大学毕业证成绩单原版一比一定制(UAL学位证)英国伦敦艺术大学毕业证成绩单原版一比一
定制(UAL学位证)英国伦敦艺术大学毕业证成绩单原版一比一Fs
 
定制(Management毕业证书)新加坡管理大学毕业证成绩单原版一比一
定制(Management毕业证书)新加坡管理大学毕业证成绩单原版一比一定制(Management毕业证书)新加坡管理大学毕业证成绩单原版一比一
定制(Management毕业证书)新加坡管理大学毕业证成绩单原版一比一Fs
 
Git and Github workshop GDSC MLRITM
Git and Github workshop GDSC MLRITMGit and Github workshop GDSC MLRITM
Git and Github workshop GDSC MLRITMgdsc13
 
Call Girls Service Adil Nagar 7001305949 Need escorts Service Pooja Vip
Call Girls Service Adil Nagar 7001305949 Need escorts Service Pooja VipCall Girls Service Adil Nagar 7001305949 Need escorts Service Pooja Vip
Call Girls Service Adil Nagar 7001305949 Need escorts Service Pooja VipCall Girls Lucknow
 
定制(Lincoln毕业证书)新西兰林肯大学毕业证成绩单原版一比一
定制(Lincoln毕业证书)新西兰林肯大学毕业证成绩单原版一比一定制(Lincoln毕业证书)新西兰林肯大学毕业证成绩单原版一比一
定制(Lincoln毕业证书)新西兰林肯大学毕业证成绩单原版一比一Fs
 
Film cover research (1).pptxsdasdasdasdasdasa
Film cover research (1).pptxsdasdasdasdasdasaFilm cover research (1).pptxsdasdasdasdasdasa
Film cover research (1).pptxsdasdasdasdasdasa494f574xmv
 
Top 10 Interactive Website Design Trends in 2024.pptx
Top 10 Interactive Website Design Trends in 2024.pptxTop 10 Interactive Website Design Trends in 2024.pptx
Top 10 Interactive Website Design Trends in 2024.pptxDyna Gilbert
 
Call Girls In The Ocean Pearl Retreat Hotel New Delhi 9873777170
Call Girls In The Ocean Pearl Retreat Hotel New Delhi 9873777170Call Girls In The Ocean Pearl Retreat Hotel New Delhi 9873777170
Call Girls In The Ocean Pearl Retreat Hotel New Delhi 9873777170Sonam Pathan
 
Potsdam FH学位证,波茨坦应用技术大学毕业证书1:1制作
Potsdam FH学位证,波茨坦应用技术大学毕业证书1:1制作Potsdam FH学位证,波茨坦应用技术大学毕业证书1:1制作
Potsdam FH学位证,波茨坦应用技术大学毕业证书1:1制作ys8omjxb
 

Kürzlich hochgeladen (20)

young call girls in Uttam Nagar🔝 9953056974 🔝 Delhi escort Service
young call girls in Uttam Nagar🔝 9953056974 🔝 Delhi escort Serviceyoung call girls in Uttam Nagar🔝 9953056974 🔝 Delhi escort Service
young call girls in Uttam Nagar🔝 9953056974 🔝 Delhi escort Service
 
Call Girls South Delhi Delhi reach out to us at ☎ 9711199012
Call Girls South Delhi Delhi reach out to us at ☎ 9711199012Call Girls South Delhi Delhi reach out to us at ☎ 9711199012
Call Girls South Delhi Delhi reach out to us at ☎ 9711199012
 
Contact Rya Baby for Call Girls New Delhi
Contact Rya Baby for Call Girls New DelhiContact Rya Baby for Call Girls New Delhi
Contact Rya Baby for Call Girls New Delhi
 
办理多伦多大学毕业证成绩单|购买加拿大UTSG文凭证书
办理多伦多大学毕业证成绩单|购买加拿大UTSG文凭证书办理多伦多大学毕业证成绩单|购买加拿大UTSG文凭证书
办理多伦多大学毕业证成绩单|购买加拿大UTSG文凭证书
 
Blepharitis inflammation of eyelid symptoms cause everything included along w...
Blepharitis inflammation of eyelid symptoms cause everything included along w...Blepharitis inflammation of eyelid symptoms cause everything included along w...
Blepharitis inflammation of eyelid symptoms cause everything included along w...
 
