|Operating system(s) affected||Windows|
CryptoLocker is a ransomware trojan which targets computers running Microsoft Windows and first surfaced in September 2013. A CryptoLocker attack may come from various sources; one such is disguised as a legitimate email attachment. When activated, the malware encrypts certain types of files stored on local and mounted network drives using RSA public-key cryptography, with the private key stored only on the malware's control servers. The malware then displays a message which offers to decrypt the data if a payment (through either Bitcoin or a pre-paid voucher) is made by a stated deadline, and threatens to delete the private key if the deadline passes. If the deadline is not met, the malware offers to decrypt data via an online service provided by the malware's operators, for a significantly higher price in Bitcoin.
Although CryptoLocker itself is readily removed, files remain encrypted in a way which researchers have considered infeasible to break. Many say that the ransom should not be paid, but do not offer any way to recover files; others say that paying the ransom is the only way to recover files that had not been backed up. No instance of the files being unlocked after payment can be verified.
CryptoLocker typically propagates as an attachment to a seemingly innocuous e-mail message, which appears to have been sent by legitimate company; or, it is uploaded to a computer already recruited to a botnet by a previous trojan infection. A ZIP file attached to an email message contains an executable file with the filename and the icon disguised as a PDF file, taking advantage of Windows' default behaviour of hiding the extension from file names to disguise the real .EXE extension. More detail on how a zip file can execute itself would be useful. Some instances may actually contain the Zeus trojan instead, which in turn installs CryptoLocker. When first run, the payload installs itself in the Documents and Settings folder (Windows XP) with a random name, and adds a key to the registry that causes it to run on startup. It then attempts to contact one of several designated command and control servers; once connected, the server then generates a 2048-bit RSA key pair, and sends the public key back to the infected computer. The server may be a local proxy and go through others, frequently relocated in different countries to make tracing difficult.
The payload then proceeds to begin encrypting files across local hard drives and mapped network drives with the public key, and logs each file encrypted to a registry key. The process only encrypts data files with certain extensions, including Microsoft Office, OpenDocument, and other documents, pictures, and AutoCAD files. The payload then displays a message informing the user that files have been encrypted, and demands a payment of 400 USD or Euro through an anonymous pre-paid cash voucher (i.e. MoneyPak or Ukash), or an equivalent amount in Bitcoin within 72 or 100 hours (while starting at 2 BTC, the ransom price has been adjusted all the way down to 0.3 by the operators to reflect the fluctuating value of Bitcoin), or else the private key on the server would be destroyed, and "nobody and never [sic] will be able to restore files." Payment of the ransom allows the user to download the decryption program, which is pre-loaded with the user's private key. Some infected victims claim that they paid the attackers but their files were not decrypted.
In November 2013, the operators of CryptoLocker launched an online service which claims to allow users to decrypt their files without the CryptoLocker program, and to purchase the decryption key after the deadline expires; the process involves uploading an encrypted file to the site as a sample, and waiting for the service to find a match, which the site claims would occur within 24 hours. Once a match is found, the user can pay for the key online; if the 72-hour deadline has passed, the cost increases to 10 Bitcoin.
While security software is designed to detect such threats, it might not detect CryptoLocker at all, or only after encryption is underway or complete, particularly if a new version unknown to the protective software is distributed. If an attack is suspected or detected in its early stages, it takes some time for encryption to take place; immediate removal of the malware (a relatively simple process) before it has completed would limit its damage to data. Experts suggested precautionary measures, such as using software or other security policies to block the CryptoLocker payload from launching. Symantec estimated that 3% of users infected by CryptoLocker chose to pay.
Due to the nature of CryptoLocker's operation, some experts reluctantly suggested that paying the ransom was the only way to recover files from CryptoLocker in the absence of backups (in particular, offline backups that are inaccessible from the network, and thus cannot be infected by CryptoLocker). Due to the length of the key employed by CryptoLocker, experts considered it practically impossible to use a brute-force attack to obtain the key needed to decrypt files without paying; the similar 2008 worm Gpcode.AK used a 1024-bit key that was believed to be large enough to be computationally infeasible to break without a concerted distributed effort, or the discovery of a flaw that could be used to break the encryption. Sophos security analyst Paul Ducklin even speculated that CryptoLocker's online decryption service involved the brute forcing of its own encryption.
In December 2013 ZDNet traced four Bitcoin addresses posted by users who had been infected by CryptoLocker, in an attempt to gauge the operators' takings. The four addresses showed movement of 41,928 BTC between October 15 and December 18, about US$27 million at that time.
