FEATURE

Ransomware attacks:
detection, prevention
and cure Ross Brewer

Ross Brewer, LogRhythm

Over the past three years, ransomware has become one of the biggest cyber
scams to hit businesses. Indeed, the FBI estimates that losses incurred in 2016
due to ransomware will top $1bn. Ransomware is malicious software that software’ just to get rid of the warning
allows a hacker to restrict access to an individual’s or company’s vital informa- message.
tion in some way and then demand some form of payment to lift the restric- The term ‘ransomware’ broadly
tion. The most common form of restriction today is encryption of important describes a wide range of malicious soft-
data on the computer or network, which essentially lets the attacker hold user ware programs, including CryptoLocker,
data or a system hostage. Locky, CryptoWall, KeyRanger,
SamSam, TeslaCrypt, TorrentLocker
Payment in Bitcoins is the typical demand, trojan called PC Cyborg in which and others.1-4 Various strains of these
as the digital currency is both global and malware would hide all folders and major applications appear and continue
anonymous. Ransomware attacks are encrypt files on the PC’s C: drive. to evolve in order to avoid detection.
rapidly growing in popularity with cyber- A script delivered a ransom message In fact, researchers saw more than four
criminals and for good reason – it’s esti- demanding that $189 be directed to the million samples of ransomware in the
mated that this type of attack earns crimi- PC Cyborg Corporation. The afflicted second quarter of 2015, including 1.2
nals millions of pounds a month. PC wouldn’t function until the ransom million that were new. That compares
was paid and the malware’s actions to fewer than 1.5 million total samples
Old tricks were reversed. Since then, numerous in the third quarter of 2013, when fewer
enhancements to this type of scheme than 400,000 were new.
The notion of ransomware has actually have been made, especially in the area The vast majority of attacks today are
been around for quite some time. In of stronger file encryption. Now, it’s against Windows-based systems. This is
1989, Dr Joseph Popp distributed a virtually impossible for victims to largely due to a numbers game – there
decrypt their own files. are more Windows-based computers
than any other type of OS. Attackers
“Researchers saw more often use exploit kits to get the ransom-
than four million samples of ware software on victims’ machines.
ransomware in the second
quarter of 2015, including 1.2 Lucrative business
million that were new. That Until recently, most ransomware attacks
compares to fewer than 1.5 were simply opportunistic and mostly
million total samples in the affected the computers of individual
third quarter of 2013” users or small businesses. The ransom
demands have commonly been the
Another type of ransomware scheme, equivalent of just a few hundred pounds
dubbed ‘scareware’, displayed a warn- for an individual PC.
ing on a user’s computer that the device This has been and continues to be,
was infected with malware that could a lucrative business for criminals who
be removed immediately by purchas- consider end users to be low-hanging
ing what turned out to be fake anti- fruit. But now they have set their sights
virus software. The scareware message on larger organisations that have bigger
The TeslaCrypt warning message which appears appeared repeatedly, prompting many budgets to pay bigger ransom demands.
after a PC is infected and its files encrypted.
victims to purchase the ‘anti-virus They also have more important files and

5
September 2016 Network Security
 FEATURE

business might be willing to pay. On the

surface, mass distribution and targeted
attacks appear to be similar, but there
are underlying technical differences:
sä -ASSäDISTRIBUTIONäATTACKSäAREäTYPICALLYä
automated, very fast in their execu-
tion – often just 15 minutes from
initial infection to a ransom demand
being made – and well orchestrated
from the attacker’s perspective.
sä 4ARGETEDäATTACKSäAREäVERYäSIMILARäTOä
an advanced persistent threat (APT);
they are usually driven by a person as
opposed to an automated system and
may take much more time to execute.
The tools used for each kind of attack
differ as well. Mass distribution attacks
often utilise more customised or single-
use tools. Targeted attacks deploy more
off-the-shelf tools for the reconnaissance
phase, while the encryption process is
The CryptoWall warning message is less dramatic than others. However, note how it provides
easy-to-follow steps for paying.
usually customised.

