Jump to content

CryptoLocker

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by BG19bot (talk | contribs) at 06:51, 9 August 2014 (WP:CHECKWIKI error fix for #52. Do general fixes if a problem exists. - using AWB (10361)). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

CryptoLocker
TypeRansomware
SubtypeCryptovirus
ClassificationTrojan horse
Technical details
PlatformWindows

CryptoLocker is a ransomware trojan which targets computers running Microsoft Windows[1] and was first observed by Dell SecureWorks in September 2013.[2][3] A CryptoLocker attack may come from various sources; one such is disguised as a legitimate email attachment. When activated, the malware encrypts certain types of files stored on local and mounted network drives using RSA public-key cryptography, with the private key stored only on the malware's control servers. The malware then displays a message which offers to decrypt the data if a payment (through either Bitcoin or a pre-paid voucher) is made by a stated deadline, and threatens to delete the private key if the deadline passes. If the deadline is not met, the malware offers to decrypt data via an online service provided by the malware's operators, for a significantly higher price in Bitcoin.

Although CryptoLocker itself is readily removed, files remain encrypted in a way which researchers have considered infeasible to break. Many said that the ransom should not be paid, but did not offer any way to recover files; others said that paying the ransom was the only way to recover files that had not been backed up. Payment of the ransom did not always lead to the files being decrypted.

In May 2014 the network was taken down and the database of victims recovered from the operators; by August 2014 files could be decrypted without charge using the database.[4][5]

Operation

Many viruses are given names by anti-virus organisations that find them, and sometimes the same malware is given different names by different companies. Cryptolocker, however, was named by its developer; it displays its name, and uses it in registry keys and the like.[6] Virus scanners do not necessarily identify it by this name; for example, CryptoLocker is detected by ESET as Win32/Filecoder.BQ[7] and other similar malware is given the Filecoder name with a different suffix letter. Other scanners use names containing terms such as Ransom or CriLock for different ransomware.[8]

CryptoLocker typically propagates as an attachment to a seemingly innocuous e-mail message, which appears to have been sent by legitimate company; or, it is uploaded to a computer already recruited to a botnet by a previous trojan infection.[9] A ZIP file attached to an email message contains an executable file with the filename and the icon disguised as a PDF file, taking advantage of Windows' default behaviour of hiding the extension from file names to disguise the real .EXE extension. Some instances may actually contain the Zeus trojan instead, which in turn installs CryptoLocker.[6][10] When first run, the payload installs itself in the user profile folder, and adds a key to the registry that causes it to run on startup. It then attempts to contact one of several designated command and control servers; once connected, the server generates a 2048-bit RSA key pair, and sends the public key back to the infected computer.[1][6] The server may be a local proxy and go through others, frequently relocated in different countries to make tracing them more difficult.[11][12]

The payload then encrypts files across local hard drives and mapped network drives with the public key, and logs each file encrypted to a registry key. The process only encrypts data files with certain extensions, including Microsoft Office, OpenDocument, and other documents, pictures, and AutoCAD files.[10] The payload displays a message informing the user that files have been encrypted, and demands a payment of 400 USD or Euro through an anonymous pre-paid cash voucher (i.e. MoneyPak or Ukash), or an equivalent amount in Bitcoin (BTC) within 72 or 100 hours (while starting at 2 BTC, the ransom price has been adjusted down to 0.3 BTC by the operators to reflect the fluctuating value of Bitcoin),[13] or else the private key on the server would be destroyed, and "nobody and never [sic] will be able to restore files."[1][6] Payment of the ransom allows the user to download the decryption program, which is pre-loaded with the user's private key.[6] Some infected victims claim that they paid the attackers but their files were not decrypted.[9]

In November 2013, the operators of CryptoLocker launched an online service which claims to allow users to decrypt their files without the CryptoLocker program, and to purchase the decryption key after the deadline expires; the process involves uploading an encrypted file to the site as a sample, and waiting for the service to find a match, which the site claims would occur within 24 hours. Once a match is found, the user can pay for the key online; if the 72 hour deadline has passed, the cost increases to 10 Bitcoin.[14][15]

Mitigation

While security software is designed to detect such threats, it might not detect CryptoLocker at all, or only after encryption is underway or complete, particularly if a new version unknown to the protective software is distributed.[16] If an attack is suspected or detected in its early stages, it takes some time for encryption to take place; immediate removal of the malware (a relatively simple process) before it has completed would limit its damage to data.[8][17] Experts suggested precautionary measures, such as using software or other security policies to block the CryptoLocker payload from launching.[1][6][10][12][17] Symantec estimated that 3% of users infected by CryptoLocker chose to pay.[12]

