Pirating Cyber Style

What is Ransomware? History CryptoLocker BlackHole Exploit Kit

Stops PC from Running Often Called “FBI Moneypak” or “FBI Virus” Two Types Lock Screen Ransomware Locks Screen so System Cannot be Used Encryption Ransomware Locks Files so They Cannot be Accessed Uses Scare Tactics Goal Extort Money from Victim

PC Cyborg Trojan Creator Dr. Joseph Popp Released 1989 Encrypt All Files on C Drive Krotten Released 2006 Disabled Nearly All Files Preyed on Windows Directory

WinLock Originated in Russia Restricts Access to System Displays Pornographic Images Reveton First Seen in 2012 “Police Trojan” Engaged in Illegal Activity Send Fee

CryptoLocker First Seen 2013 Use 2048-Bit RSA Key Private Key Held Threatened Erase Most Common Infection Mode – Attachment Will Run in Safe Mode

Found to have used 2764 unique victim IP's contacting the sinkholed domains Highest number was recorded on Wednesday October 16, with 1266 unique IP addresses

Top 30 countries infected

Countermeasures Do Not Open Attachments Unless Source is Verified Up-to-Date Antivirus – Maybe to Late Configure System so CryptoLocker Cannot Run Block Executables from Running in %AppData% Directory Block Executables from Running in %AppData%\* Directory Block WinRAR Attachments from Opening %Temp%\Rar\*.exe Block 7zip Attachments from Opening %Temp%\7z\*.exe Block WinZip Attachments from Opening %Temp%\wz*\*.exe Block Built-in Zip Support from Opening %Temp%\*.zip\*.exe

Launched in late 2010 – Russian Hacker Currently Most Popular Exploit Kit MySQL Backend Auto Update Contains Many Recent Java Exploits Contains Exploit for CVE (MS XML) 0-Day at the time Good JavaScript Obfuscation Many Different Payloads can be Carried

How It Works:

August to September 2012 Payloads: Money Collecting Information Stealing Click Fraud

Best Option, Avoid Getting Infected Keep Good Backups – Even in Homes Avoid Paying Ransom Paying Only Encourages More Ransomware / Malware

History: the-history-and-technology-of-ransomware/ computer-blackmail-viruses-a-history history-of-ransomware/ computer-free-of-ransomware

Reveton: function CryptoLocker: Money df

Blackhole: exploit-kit/ /Briefings/Jones/BH_US_12_Jones_State_Web_Exploits_Slides.pdf