Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/5/2014
03:05 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

How Researchers Helped Cripple CryptoLocker

A Black Hat USA speaker will give the backstory on how he and others helped disrupt the infamous CyptoLocker operation, and what they learned about it.

The big news this week that a global team of law enforcement agencies and security researchers has disrupted a sophisticated and infamous ransomware operation came as no surprise to Lance James.

James, head of cyber intelligence at Deloitte & Touche, had worked with the FBI on the case, providing intelligence from a sinkhole he and his team had built to capture CryptoLocker traffic. CryptoLocker has been on the radar screen of the law enforcement and security communities for some time, and the alliance of agencies and security researchers did some serious damage to the operation by disrupting the GameoverZeuS botnet that transports it, as well as by seizing the key command and control servers used with CryptoLocker.

CryptoLocker, which encrypts the victim's files on local drives' network shares using strong encryption, has dogged enterprises for months. The attack typically begins with a convincing-looking spearphishing email and attachment, which, installs the Zeus Trojan when opened. Zeus then grabs and installs CryptoLocker, and a victim gets locked out of his own machine before he knows he's got malware.

"It targets corporate... the first victim we found" was a high-level business executive, James says. "The value of your information [is] worth a lot more" than the ransom fee in most cases.

Faced with fessing up to the company for falling for the ransomware, some victims pay the ransom of $300 or so to get their data decrypted.

James says a coordinated effort to quash CryptoLocker occurred mainly due to worries that it could become an epidemic. "It would have been an epidemic" if no one had intervened. He will share details and insight into his team's research and sinkhole effort, as well as the coordination with law enforcement, in a presentation for Black Hat USA in August, "The New Scourge Of Ransomware: A Study Of CryptoLocker And Its Friends."

CryptoLocker marked a new generation of ransomware, where attackers demand payment to give users back control of their machines. It uses strong encryption, namely public key crypto. "They used the native Windows API library and actually did it correctly." The malware uses RSA 2048-bit keys and a private key on the command and control server. And attackers use AES 256-bit encryption to encrypt the victim's files.

"If you don't have access to the control server, you can't get those files back," James says. "In the old days, there would be a symmetric key in the malware you could find and decrypt. Some [ransomware] didn't even encrypt. They just locked" the machine.

The organization behind CryptoLocker is highly organized -- and making big bucks. According to James, the gang received about $100 million in ransom payments in its first year. Victims can end up paying hundreds of dollars to regain access to their data, but even paying up doesn't guarantee getting your data back. Also, the attackers could sell your files in the underground for profit.

Another big piece of the law enforcement crackdown this week was the indictment of the GameoverZeuS botnet administrator, a Russian national, on charges of conspiracy, hacking, wire fraud, bank fraud, and money laundering associated with the botnet, as well as other charges for his role in CryptoLocker. James says the indictment helps instill a little fear, whether the alleged cybercriminal is extradited to face his crimes or not.

Meanwhile, James's team has been stalking CryptoLocker via the sinkholes. "That blocks a lot of attacks. They generate about 1,000 domains a day." The researchers try to get ahead of the new domains, which are built via the Domain Generation Algorithm (DGA), by grabbing up the next ones in line and registering them.

"We start to register them ahead of time and get the sinkholes in place," he says. "This allows a lot of the [victims] to go to the sinkhole" server, which slows down the attackers and gives the defenders time to block them. "We started lowering the effect of CryptoLocker over time."

James says he knows what CryptoLocker's backend infrastructure looks like, and he plans to provide more detail on that in his Black Hat talk.

So if antivirus tools aren't catching CryptoLocker quickly enough or at all, what's the best defense? "Backup," he says. "The big message is about resiliency and business continuity. You have to assume you might get hit with something, and assume you're in a hostile environment."

Now that CryptoLocker has been thwarted, at least temporarily, the attackers may go to a peer-to-peer infrastructure and use the Tor anonymization service. "It would be hard to see the servers then."

James was the featured guest on yesterday's episode of Dark Reading Radio. The archive of the broadcast is available here.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
6/11/2014 | 11:39:16 AM
Re: Increased Defense Documentation
@Kelly Jackson Higgins

I have to agree with you on that.  And I think that is exactly what needs to happen, not only between standard law enforcement, but every agency across the US charged with safeguarding data and assets.  Then, across country borders, there needs to be a stronger coalition of investigative entities - more cooperation, more threats neutralized, here and across the globe.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
6/11/2014 | 9:03:24 AM
Re: Increased Defense Documentation
I think that is true, but there are still a lot of proprietary/considentiality issues that have to be worked out, especially among people working in the security industry. It's a good start, though.
Kelly Jackson Higgins
100%
0%
Kelly Jackson Higgins,
User Rank: Strategist
6/11/2014 | 8:07:58 AM
Re: Increased Defense Documentation
What's especially interesting about this disruption operation is how there was a healthy degree of two-way sharing of information between law enforcement and researchers involved in the investigation. I think all parties are becoming more comfortable working together, and realize they need to work as a team to make any dent on cyber crime. 
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
6/9/2014 | 9:39:42 AM
Increased Defense Documentation
I look forward to hearing more on this.  With the proliferation of exploits and hacking how-tos, I think the more we see of defense strategy documentation, by way of articles, whitepapers and books, the closer we'll be to levelling out what to some has seemed like a continued leaning toward offensive hacking documentation and not enough defensive publishing.
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-36124
PUBLISHED: 2021-05-07
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by XML External Entity (XXE) injection. An authenticated attacker can compromise the private keys of a JWT token and reuse them to manipulate the access tokens to access the platform as any desired user (clients and administrators).
CVE-2020-36125
PUBLISHED: 2021-05-07
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control where password revalidation in sensitive operations can be bypassed remotely by an authenticated attacker through requesting the endpoint directly.
CVE-2020-36126
PUBLISHED: 2021-05-07
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control that can lead to remote privilege escalation. PAXSTORE marketplace endpoints allow an authenticated user to read and write data not owned by them, including third-party users, application and payment term...
CVE-2020-36127
PUBLISHED: 2021-05-07
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by an information disclosure vulnerability. Through the PUK signature functionality, an administrator will not have access to the current p12 certificate and password. When accessing this functionality, the administrator has the opt...
CVE-2020-36128
PUBLISHED: 2021-05-07
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by a token spoofing vulnerability. Each payment terminal has a session token (called X-Terminal-Token) to access the marketplace. This allows the store to identify the terminal and make available the applications distributed by its ...