A survey by researchers at the University of Kent found that 41% of UK respondents who were Cryptolocker victims claimed to have agreed to pay the ransom, a figure much larger than expected; 3% had been conjectured by Symantec, and 0.4% by Dell SecureWorks. The average amount per infection in the U.S. is $300.
The success of CryptoLocker spawned a number of clones closely imitating its behavior. The first, CryptoLocker 2.0, surfaced in December 2013, and was originally thought to be a variant of CryptoLocker. While visually similar to the original, it contains a few notable differences, such as being written in C# instead of Visual C++, having payload disguised as a keygen program uploaded to a P2P site, its use of an RSA-1024 key with a Triple DES algorithm, only accepting Bitcoin, additional encrypted file types (such as media files), and the ability to spread via removable drives. Analysts believed that due to its architectural and behavioral differences, CryptoLocker 2.0 may not have been connected to the original author of CryptoLocker.
Another clone, CryptoDefense, surfaced in February 2014. It also behaves similarly to CryptoLocker, encrypting certain types of files with a 2048-bit key with Windows' built-in encryption API, and instructing users to pay US$500 in Bitcoin through a hidden site on the Tor network, a fee which is doubled if not paid within four days. However, research by Symantec discovered that CryptoDefense contained a major design flaw, inadvertently allowing the private key to remain stored on the computer within the user's Application Data folder due to the behavior of Windows' encryption API. Despite this flaw, it was estimated that its operator had accrued roughly US$38,000 per month.
- "You’re infected—if you want to see your data again, pay us $300 in Bitcoins". Ars Technica. Retrieved 23 October 2013.
- "Cryptolocker Infections on the Rise; US-CERT Issues Warning". SecurityWeek. Retrieved January 18, 2014.
- Abrams, Lawrence. "CryptoLocker Ransomware Information Guide and FAQ". Bleeping Computer. Retrieved 25 October 2013.
- "Cryptolocker: How to avoid getting infected and what to do if you are". Computerworld. Retrieved 25 October 2013.
- "Destructive malware "CryptoLocker" on the loose - here's what to do". Naked Security. Sophos. Retrieved 23 October 2013.
- "CryptoLocker attacks that hold your computer to ransom". The Guardian. Retrieved 23 October 2013.
- Violet Blue (December 22, 2013). "CryptoLocker's crimewave: A trail of millions in laundered Bitcoin". ZDNet. Retrieved 2013-12-23.
- "CryptoLocker crooks charge 10 Bitcoins for second-chance decryption service". NetworkWorld. Retrieved 5 November 2013.
- "CryptoLocker creators try to extort even more money from victims with new service". PC World. Retrieved 5 November 2013.
- The Yuma Sun, on a CryptoLocker attack: "... was able to go undetected by the antivirus software used by the Yuma Sun because it was Zero-day malware"
- Leyden, Josh. "Fiendish CryptoLocker ransomware: Whatever you do, don't PAY". The Register. Retrieved 18 October 2013.
- Cannell, Joshua. "Cryptolocker Ransomware: What You Need To Know". Malwarebytes Unpacked. Retrieved 19 October 2013.
- Naraine, Ryan (6 June 2008). "Blackmail ransomware returns with 1024-bit encryption key". ZDnet. Retrieved 25 October 2013.
- Lemos, Robert (13 June 2008). "Ransomware resisting crypto cracking efforts". SecurityFocus. Retrieved 25 October 2013.
- "Cryptolocker Wants Your Money!". SecureList. Kapersky. Retrieved 30 October 2013.
- "Results of online survey by Interdisciplinary Research Centre in Cyber Security at the University of Kent in Canterbury". kent.ac.uk. University of Kent in Canterbury. Retrieved 25 March 2014.
- Urroz, Jose. "CryptoLocker Critical Security Alert". alvaka.net. Alvaka Networks. Retrieved 25 March 2014.
- "Cryptolocker 2.0 – new version, or copycat?". WeLiveSecurity. ESET. Retrieved 18 January 2014.
- "New CryptoLocker Spreads via Removable Drives". Trend Micro. Retrieved 18 January 2014.
- "CryptoDefense ransomware leaves decryption key accessible". Computerworld. IDG. Retrieved 7 April 2014.
- Thomson, Iain (2014-04-03). "Your files held hostage by CryptoDefense? Don't pay up! The decryption key is on your hard drive". The Register. Retrieved 2014-04-06.