The Day We Infected Ourselves with Ransomware

RANSOMWARE

5/24/2017

Who We AreRIIS is a boutique IT firm focused on joining business

and technology through Custom Mobile , Software

Development and Premium IT Professional Services

Mobile Apps Web Dev Professional Services Security Audits User Experience

Our Specialties

Agenda

• Wanna Cry

• What is Ransomware?

• Different Flavors

• Test Lab Setup

• Fixes

• Preparation Plan

• Call to Action

Wanna Cry

Ransomware

Trust but VerifyDon’t believe the HypeHard to decipher the signal from the noise

What is Ransomware

Deployment

What is

Ransomware

• Deployment

What is Ransomware

Installation

What is

Ransomware

• Installation

What is Ransomware

Command and Control

What is Ransomware

Destruction

What is Ransomware

Extortion

What is Ransomware

Targets

• Hospitals

• Fortune 500

• Universities and Schools

• Police Stations

• Religious Organizations

What is Ransomware

Flavors

• Locky

• Cryptowall

• CryptXXX

• Jigsaw

• TeslaCrypt

• Petra

• Win32Dircrypt

What is

Ransomware

• Ransomware as a service

Test Lab

• Wipe machines

• Install fresh copy of Windows 7

• Use dedicated wifi hotspot of test phone

• Download Ransomware from the Zoo

• https://github.com/ytisf/theZoo

• Choose your flavor and install

Test Lab

Warning

Do not do this on a machine you ever want

to use again. Make sure it is not connected

to your company wifi.

Test Lab

Jigsaw

TeslaCrypt

Ransomware Prep Plan

• Backup your data and keep a copy offsite.

• Disconnect from all cloud backup services such as Dropbox.

• Use Antivirus, Firewalls and Email scanners.

• Update your OS when a new patch appears.

• Use Microsoft’s shadow drives (VSS) or Mac’s Time Machine.

• Uninstall Flash.

• Remove or restrict Admin access.

• Disconnect any shared drives.

• Train your staff, send them test phishing emails

• Use a test lab and see if you can recover from a simulated attack.

• Sign up for a Bitcoin account in case you need to pay!

Prep Plan

• Test Phishing Emails

Ransomware Potential Breakpoints

The ransomware must execute and unpack itself and then collect system information.

The ransomware has to change registry settings to maintain persistence.

More advanced ransomware disables system restore and deletes everything in the Volume Shadow Copy (VSC).

Most, but not all, ransomware has to call out to command-and-control infrastructure to get a public key that will be used to encrypt the files.

The ransomware now has to enumerate the files.

It then begins to read and encrypt the files.

If each encrypted file is written to a new file, the original files must be deleted.

Finally, the encryption key is removed from the local machine and sent back to the controller.

Bitcoin

Resources

http://riis.com/blog

https://www.knowbe4.com/phishing-security-test-offer

https://github.com/ytisf/theZoo

https://www.bleepingcomputer.com/download/jigsaw-decrypter/dl/321/

http://www.talosintelligence.com/teslacrypt_tool/

https://noransom.kaspersky.com/

https://www.ghacks.net/2016/03/30/anti-ransomware-overview/

Call(s) to Action

• Set up a Test Lab

• Run a Ransomware drill

Mobile App Partners

Contact us!

riis.com

248.351.1200

1250 Stephenson Hwy, Troy, MI 48083

The Day We Infected Ourselves with Ransomware

Technology

Transcript of The Day We Infected Ourselves with Ransomware

Thermostat Ransomware

Cybercrime Tactics & Techniques: Q2 2019 Ransomware ......Ransomware shifts to business targets » Consumer ransomware drops -12% YoY & -25% QoQ » Business focused ransomware increase

Defend Your Data from Ransomware Attacksdiscover.zyxel.com/rs/471-TTL-126/images/Ransomware...Defend Your Data from Ransomware Attacks The Threat of Ransomware The WannaCry attack

Lessons Learned: Recovering from Ransomware · 2020. 7. 7. · Ransomware typically spreads through phishing emails or by unknowingly visiting an infected website.” In 2019 one

Malware Defense I - ida.liu.seTDDD17/lectures/slides/tddd17-malware-I.pdf · • Ransomware either lock the GUI of infected computer or encrypt all files on hard drive. Then requires

2017: The Year of Ransomware - WeLiveSecurity · The outbreak began in Ukraine. Attackers used a compromised update of the M.E.Doc accounting software to spread the malware. Infected

RANSOMWARE - Technology Management · 2018-10-03 · Protect your data How to identify Ransomware What will happen if you’re infected Check your emails carefully How to protect

Hive Ransomware

The real hard problems in security - Ming Chow · 2020-06-19 · The fundamental flaw exploited in WannaCry –ransomware that infected hundreds of thousands of machines in under

UNMASKING RANSOMWARE

Threat Intelligence Report · Maze ransomware group releases data On January 31, the France-based company Bouygues Construction disclosed that its computer network had been infected

Designing a Web GIS Security Strategy - Esri Supportdownloads.esri.com/resources/enterprisegis/2017UC...•Scenario-Ransomware infected over 230,000 endpoints within 1 day of being

Ransomware: Modern Day PiratesRansomware • What is ransomware • History of ransomware • Actors and their motivations • Anatomy of a ransomware attack • Cost of a ransomware

This Could Happen to You: Reasons for Clicking on Ransomware … · 2018-05-11 · This Could Happen to You: Reasons for Clicking on Ransomware-Infected Links and Attachments Zinaida

Ransomware Tips to Help Avoid Ransomware Attacks · 2019. 5. 8. · installed the ransomware. Tips to Help Avoid Ransomware Attacks 1. Don’t click. Visiting unsafe, suspicious or

RANSOMWARE - Europol€¦ · THE MALWARE THAT HOLDS YOUR DATA HOSTAGE FOR A PRICE RANSOMWARE PROTECT YOURSELF INFECTED? WHAT TO DO NEXT HOW DOES IT SPREAD? Ransomware prevents or

Ransomware ly

RANSOMWARE - eset.com

Ransomware - asecuritysite.com · Types •Locker Ransomware. Locks the computer. •Crypto Ransomware. Requires decryption key. •Master Boot Record Ransomware. Attack MBR so that

An Enterprise Guide to Preventing Ransomware Attacksstratxsolutions.com/...black_ebook_ransomware_0912.pdf · AN ENTERPRISE GUIDE TO PREVENTING RANSOMWARE ATTACKS Ransomware isn’t