computer systems that are critical to an ware attacks. They are now increasingly The five phases of
organisation’s daily operations. scoping out specific organisations that
While individuals and small businesses have deep pockets and are more likely to ransomware
often fell victim to mass distribution pay a hefty ransom request in order to There are distinct phases of a ransom-
ransomware, which saw them become minimise downtime. ware attack, regardless of whether it’s a
the targets of opportunity via a phishing The perpetrators understand the mass distribution or a targeted attack.
email, drive-by download or a compro- mathematics. Targeted organisations Understanding what happens in each
mised website, criminals are shifting are likely to see much higher ransom phase and knowing the indicators of
their tactics to more targeted ransom- demands that are based on what the compromise (IOCs) to look for, increas-
es the likelihood of being able to success-
fully defend against – or at least mitigate
the effects of – an attack.
Phase 1: Exploitation and infection.
In order for an attack to be successful,
the malicious ransomware file needs to
execute on a computer. This is often
done through a phishing email or an
exploit kit – a type of malicious toolkit
used to exploit security holes in software
applications for the purpose of spreading
malware. These kits target users running
insecure or outdated software applica-
tions on their computers. In the case of
the CryptoLocker malware, the Angler
exploit kit is a preferred method to gain
execution. The vulnerabilities favoured by
the Angler exploit kit are typically found
in Adobe Flash and Internet Explorer.
Phase 2: Delivery and execution.
Following the exploit process, the actual
ransomware executable will be delivered
The CryptoLocker warning message. Most ransomware campaigns use Bitcoin as a payment to the victim’s system. Upon execution,
method as it offers anonymity for the attackers.
persistence mechanisms will be put in

6
Network Security September 2016
 FEATURE

place. Typically, this process takes a few Even if a program is holding a lock to encryption process can take anywhere
seconds, depending on network latencies. those files, it will kill the process so it can from a few minutes to a couple of hours.
Unfortunately, the executables are most delete those folders of the back-ups to There have been instances where, on
often delivered via an encrypted chan- make recovery all the more difficult. a widely distributed network, the ran-
nel – instead of SSL, a custom encryption Phase 4: File encryption. Once somware tries to encrypt files across a
layer is added on top of a regular HTTP the back-ups are completely removed, wide area network. For a single endpoint
connection. Because the malware is using the malware will perform a secure key device, however, the encryption process
strong encryption, it’s difficult to recover exchange with the command and control is usually done in minutes.
the executable from the wire. Most often, (C2) server, establishing those encryption Phase 5: User notification and
we see the executable files being placed in keys that will be used on the local sys- clean-up. With the back-up files
either the %APPDATA% or %TEMP% tem. Quite often the malware will tag removed and the encryption dirty work
folder beneath the user’s profile. It’s the local system using a unique identifier done, the demand instructions for extor-
good to know this for detection purposes that will be presented to the user in the tion and payment are presented. Quite
because your organisation can moni- instructions at the end. This is also how often, the victim is given a few days
tor for those events to set up a line of the C2 server differentiates between the to pay and after that time the ransom
defence. Most of the crypto malware will encryption keys used for different victims. increases. How the instructions are
add persistence mechanisms such that if Unfortunately, most of the variants today presented can help you identify which
the afflicted machine is rebooted in the use strong encryption such as AES 256, ransomware software has attacked the
middle of the encryption process, the ran- so the victim isn’t going to be able to system. The demand instructions are
somware can pick up where it left off and break the encryption on their own. usually saved onto the hard drive, some-
continue to encrypt the system until it is Not every type of ransomware needs times in the same folders as the encrypt-
completed. to contact a C2 server to exchange keys. ed files. Other times, they are saved to
In the case of the SamSam malware, the very specific locations on the hard disk.
“Most of the crypto malware software application does all encryption For example, CryptoWall version 3 uses
will add persistence locally without reaching out to the the HELP_DECRYPT file to store the
mechanisms such that if Internet at all. This is worth noting, instructions. CryptoWall V4 changed
because the communication with a C2 it to HELP-YOUR-FILES. There are a
the afflicted machine is
server is an IOC that should be moni- couple of different instructions and vari-
rebooted in the middle of tored, but the absence of this event does ations on the theme but you can usu-
the encryption process, the not mean that ransomware is not present. ally use this guidance to do an Internet
ransomware can pick up search and find the exact variant.
where it left off” “Depending on network Finally, the malware cleans itself off
latencies, the number and the victimised system so as not to leave
Phase 3: Back-up spoliation. A few sizes of documents and behind significant forensic evidence that
seconds after the malware is executed, would help build better defences against
the number of devices
the ransomware targets the back-up files the malware.
and folders on the system and removes
connected, the encryption
process can take anywhere
them to prevent restoring from back-up.
from a few minutes to a Handling a ransomware
This is unique to ransomware. Other
types of crimeware and even APTs don’t couple of hours” attack
bother to delete back-up files. Most of Step 1: Preparation. Because malware
the ransomware variants will go out of During the file encryption phase, often enters systems through known
their way to try and remove any means different ransomware variants handle vulnerabilities, the best step to bolster
that the victim has to recover from the file naming and encryption differently. defences is to aggressively patch sys-
attack without paying the ransom. On For instance, CryptoWall version 3 tems. By eliminating vulnerabilities, the
Windows systems, in both targeted and does not encrypt the filename, whereas malware may not have a way to get on
mass distribution attacks, we often see the CryptoWall version 4 randomises the any of your computers in the first place.
vssadmin tool being used to remove the filename and extension. Locky will ran- It’s also important to create and protect
volume shadow copies from the system. domise the filenames but add a locky back-ups. Ransomware destroys back-up
For instance, CryptoLocker and Locky extension to the end. Knowing this, your files and encrypts regular files and this puts
will execute a command to delete all of organisation can sometimes fingerprint organisations at risk. Therefore, it’s imper-
the volume shadow copies from the sys- the exact ransomware variant based on ative to frequently back up all documents
tem. Several of the variants, especially in the file-naming convention that it uses. to a location that can’t be affected by the
the targeted attacks, will even go so far as Depending on network latencies, the ransomware (eg, to offline storage) and
to look for folders containing back-ups number and sizes of documents and then verify that these files can be restored
and then forcefully remove those files. the number of devices connected, the easily if needed. Even network shares or

7
September 2016 Network Security
 FEATURE

cloud storage may not be entirely safe, as For the phishing emails that con- to the endpoint, it’s not able to actually
files that have already been encrypted or tain or lead users to the ransomware encrypt files on the network.
corrupted by the ransomware could be malware, any tools that detect malicious Step 4: Eradication. Once the ran-
automatically backed up to the network or attachments or perform attachment somware incident has been identified and
the cloud, also corrupting the files in those scanning to look for executable attach- has been contained, the next step is eradi-
storage locations. ments are the best automated defence cating it from the network. It’s usually
Organisations should also develop against ransomware emails. recommended that machines be replaced
an incident response (IR) plan that is It’s also worth knowing that two com- rather than cleaned. As with any type of
explicitly for a ransomware attack. This mon areas from which the ransomware malware, it’s difficult to know if residual
step is particularly important to prepare typically executes are the %APPDATA% files are hidden on the system and able
for targeted attacks that can affect broad folder and the %TEMP% folder on to re-infect devices. However, for net-
swaths of an organisation. The IR plan your system. Looking for any file execut- work locations such as mailboxes or file
should detail the specific actions people ing from these locations is a good way shares, sometimes it is more relevant to
should take as soon as it becomes appar- to spot ransomware before it has actually clean those locations, remove the mali-
ent that an attack is underway. This will had a chance to encrypt files. Similar cious email message from the mailbox, or
help to ensure a prompt response in a to the exploitation phase, network rules remove the ransomware instructions from
scenario where time is of the essence to can also be used to detect the executable the file share. If organisations choose to
stop or contain a serious situation. delivery and execution, especially for clean rather than replace, it’s important
Finally, user awareness training is an cases such as CryptoLocker. that they continue to monitor for sig-
effective means to teach people to avoid Back-up spoliation is another key area natures and other IOCs to prevent the
falling victim to phishing email messages where CryptoLocker can be detected attack from re-emerging.
that plant malware in the first place. before it has actually had a chance to Step 5: Recovery. For recovery, the
Many attackers rely on social engineer- execute. Specifically, look for that vssad- number one task is going to be restoring
ing tactics that are growing more and min command execution. It’s very com- from back-up. If there are good veri-
more sophisticated. End users need to mon for this approach to be used and fied back-ups, any ransomware event
know what to expect and what to look if the admin tool executed can be high- can really be made into a non-issue by
for in their messages to avoid infection. lighted, action can be taken and other simply replacing or cleaning systems and
laptops or the network shares could recovering from back-ups. There may
“Any tools that detect avoid being encrypted. be a small amount of downtime, but it
malicious attachments or The file encryption phase also usu- shouldn’t be a big multi-day issue.
perform attachment scanning ally begins with a key exchange that can In most ransomware cases, a full
be detected via network signatures, file investigation into what specific infection
to look for executable
naming and registry modifications on vector was used against the system is an
attachments are the best the local system. Looking for files with a important step. Was it a phishing email,
automated defence against .locky extension is a good method to try to or was it a web-based attack kit? If it
ransomware emails” detect Locky being encrypted on a system. was a web-based attack kit, how did that
Similarly with CryptoWall, looking for the user get to that web page? Knowing how
Step 2: Detection. In the event of random filename patterns is another way the ransomware came onto your system
an attack, organisations can minimise to detect the ransomware as it is actually can help organisations better prime their
damage if they can detect the malware running. Unfortunately, it is a little late in defence systems and direct their detection
early. For initial exploitation and infec- the progression of the malware, but if the mechanisms in the future.
tion, a good defence is to get signatures user notification files being placed on the
and IOCs into an IDS or other network system can be detected, it’s easier to see Conclusion
device. Use threat intelligence sources to the presence of the encryption even if you
block or at least alert to the presence of aren’t able to block it. Quick detection at Ransomware attacks against organisations
anomalies associated with ransomware in this stage may help contain the situation. are just starting to ramp up. Because these
your network traffic. There are numer- Step 3: Containment. Once the attacks are so lucrative for the perpetrators,
ous signatures for most of the major ransomware has already taken hold of they are certain to become more com-
IDS vendors out there for CryptoWall one device, there are steps to contain mon, more damaging and more expensive.
and Locky traffic. These are usually it locally so that network files aren’t What’s more, almost every organisation
malware version-dependent and they can affected. Having an endpoint protection – large or small – is vulnerable to a ransom-
change. Therefore, it’s important to have system that is able to look for the execu- ware attack. The ramifications of a success-
more defences than just the detection. tion and kill the process is usually the ful attack are far more extensive than just
However, these signatures can be a good best means of containment. If ransom- the cost of the ransom. Organisations can
source for the most widely distributed ware is detected, network connectivity suffer the effects of lost productivity, loss of
tools that enterprises tend to use. can be disabled so that if it is able to get business, inconvenience to customers and

