How Researchers Helped Cripple CryptoLocker

A Black Hat USA speaker will give the backstory on how he and others helped disrupt the infamous CyptoLocker operation, and what they learned about it.

The big news this week that a global team of law enforcement agencies and security researchers has
disrupted a sophisticated and infamous ransomware operation
came as no surprise to Lance James.
James, head of cyber intelligence at Deloitte & Touche, had worked with the FBI on the case, providing intelligence from a sinkhole he and his team had built to capture CryptoLocker traffic. CryptoLocker has been on the radar screen of the law enforcement and security communities for some time, and the alliance of agencies and security researchers did some serious damage to the operation by disrupting the GameoverZeuS botnet that transports it, as well as by seizing the key command and control servers used with CryptoLocker.
CryptoLocker, which encrypts the victims files on local drives network shares using strong encryption, has dogged enterprises for months. The attack typically begins with a convincing-looking spearphishing email and attachment, which, installs the Zeus Trojan when opened. Zeus then grabs and installs CryptoLocker, and a victim gets locked out of his own machine before he knows hes got malware.
It targets corporate... the first victim we found was a high-level business executive, James says. The value of your information [is] worth a lot more than the ransom fee in most cases.
Faced with fessing up to the company for falling for the ransomware, some victims pay the ransom of $300 or so to get their data decrypted.
James says a coordinated effort to quash CryptoLocker occurred mainly due to worries that it could become an epidemic. It would have been an epidemic if no one had intervened. He will share details and insight into his teams research and sinkhole effort, as well as the coordination with law enforcement, in a presentation for
Black Hat USA in August, The New Scourge Of Ransomware: A Study Of CryptoLocker And Its Friends.
CryptoLocker marked a new generation of ransomware, where attackers demand payment to give users back control of their machines. It uses strong encryption, namely public key crypto. They used the native Windows API library and actually did it correctly. The malware uses RSA 2048-bit keys and a private key on the command and control server. And attackers use AES 256-bit encryption to encrypt the victims files.
If you dont have access to the control server, you cant get those files back, James says. In the old days, there would be a symmetric key in the malware you could find and decrypt. Some [ransomware] didnt even encrypt. They just locked the machine.
The organization behind CryptoLocker is highly organized -- and making big bucks. According to James, the gang received about $100 million in ransom payments in its first year. Victims can end up paying hundreds of dollars to regain access to their data, but even paying up doesnt guarantee getting your data back. Also, the attackers could sell your files in the underground for profit.
Another big piece of the law enforcement crackdown this week was the indictment of the GameoverZeuS botnet administrator, a Russian national, on charges of conspiracy, hacking, wire fraud, bank fraud, and money laundering associated with the botnet, as well as other charges for his role in CryptoLocker. James says the indictment helps instill a little fear, whether the alleged cybercriminal is extradited to face his crimes or not.
Meanwhile, Jamess team has been stalking CryptoLocker via the sinkholes. That blocks a lot of attacks. They generate about 1,000 domains a day. The researchers try to get ahead of the new domains, which are built via the Domain Generation Algorithm (DGA), by grabbing up the next ones in line and registering them.
We start to register them ahead of time and get the sinkholes in place, he says. This allows a lot of the [victims] to go to the sinkhole server, which slows down the attackers and gives the defenders time to block them. We started lowering the effect of CryptoLocker over time.
James says he knows what CryptoLockers backend infrastructure looks like, and he plans to provide more detail on that in his Black Hat talk.
So if antivirus tools arent catching CryptoLocker quickly enough or at all, whats the best defense? Backup, he says. The big message is about resiliency and business continuity. You have to assume you might get hit with something, and assume youre in a hostile environment.
Now that CryptoLocker has been thwarted, at least temporarily, the attackers may go to a peer-to-peer infrastructure and use the Tor anonymization service. It would be hard to see the servers then.
James was the featured guest on yesterdays episode of Dark Reading Radio. The archive of the broadcast is available
here
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
How Researchers Helped Cripple CryptoLocker