Cryptolocker Ransomware: A Ransom no more!
Christopher S Ebingersmith
University of Maryland University College
June 24, 2015

Introduction

Cryptolocker Ransomware is part of a larger number of malware campaigns infecting large numbers of computer systems. This new variant of ransomware is more egregious in nature as it not only holds the system hostage as other types of ransomware, but through the course of infection a great number files, when found, are encrypted by this malware. The primary vector of infection is through the use of phishing email attempts to entice unwitting users to click on malicious attachments. Once the system is infected Cryptolocker hides, slowly beginning to affect the availability of files on the affected system communicating back to the “attackers’ command and control (C2) server to deposit the asymmetric key out of the victim’s reach.” (Alert, 2013)
Cryptolocker, which only seems to affect Windows based targets, first popped up on security radars in September of 2013, “and these early versions were distributed via social engineering and spam emails that try to entice business professionals into opening an attached Zip file.” (Kostadinov, 2014) The zip files were thinly disguised as a 20kb file with some file names between 13 and 17 characters that mimicked “the look of legitimate businesses and through phony FedEx and UPS tracking notices.”(Alert, 2013) Spamming was the primary method utilized to infect potential hosts; this really contained an embedded Trojan (Downloader.Upatre). (Kostadinov, 2014) This was really the tip of the iceberg of this infection. Subsequently, Downloader.Uptare, would “download the Gameover Zeus Trojan (a.k.a. Trojan.Zbot), which in turn will download Trojan.CryptoLocker.” (Kostadinov, 2014) Cryptolocker is a very different beast though: It allows normal operation to occur for a time, “but your personal files, such as documents, spreadsheets and images, are encrypted.” (Ducklin, 2013) There is a laundry list of files affected by this malware. Once embedded inside the host, it calls “home”, back to the command and control server, and it may use “Domain Generation Algorithm (DGA), which can generate 1,000 domains daily and hold onto the first available line, to seek a live C2 server.”(Ducklin, 2013) It has to find a proper command and control server containing the right private key to decrypt the message sent in order to communicate. The next step is dump the public key in order to encrypt affected files with the unique key sending it back to the command and control server.
Each file is encrypted with a unique AES key, which in turn is encrypted with the RSA public key received from the C2 server. The encrypted key, a small amount of metadata, and the encrypted file contents are then written back to disk, replacing the original file. Encrypted files can only be recovered by obtaining the RSA private key held exclusively by the threat actors. (Jarvis, 2013)
What we see is that while you can use antivirus (anti-malware) software, this only mitigates part of the problem, which would be any additional viruses or Trojans downloaded to your system. If the system gets infected and you find your files become encrypted, the only safeguard is to have a clean backup from which you can pull clean data. (Ducklin, 2013) If you did the research, you might be able to “black hole” at least some of the domains through policies to modify the localhosts file in computer systems and add the black hole list to your proxy server (if you use one). As an added layer of defense, network administrators could try to resolve known domains to IP address blocking them at the perimeter to prevent actual communication with the command and control server(s) involved in passing the encryption keys. Also, if possible, “enable Inbound and Outbound inspection of HTTP, FTP, IMAP, SMTP, POP3, CIFS/NetBIOS and TCP Stream.”(Best Practices, 2014) User awareness training is the keystone to all of this: if you are not educating them, they will show you they are the weakest link in the chain. A multilateral defense strategy is necessary to defend against this and other threats as they evolve over time; if you aren’t vigilant in the cyber realm, you are as good as hacked.

References
Alert (TA13-309A). (2013, November 5). Retrieved June 24, 2015, from https://www.us-cert.gov/ncas/alerts/TA13-309A
Best Practices to protect against CryptoWall and CryptoLocker (SW12434). (2014, November 11). Retrieved June 25, 2015, from https://support.software.dell.com/kb/sw12434
Ducklin, P. (2013, October 18). CryptoLocker ransomware - see how it works, learn about prevention, cleanup and recovery. Retrieved June 24, 2015, from https://nakedsecurity.sophos.com/2013/10/18/cryptolocker-ransomware-see-how-it-works-learn-about-prevention-cleanup-and-recovery/ Jarvis, K. (2013, December 18). CryptoLocker Ransomware - Dell SecureWorks. Retrieved June 24, 2015, from http://www.secureworks.com/cyber-threat-intelligence/threats/cryptolocker- ransomware/
Kostadinov, D. (2014, February 6). RansomWar(e) - InfoSec Institute. Retrieved June 24, 2015, from http://resources.infosecinstitute.com/ransomware/