Due to the nature of CryptoLocker's operation, some experts reluctantly suggested that paying the ransom was the only way to recover files from CryptoLocker in the absence of backups (in particular, offline backups made before the infection that are inaccessible from the network, and thus cannot be infected by CryptoLocker).[9] Due to the length of the key employed by CryptoLocker, experts considered it practically impossible to use a brute-force attack to obtain the key needed to decrypt files without paying; the similar 2008 worm Gpcode.AK used a 1024-bit key that was believed to be large enough to be computationally infeasible to break without a concerted distributed effort, or the discovery of a flaw that could be used to break the encryption.[6][15][18][19] Sophos security analyst Paul Ducklin even speculated that CryptoLocker's online decryption service involved the brute forcing of its own encryption.[15]

In late October 2013, security vendor Kaspersky Labs reported that a DNS sinkhole had been created to block some of the domain names used by CryptoLocker.[20] By August 2014 the network had been dismantled and users were able to decrypt files.

Money paid

In December 2013 ZDNet traced four Bitcoin addresses posted by users who had been infected by CryptoLocker, in an attempt to gauge the operators' takings. The four addresses showed movement of 41,928 BTC between 15 October and 18 December, about US$27 million at that time.[13]

A survey by researchers at the University of Kent found that 41% of UK respondents who were CryptoLocker victims claimed to have agreed to pay the ransom, a figure much larger than expected; 3% had been conjectured by Symantec, and 0.4% by Dell SecureWorks.[21] The average amount per infection in the U.S. is $300.[22] However, analysis of data which became available after the network was taken down indicated about 1.3% of those infected had paid the ransom; many had been able to recover files which had been backed up, and others are believed to have lost huge amounts of data. Nonetheless, the gang was believed to have extorted about US$3m.[23]

Takedown and recovery of files

In late May 2014 law enforcement agencies and security companies seized a network of hijacked computers used to spread both Cryptolocker and Gameover Zeus, in what was called "Operation Tovar". The criminals attempted to send a copy of their database to a safe location, but it was intercepted by agencies already in control of part of the network. Russian Evgeniy Bogachev, aka "lucky12345" and "slavik", was charged by the US FBI of being the ringleader of the gang behind Gameover Zeus and Cryptolocker. The database indicates the scale of the attack, and makes decryption of CryptoLocked files possible.

In August 2014 security firms involved in the shutdown, Fox-IT and FireEye, created a portal, called Decrypt Cryptolocker,[24] which allows any of the 500,000 victims to find the key to unlock their files. Victims need to submit an encrypted file without sensitive information, which allows the unlockers to deduce which encryption key was used. It is possible that not all CryptoLocked files can be decrypted, nor files encrypted by different ransomware.[4][23]

Imitators

The success of CryptoLocker spawned a number of imitators working in essentially the same way: infecting computers by trickery, encrypting files, and offering to decrypt them on payment of a ransom. The first, which calls itself CryptoLocker 2.0,[7] surfaced in December 2013, and was originally thought to be a variant of CryptoLocker. While visually similar to the original, it is written in the C# programming language rather than Visual C++. The file installing it is typically uploaded to a P2P site disguised as a program to generate a key to enable the unauthorised use of a commercial program, or to activate a program or operating system. It uses an RSA-1024 key with a Triple DES algorithm, only accepts Bitcoin payment, encrypts additional file types such as media files, and can spread via removable drives (e.g., USB sticks). Analysts believe that, due to its architectural and behavioral differences, CryptoLocker 2.0 may not have been connected to the original author of CryptoLocker.[7][25]

CryptoDefense surfaced in February 2014. It encrypts files with a 2048-bit key using Windows' built-in encryption API, and demands US$500 in Bitcoin. Symantec discovered that CryptoDefense contained a major design flaw, inadvertently allowing the private key to remain stored on the computer within the user's Application Data folder due to the behavior of Windows' encryption API. Despite this flaw, it was estimated that its operator had accrued roughly US$38,000 per month.[26][27] After Symantec revealed the flaw, CryptoDefense was repaired; as it also removes all system restore information and shadow file copies prior to the infection date, the only way to recover files encrypted after 1 April 2014 without paying the ransom is from an off-line backup made before the encryption.

