I recently spoke at GrrCon 2018 about how ransomware actually implement key management models by abusing the resident CryptoAPI on host systems. This 25 minute talk goes deep into explaining what the CryptoAPI entails on a Windows system, what DLLs the ransomware imports, what functions from these DLLs are used by the ransomware, and how Cryptographic Service Providers (CSPs) come into the picture.
This talk also demonstrates the concepts by taking the example of the infamous "NotPetya" ransomware. We reverse engineer the NotPeya malware in IDA disassembler and discuss the cryptographic functions being imported from DLLs on Windows.
Ransomware such as WannaCry and Petya have been heavily focused upon in the news but are their cryptographic models different from predecessors? Key management is crucial to these cryptoviral extortions and for convenience, they harness the power of resident Crypto APIs available on host. Simply stated, they command victim’s resources to lock victim’s resources. In this talk, we examine popular key management models deployed in infamous cryptovirii with the ultimate objective of providing a deeper comprehension of exactly how resident APIs are being used against users. On a Windows host, CryptoAPI (CAPI) provides cryptographic services to applications. CSPs are sets of DLLs that are associated with CAPI implementing cryptographic functions such as CryptAcquireContext, CryptGenKey, CryptEncrypt, CryptImportKey, CryptExportKey, CryptDestroyKey. In Windows Vista and later, CNG replaces CAPI and the ransomware menace persists. We explain cryptographic functions exploited by several ransomware families and explore answers to crucial questions such as how and where the encryption key is generated, where it is stored, how it is protected while encrypting user data, and how it is securely purged. We provide graphical representations combined with pseudo-codes embodying real-world Crypto API function calls pertaining to key management in ransomware. This talk delves deep into key management in present-day ransomware and is a direct result of real-world case studies of highly virulent infections. Dissections will be shown to back up the arguments.
You can watch the video here:
