The talk below details Javascript-based malware threats that we have observed in the wild. Traditionally, malware is developed in languages such as C and C++, and so studying Javascript-based malware threats has been an interesting exercise for us.
In this CascadiaJS talk, I share intricacies of the RAA ransomware, the first ransomware written entirely in Javascript, and Cryptojacking attacks. CascadiaJS was a great venue to share this analysis since it brings together Javascript experts and enthusiasts. Please watch the talk embedded below.
I recently spoke at ToorCon XX about the dangers of modern ransomware and cryptojacking attacks. These are the top malware threats in 2018 and as part of the Security Research Group at MSU, I was closely following the threat patterns. The video for the talk has now been released by ToorCon, and the video and talk abstract are provided below.
Ransomware and cryptojacking have been recognized as the top malware
threats in 2018. Financially motivated cybercriminals are attracted to
both since both remain viable means of generating illicit income. In
this talk, we delve deep into the latest characteristics observed in
ransomware and cryptojacking attacks. Modern ransomware go beyond mere
data encryption and come bundled with other threats, while cryptojacking
attacks exploit unsuspecting web users by deploying embedded JavaScript
miners concealed in websites. We discuss the intricate characteristics
of sophisticated modern ransomware variants, cryptojacking attacks, and
the results of our web crawl identifying websites involved in
cryptojacking. Finally, we compare ransomware and cryptojacking in terms
of their potential to generate illicit income for cybercriminals versus
the levels of sophistication required to implement their respective
campaigns.
Modern malware present multi-faceted threats that leverage a variety of
attack vectors. Leading the malware threatscape in 2018 are ransomware
and cryptojacking attacks, and the more evolved variants are now
implementing targeted attacks against organizations (e.g. SamSam). These
modern ransomware include a hybrid cryptosystem that uses a combination
of symmetric and asymmetric cryptography. In recent practice,
ransomware are going beyond mere data encryption and come bundled with
other threats. We present real-world cases of ransomware where we
observed these cryptoviral extortions drop trojan horses (e.g. RAA
dropping pony) and cryptominers (e.g. BlackRuby). Our research shows
that these secondary infections remain active on host even after the
ransom is paid. During this talk, we will also discuss how elliptic
curve cryptography (ECIES) is deployed in modern ransomware (e.g. Petya
and PetrWrap) and the tactical advantages it provides (over RSA) to
ransomware operators. We will show how many ransomware variants purge
shadow copies (via vssadmin), encrypt network backups (using
WNetAddConnection2), and use the latest anti-virus circumvention
techniques such as “process doppelganging” (e.g. SynAck ransomware). In
addition, we will discuss the results of our preliminary web crawl that
identified cryptojacking scripts embedded across a variety of websites.
We will discuss just how cryptojacking works, why it is rampantly
spreading, how it effects organizations and individuals and how to
effectively protect an organization and its employees against it.
In conclusion, we will discuss the future of the most potent ransomware
and cryptojacking malware as predicted via analysis of real-world
malware samples observed lately in the wild. We will also explore new
attack vectors (besides phishing) deployed by these malware such as
exploiting critical vulnerabilities (e.g. the infamous EternalBlue) or
brute forcing remote services (e.g. RDP or SSH). All arguments presented
during the talk will be backed by empirical evidence in form of system
snapshots, code snippets, and network packet dumps as collected from
real-world malware.
I recently spoke at GrrCon 2018 about how ransomware actually implement key management models by abusing the resident CryptoAPI on host systems. This 25 minute talk goes deep into explaining what the CryptoAPI entails on a Windows system, what DLLs the ransomware imports, what functions from these DLLs are used by the ransomware, and how Cryptographic Service Providers (CSPs) come into the picture.
This talk also demonstrates the concepts by taking the example of the infamous "NotPetya" ransomware. We reverse engineer the NotPeya malware in IDA disassembler and discuss the cryptographic functions being imported from DLLs on Windows.
Ransomware such as WannaCry and Petya have been heavily focused upon in the news but are their cryptographic models different from predecessors? Key management is crucial to these cryptoviral extortions and for convenience, they harness the power of resident Crypto APIs available on host. Simply stated, they command victim’s resources to lock victim’s resources. In this talk, we examine popular key management models deployed in infamous cryptovirii with the ultimate objective of providing a deeper comprehension of exactly how resident APIs are being used against users. On a Windows host, CryptoAPI (CAPI) provides cryptographic services to applications. CSPs are sets of DLLs that are associated with CAPI implementing cryptographic functions such as CryptAcquireContext, CryptGenKey, CryptEncrypt, CryptImportKey, CryptExportKey, CryptDestroyKey. In Windows Vista and later, CNG replaces CAPI and the ransomware menace persists. We explain cryptographic functions exploited by several ransomware families and explore answers to crucial questions such as how and where the encryption key is generated, where it is stored, how it is protected while encrypting user data, and how it is securely purged. We provide graphical representations combined with pseudo-codes embodying real-world Crypto API function calls pertaining to key management in ransomware. This talk delves deep into key management in present-day ransomware and is a direct result of real-world case studies of highly virulent infections. Dissections will be shown to back up the arguments.
Right now, your computer might be using its memory and processor power – and your electricity – to generate money for someone else, without you ever knowing. It’s called “cryptojacking,” and it is an offshoot of the rising popularity of cryptocurrencies like bitcoin.
Instead of minting coins or printing paper money, creating new units of cryptocurrencies, which is called “mining,” involves performing complex mathematical calculations. These intentionally difficult calculations securely record transactions among people using the cryptocurrency and provide an objective record of the “order” in which transactions are conducted.
The user who successfully completes each calculation gets a reward in the form of a tiny amount of that cryptocurrency. That helps offset the main costs of mining, which involve buying advanced computer processors and paying for electricity to run them. It is not surprising that enterprising cryptocurrency enthusiasts have found a way to increase their profits, mining currency for themselves by using other people’s processing and electrical power.
Our security research group at Michigan State University is presently focused on researching ransomware and cryptojacking – the two biggest threats to user security in 2018. Our preliminary web crawl identified 212 websites involved in cryptojacking.
Source code of a cryptojacking website, with a box around the text telling the software where to credit any cryptocurrency earnings.Screenshot by Pranshu Bajpai, CC BY-ND
The mining script can be very small – just a few lines of text that download a small program from a web server, activate it on the user’s own browser and tell the program where to credit any mined cryptocurrency. The user’s computer and electricity do all the work, and the person who wrote the code gets all the proceeds. The computer’s owner may never even realize what’s going on.
Is all cryptocurrency mining bad?
There are legitimate purposes for this sort of embedded cryptocurrency mining – if it is disclosed to users rather than happening secretly. Salon, for example, is asking its visitors to help provide financial support for the site in one of two ways: Either allow the site to display advertising, for which Salon gets paid, or let the site conduct cryptocurrency mining while reading its articles. That’s a case when the site is making very clear to users what it’s doing, including the effect on their computers’ performance, so there is not a problem. More recently, a UNICEF charity allows people to donate their computer’s processing power to mine cryptocurrency.
However, many sites do not let users know what is happening, so they are engaging in cryptojacking. Our initial analysis indicates that many sites with cryptojacking software are engaged in other dubious practices: Some of them are classified by internet security firm FortiGuard as “malicious websites,” known to be homes for destructive and malicious software. Other cryptojacking sites were classified as “pornography” sites, many of which appeared to be hosting or indexing potentially illegal pornographic content.
The problem is so severe that Google recently announced it would ban all extensions that involved cryptocurrency mining from its Chrome browser – regardless of whether the mining was done openly or in secret.
The longer a person stays on a cryptojacked website, the more cryptocurrency their computer will mine. The most successful cryptojacking efforts are on streaming media sites, because they have lots of visitors who stay a long time. While legitimate streaming websites such as YouTube and Netflix are safe for users, some sites that host pirated videos are targeting visitors for cryptojacking.
Other sites extend a user’s apparent visit time by opening a tiny additional browser window and placing it in a hard-to-spot part of the screen, say, behind the taskbar. So even after a user closes the original window, the site stays connected and continues to mine cryptocurrency.
What harm does cryptojacking do?
The amount of electricity a computer uses depends on what it’s doing. Mining is very processor-intensive – and that activity requires more power. So a laptop’s battery will drain faster if it’s mining, like when it’s displaying a 4K video or handling a 3D rendering.
Similarly, a desktop computer will draw more power from the wall, both to power the processor and to run fans to prevent the machine from overheating. And even with proper cooling, the increased heat can take its own toll over the long term, damaging hardware and slowing down the computer.
This harms not only individuals whose computers are hijacked for cryptocurrency mining, but also universities, companies and other large organizations. A large number of cryptojacked machinesacross an institution can consume substantial amounts of electricity and damage large numbers of computers.
Protecting against cryptojacking
Users may be able to recognize cryptojacking on their own. Because it involves increasing processor activity, the computer’s temperature can climb – and the computer’s fan may activate or run more quickly in an attempt to cool things down.
People who are concerned their computers may have been subjected to cryptojacking should run an up-to-date antivirus program. While cryptojacking scripts are not necessarily actual computer viruses, most antivirus software packages also check for other types of malicious software. That usually includes identifying and blocking mining malware and even browser-based mining scripts.
Written by: Pranshu Bajpai
| Find Pranshu on Google+ And LinkedIn
Recently, I was collaborating with a PhD candidate on a research project on malware analysis. The subject relates to behavior-based analysis of malware. I helped analyze malware samples that were collected from various sources.
First thing we did was to set up a virtual environment. She runs her samples in a virtual sandbox (CWSandbox), while I installed a fresh copy of Windows on a VirtualBox.
We collected the virus samples from various places including:
Process Monitor sysInternals: This gives a detailed look at processes running on the system. This tool makes it possible to execute the malware and then observe its behavior by identifying its name in Process Internals.
Regshot: This tool takes a snapshot of the Registry before and after the malware infection, compares them., and then points out the differences. This points to the changes that the malware has made.
Ollydbg: A debugger to reverse the malware executable into its assembly code.
Cryptocurrency mining can be a legitimate source of revenue – but not when done secretly or by hijacking others’ computers to do the work and having them pay the resulting financial costs.