Font Performance - NYC WebPerf Meetup April '24
Font Performance - NYC WebPerf Meetup April '24Font Performance - NYC WebPerf Meetup April '24
Font Performance - NYC WebPerf Meetup April '24
 
办理(UofR毕业证书)罗切斯特大学毕业证成绩单原版一比一
办理(UofR毕业证书)罗切斯特大学毕业证成绩单原版一比一办理(UofR毕业证书)罗切斯特大学毕业证成绩单原版一比一
办理(UofR毕业证书)罗切斯特大学毕业证成绩单原版一比一
 
Call Girls Near The Suryaa Hotel New Delhi 9873777170
Call Girls Near The Suryaa Hotel New Delhi 9873777170Call Girls Near The Suryaa Hotel New Delhi 9873777170
Call Girls Near The Suryaa Hotel New Delhi 9873777170
 
定制(AUT毕业证书)新西兰奥克兰理工大学毕业证成绩单原版一比一
定制(AUT毕业证书)新西兰奥克兰理工大学毕业证成绩单原版一比一定制(AUT毕业证书)新西兰奥克兰理工大学毕业证成绩单原版一比一
定制(AUT毕业证书)新西兰奥克兰理工大学毕业证成绩单原版一比一
 
Model Call Girl in Jamuna Vihar Delhi reach out to us at 🔝9953056974🔝
Model Call Girl in Jamuna Vihar Delhi reach out to us at 🔝9953056974🔝Model Call Girl in Jamuna Vihar Delhi reach out to us at 🔝9953056974🔝
Model Call Girl in Jamuna Vihar Delhi reach out to us at 🔝9953056974🔝
 
定制(UAL学位证)英国伦敦艺术大学毕业证成绩单原版一比一
定制(UAL学位证)英国伦敦艺术大学毕业证成绩单原版一比一定制(UAL学位证)英国伦敦艺术大学毕业证成绩单原版一比一
定制(UAL学位证)英国伦敦艺术大学毕业证成绩单原版一比一
 
定制(Management毕业证书)新加坡管理大学毕业证成绩单原版一比一
定制(Management毕业证书)新加坡管理大学毕业证成绩单原版一比一定制(Management毕业证书)新加坡管理大学毕业证成绩单原版一比一
定制(Management毕业证书)新加坡管理大学毕业证成绩单原版一比一
 
Git and Github workshop GDSC MLRITM
Git and Github workshop GDSC MLRITMGit and Github workshop GDSC MLRITM
Git and Github workshop GDSC MLRITM
 
Call Girls Service Adil Nagar 7001305949 Need escorts Service Pooja Vip
Call Girls Service Adil Nagar 7001305949 Need escorts Service Pooja VipCall Girls Service Adil Nagar 7001305949 Need escorts Service Pooja Vip
Call Girls Service Adil Nagar 7001305949 Need escorts Service Pooja Vip
 
定制(Lincoln毕业证书)新西兰林肯大学毕业证成绩单原版一比一
定制(Lincoln毕业证书)新西兰林肯大学毕业证成绩单原版一比一定制(Lincoln毕业证书)新西兰林肯大学毕业证成绩单原版一比一
定制(Lincoln毕业证书)新西兰林肯大学毕业证成绩单原版一比一
 
Film cover research (1).pptxsdasdasdasdasdasa
Film cover research (1).pptxsdasdasdasdasdasaFilm cover research (1).pptxsdasdasdasdasdasa
Film cover research (1).pptxsdasdasdasdasdasa
 