8
Network Security September 2016
 FEATURE

potentially the permanent loss of data. An tions. Prior to joining LogRhythm, Brewer 2. ‘Locky Ransomware Information,
organisation’s success in defending against a was vice-president and managing director Help Guide and FAQ’.
ransomware attack is largely dependent on for EMEA at LogLogic. BleepingComputer, 9 May 2016.
the level of preparation and the ability to Accessed Sep 2016. www.bleeping-
detect, shut down and contain suspicious Resource computer.com/virus-removal/locky-
activity. sä @4HEäSTATEäOFäRANSOMWAREäHOWäTOä ransomware-information-help.
prepare for an attack’. LogRhythm 3. ‘Lucrative Ransomware Attacks:
About the author Labs, 28 Mar 2016. Accessed Sep Analysis of the CryptoWall
Ross Brewer is vice-president and manag- 2016. https://logrhythm.com/blog/ Version 3 Threat‘. Cyber Threat
ing director for EMEA at LogRhythm. He the-state-of-ransomware-how-to- Alliance. Accessed Sep 2016.
joined LogRhythm in 20018 and has more prepare-for-an-attack/. http://cyberthreatalliance.org/cryp-
than two decades’ experience within sales towall-report.pdf.
and management and more than 10 years References 4. ‘TeslaCrypt’. Wikipedia.
spent in the information security sector, 1. ‘Cryptolocker’. Wikipedia. Accessed Accessed Sep 2016.
where he has had a successful track record of Sep 2016. https://en.wikipedia.org/ https://en.wikipedia.org/wiki/
building and managing internatioal opera- wiki/CryptoLocker. TeslaCrypt.

Risk-based security: staff

can play the defining role
in securing assets Marc Sollars

Marc Sollars, Teneo

Last year, US firm Ubiquiti’s finance team made an urgent multi-million pound
money transfer for a senior executive, only to find later that the request had and their staff’s mistakes to customers
been made by criminals posing as him.1 In the UK, the exposure of customer and business partners as never before.
financial details held by telecomms provider TalkTalk, seemingly caused by
young hackers, has led to an exit of disgruntled customers.2 “Organisations are having to
draw up plans to designate
Different attacks and victims, certainly, can cut through all the noise and rethink approved workforce tools,
but they show how information security is the task of educating their workforce
block malware and inspire
headline news because every organisation about more effective security procedures.
is now a target. With company bosses and So how can we bring best security prac-
staff to follow new rules –
the public alike realising that the person tice by employees to the heart of every- all at the same time. How is
being duped into releasing malware or thing we do in our workplace, whether this multi-faceted balancing
wrongly transferring money is just as likely it’s the corporate HQ or the remotest of act to be achieved?”
to be a company CEO as your neighbour, branch offices?
the security industry has acquired an This ‘re-education’ requirement has However, since today’s business
unprecedented profile because its direst emerged with a vengeance because models are increasingly dependent on
warnings are all coming true. organisations, rapidly being brought to federated partners, service providers
a standstill by hackers’ exploits, can no and supply chains, the old concepts of
New demands longer make excuses or brush this type protecting the perimeter or arbitrarily
of matter under the carpet. Even targets locking down IT infrastructures have
At the same time, the security industry such as hospitals that once might have gone out of the window. We’ve reached
is inevitably being asked to come up been regarded as being no-go areas for a point where organisations are having
with practical measures to help a myriad cyber-attacks are now being held to ran- to draw up plans to designate approved
organisations to secure their data. It’s som.3 Board-level executives are having to workforce tools, block malware and
also being asked by companies how they explain their information security policies inspire staff to follow new rules – all at

9
September 2016 Network Security