The New Scourge of Ransomware: A Study of CryptoLocker and Its Friends
summary
CryptoLocker uses a public key model where the private key never touches the victim and a domain generation algorithm spits out roughly 1,200 candidate domains per day, so defenders register sinkholes and one team runs about 125 sinkholes against ~1,000 registered domains. A 160-person working group coordinates reversing the DGA, passive DNS and async adns querying, Bitcoin tracing and memory forensics. Law enforcement leads Operation Tovar across 13 countries, the campaign runs under a year and a decryptor later appears.
AI-written summary · about
chapters (57)
- 0:00Introduction
- 2:19Introductions
- 2:53What is ransomware
- 3:37Ransomware in general
- 4:15Ransomware is not new
- 4:51New ways to leverage ransomware
- 5:42Difference between symmetric and asymmetric
- 6:21Ransomware is a growing threat
- 6:59Ransomware is a marketing threat
- 7:35CryptoLocker appears
- 8:26Theyre getting the data back
- 8:40How we met
- 10:14Working group
- 11:12David Diggin
- 13:00Mafia Rules
- 14:39ASDF
- 15:52OPSEC
- 17:32Recovery
- 18:07Backups
- 18:38Updated Directory
- 19:16Domain Generation
- 20:35Reverse DGA
- 21:15No Domains Registered
- 23:26Community Response
- 24:21Working Groups
- 25:26Industry Law Enforcement
- 26:12FBI
- 26:29CryptoLocker
- 27:11Gameover Zeus
- 28:16Single Flux Networking
- 28:56Following the Money
- 29:32Targeted Businesses
- 30:38Money Packs
- 32:20The good goes takedown
- 33:11DNS tools
- 34:17Passive DNS
- 34:36Bias
- 35:27Bitcoin Value
- 36:18Politeness
- 37:06sufficiency
- 37:59we are sending a message
- 38:44a lot more events
- 39:15there comes a time
- 39:50theres nothing wrong with that
- 40:12this was a very lucrative cash crop
- 41:40what do you do next
- 42:29they tended to do trouble
- 43:37Flashback
- 44:05Algorithm
- 44:25sinkholes
- 46:38no physical evidence
- 46:58law enforcement
- 47:51impact
- 48:37working with industry
- 49:26ransomware examples
- 49:57ransomware techniques
- 50:27resiliency
related talks
32mProspecting Ransomware Tech
37mRansomware Resilience: Holistic Defense for SOC Leaders
37mThe 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?
40mRansomware Threat Landscape
32mSurviving a Ransomware Attack - Lessons from the Field
33mThe Evolution of Ransomware - from Floppies to Droppers
19mThe Innerworkings of Ransomware
24mThe History of Ransomware: From Floppies to Droppers, and Beyond