Top 10 Interactive Website Design Trends in 2024.pptx
Top 10 Interactive Website Design Trends in 2024.pptxTop 10 Interactive Website Design Trends in 2024.pptx
Top 10 Interactive Website Design Trends in 2024.pptx
 
Hot Sexy call girls in Rk Puram 🔝 9953056974 🔝 Delhi escort Service
Hot Sexy call girls in Rk Puram 🔝 9953056974 🔝 Delhi escort ServiceHot Sexy call girls in Rk Puram 🔝 9953056974 🔝 Delhi escort Service
Hot Sexy call girls in Rk Puram 🔝 9953056974 🔝 Delhi escort Service
 
Call Girls In The Ocean Pearl Retreat Hotel New Delhi 9873777170
Call Girls In The Ocean Pearl Retreat Hotel New Delhi 9873777170Call Girls In The Ocean Pearl Retreat Hotel New Delhi 9873777170
Call Girls In The Ocean Pearl Retreat Hotel New Delhi 9873777170
 
Potsdam FH学位证,波茨坦应用技术大学毕业证书1:1制作
Potsdam FH学位证,波茨坦应用技术大学毕业证书1:1制作Potsdam FH学位证,波茨坦应用技术大学毕业证书1:1制作
Potsdam FH学位证,波茨坦应用技术大学毕业证书1:1制作
 

3Es of Ransomware

  • 1. 3Es of Ransomware Economy  Evolution  Evaluation
  • 2. Who am I? • Threat Researcher for money. • Interested in • Things commonly considered criminal. • Reach me • @_badbot • badboy16a@gmail.com
  • 3. Ransomware “Never before in the history of human kind have people across the world been subjected to extortion on a massive scale as they are today.”
  • 4. Why this? • $445 Billion • The amount cybercrime will cost the global economy in 2016. The primary driver of loss will be ransomware. • +300% • The increase in ransomware attacks from Q1 of 2016 compared to Q1 2015. That’s as many as 4,000 ransomware attacks per day. • 60 Seconds • The time it takes a hacker to compromise a computer with ransomware.
  • 6. Economy • About 1,425% ROI for 30 days campaign. • Investment : $5,900 USD • Delivery • Infection • C&C • Earnings: $90,000 USD • 10% infection • 0.5% payment • $300 Ransom • Profit: $84,100
  • 7. Economy • About 39% of enterprises were attacked, ~40% paid to the attackers. • $209 million payments in the first three months of 2016. • Estimated to be a $1 billion a year
  • 9. Evolution • AIDS/PC Cyborg : 1989 • Author: Joseph L. Popp • Delivery: 20,000 infected floppies. • Target: Attendees of WHO conference on AIDS. • Payout: $189 USD to PO Box in Panama. • Behavior: Encrypted file names and hide directories after 90 reboots.
  • 10. Evolution • GPCoder : 2005 • Discovered and Researched by Kaspersky Lab. • First use of PKI. • RC4 + RSA. • Original file is Deleted. • Payout: $100-$200 in E-Gold/Liberty Reserve account. • StopGPCode was released to recover files.
  • 11. Evolution • WinLock : 2010 • System Locker. • Ransom: 1 premium SMS of ~$10. • Displaying porn. • Unnamed : 2011 • System Locker. • Imitated Windows Activation Dialog. • Asked to call fake activation support phone.
  • 12. Evolution • Reveton: 2012 • System Locker • Accused user’s of having illegal material. • Threatened action from FBI if “fine” is not paid. • Based on Zeus and Citadel. • Kotver : 2013 • System Lokcer • Waits for certain actions.
  • 13. Evolution • CryptoLocker : 2013 • Return of encryption. • Generated 2048 bit RSA key pair. • Uploaded private key to server. • Asked payment in Bitcoin. • Taken down by government in 2014. • At least $3 million extortion.
  • 14. Evolution • CryptoWall: 2014 • Used TOR from v1.0. • Distributed via malvertising. • Used digitally signed payload. • Estimated losses of $18 million by June 2015. • Locky: 2015 • Ransomware for hire. • Adds .locky extension to encrypted files • Mostly distributed via spam emails. • Attachments with macros.
  • 16. Infection : Dropper • Attachment with macro • Macro activation. • Scripts • js/jse • vbs/vbe • wsf • ps1 • HTML • HTA
  • 17. Infection : Payload • EXE • Custom Packers • Installer Package • DLL • Python • Fs0ciety • PS1 • PowerWare • Cerber
  • 18. Setup • No Recovery • vssadmin delete shadows /for=d: /all • WMIC.exe "shadowcopy delete“ • Bcdedit.exe "/set {default} recoveryenabled no“ • Bcdedit.exe "/set {default} bootstatuspolicy ignoreallfailures • Registry Entries • Autorun • key+IV • TypeHandler • Encryption Key • UUID • SerialNumber
  • 19. Encryption • Targets • File Types • doc, xls, ppt, jpg… • Disks • Extensions • locky, crypt, locked, [random]… • Exclusions • Program Files • Windows • .exe, .dll, .sys
  • 20. Ransom • Display Note • MessageBox • Window • Wallpaper • Image • HTML/TEXT/URL • Content • Encryption Algorithm • Amount • SystemID/UserID • URL for bitcoin transfer • Proof of decryption
  • 21. Recovery • Decryption/Eradication Tools • Kaspersky • WildFire, Shade, Rakhni, SMASH, CoinVault, XORIST… • TrendMicro • CryptXXX(1,2,3,4,5), Crysis, TeslaCrypt, Cerber V1, Nemucod… • https://www.nomoreransom.org/decryption-tools.html • Recovery tools • Photorec
  • 22. Education • Avoid ransomware • Don’t click • Unplug immediately • Don’t pay • Backup • Disconnected • Full Snapshots • Offline restoration • Update