Other imitators include CryptoWall and CryptorBit.[28][29]

A version targeting Synology NAS servers, named SynoLocker, targets unpatched devices with firmware 4.3-3810 or earlier.[30] It exploits a vulnerability already patched in December 2013 and surfaced August 3. 2014.[31]

See also

References

  1. ^ a b c d "You're infected—if you want to see your data again, pay us $300 in Bitcoins". Ars Technica. Retrieved 23 October 2013.
  2. ^ Jarvis, Keith. "CryptoLocker Ransomware". Dell SecureWorks Threat Analyses. Dell SecureWorks. Retrieved 18 December 2013.
  3. ^ Kelion, Leo (24 December 2013). "Cryptolocker ransomware has 'infected about 250,000 PCs'". BBC. Retrieved 24 December 2013.
  4. ^ a b FireEye:Your Locker of Information for Cryptolocker Decryption, 6 August 2014
  5. ^ Swati Khandelwal. "Free CryptoLocker Ransomware Decryption Tool Released". Thehackernews.com. Retrieved 8 August 2014.
  6. ^ a b c d e f g Abrams, Lawrence. "CryptoLocker Ransomware Information Guide and FAQ". Bleeping Computer. Retrieved 25 October 2013.
  7. ^ a b c "Cryptolocker 2.0 – new version, or copycat?". WeLiveSecurity. ESET. Retrieved 18 January 2014.
  8. ^ a b Cannell, Joshua. "Cryptolocker Ransomware: What You Need To Know, last updated 06/02/2014". Malwarebytes Unpacked. Retrieved 19 October 2013.
  9. ^ a b c "Cryptolocker Infections on the Rise; US-CERT Issues Warning". SecurityWeek. 19 November 2013. Retrieved 18 January 2014.
  10. ^ a b c "Cryptolocker: How to avoid getting infected and what to do if you are". Computerworld. Retrieved 25 October 2013.
  11. ^ "Destructive malware "CryptoLocker" on the loose - here's what to do". Naked Security. Sophos. Retrieved 23 October 2013.
  12. ^ a b c "CryptoLocker attacks that hold your computer to ransom". The Guardian. Retrieved 23 October 2013.
  13. ^ a b Violet Blue (22 December 2013). "CryptoLocker's crimewave: A trail of millions in laundered Bitcoin". ZDNet. Retrieved 23 December 2013.
  14. ^ "CryptoLocker crooks charge 10 Bitcoins for second-chance decryption service". NetworkWorld. Retrieved 5 November 2013.
  15. ^ a b c "CryptoLocker creators try to extort even more money from victims with new service". PC World. Retrieved 5 November 2013.
  16. ^ The Yuma Sun, on a CryptoLocker attack: "... was able to go undetected by the antivirus software used by the Yuma Sun because it was Zero-day malware"
  17. ^ a b Leyden, Josh. "Fiendish CryptoLocker ransomware: Whatever you do, don't PAY". The Register. Retrieved 18 October 2013.
  18. ^ Naraine, Ryan (6 June 2008). "Blackmail ransomware returns with 1024-bit encryption key". ZDnet. Retrieved 25 October 2013.
  19. ^ Lemos, Robert (13 June 2008). "Ransomware resisting crypto cracking efforts". SecurityFocus. Retrieved 25 October 2013.
  20. ^ "Cryptolocker Wants Your Money!". SecureList. Kapersky. Retrieved 30 October 2013.
  21. ^ "Results of online survey by Interdisciplinary Research Centre in Cyber Security at the University of Kent in Canterbury" (PDF). kent.ac.uk. University of Kent in Canterbury. Retrieved 25 March 2014.
  22. ^ Urroz, Jose. "CryptoLocker Critical Security Alert". alvaka.net. Alvaka Networks. Retrieved 25 March 2014.
  23. ^ a b BBC News: Cryptolocker victims to get files back for free, 6 August 2014
  24. ^ Decrypt Cryptolocker Web site
  25. ^ "New CryptoLocker Spreads via Removable Drives". Trend Micro. Retrieved 18 January 2014.
  26. ^ "CryptoDefense ransomware leaves decryption key accessible". Computerworld. IDG. Retrieved 7 April 2014.
  27. ^ Thomson, Iain (3 April 2014). "Your files held hostage by CryptoDefense? Don't pay up! The decryption key is on your hard drive". The Register. Retrieved 6 April 2014.
  28. ^ "Cryptowall – the extended version of Cryptolocker". Cyberoam Threat Research Labs. 2014.
  29. ^ "CryptoWall Virus". PCRisk.com. 2014.
  30. ^ "SynoLocker Ransomware Affecting Synology DiskStation". Synology Inc. 2014.
  31. ^ "Synology disk HACKED (Synolock), Synology Inc. Online Community Forum". 2014.

External links

Retrieved from "https://en.wikipedia.org/w/index.php?title=CryptoLocker&oldid=620471477"