Hinweis der Redaktion

  1. Sean Murray
  2. Symantec-08/2015 “Ransom”: A sum of money demanded or paid for the release of a captive. Captive: Files/Systems Ransomware is a tool to facilitate Ransom. F-s0ciety http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-evolution-of-ransomware.pdf
  3. https://fightransomware.com/
  4. Return On Investment. Stats by Trustwave, CTBLoker as example. http://www.darkreading.com/analytics/cybercrime-can-give-attackers-1425--return-on-investment/d/d-id/1320756
  5. *2 : byFBI, based on reported cases. https://go.malwarebytes.com/OstermanRansomwareSurvey.html
  6. http://centracomm.net/wp-content/uploads/2016/06/the-rise-of-ransomware.png
  7. 1. Harvard-trained evolutionary biologist Joseph L. Popp. 4. PO Box in name of PC Cyborg Corp. 5. Ransom was asked as license fee to use the software.
  8. 1st in 2004. Custom symmetric encryption, 1 byte key. Easily defeated. GPCoder.ak proper 1024bit RSA+RC4. Deleted, so undelete was possible. RC4 => Easy cryptoanalysis.
  9. Police themed ransomware. Ransomware for OSX. Used webpage and clickjacking. Jay Matthew Riley, 21, of Woodbridge, Va, turned himself to police.
  10. Primarily distributed by the Gameover Zeus botnet Operation Tovar
  11. Cryptowall started as clone of Cryptolocker These variants have evolved. Clones/Mixed. Random extensions.
  12. Infection Key-Setup Encryption Ransom Demand
  13. Custom packers: Locky, TeslaCrypt DLL: Locky
  14. Autorun: Locky Key+iv: NoobLocker PricessLocker adds ransom note as .locked type handler.
  15. Cerber targets 294 different file extensions HDDCryptor uses component of open source tool.
  16. They usually display name of ransomware.
  17. Almost all AV vendors have some ransomware recovery. Not all versions are decryptable. NoMoreRansom: Kaspersky, Intel, Law Enforcement Recover Tools: TestDisk. Recuva
  18. Don’t pay : don’t listen to FBI Mount backups in ReadOnly mode while restoring.