Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Virus Bulletin 2016: Challenges and Approaches ...

hasherezade
October 06, 2016

Virus Bulletin 2016: Challenges and Approaches of Cracking Ransomware

hasherezade

October 06, 2016
Tweet

More Decks by hasherezade

Other Decks in Programming

Transcript

  1. Agenda 1. Short background 2. Hunting weak points - tips

    and tricks 3. My experience on real-life examples (7ev3n, Petya, DMALocker, Chimera)
  2. Ransomware - trends (2015-2016) 0 50000 100000 150000 200000 250000

    300000 350000 Ransomware detections per month (source: Malwarebytes telemetry) 2015 2016
  3. Ransomware – encryption algorithms •Most popular: AES + RSA •AES

    to encrypt files, RSA to encrypt random AES key •Other observed: •AES (only), RSA (only), Salsa20, ChaCha, TripleDES, XTEA, XOR, custom... http://www.nyxbone.com/malware/RansomwareOverview.html
  4. Ransomware - successful recovery attempts •7ev3n, XORist, Bart – weak

    encryption algorithm •Petya – mistakes in cryptography implementation •DMA Locker, CryptXXX – weak key generator •Cerber – server-side vulnerability •Chimera – leaked keys •...
  5. Ransomware - successful recovery attempts •Tesla Crypt – failed to

    protect AES keys – weak keys for the ECDH (Elliptic Curve Diffie-Hellman) algorithm [2][3][4] •Torrent Locker (2014) – failed to initialize AES CTR properly (invalid initalization vector - introduced a possibility of known-plaintext attack) [1] •And many more...
  6. How to find the weak points? 1. Identifying the encryption

    algorithm •Visualization is your friend! 2. Checking the implementation correctness 3. Identifying the key generator •Is the key unique for each file? 4. Identifying how the key is stored
  7. Identifying the encryption algorithm What can the visualization tell us?

    Original file Encrypted by Cerber Encrypted by Locky High entropy, no patterns visible: often: stream ciphers/chained blocks (i.e. AES CBC), rarely: RSA https://github.com/hasherezade/crypto_utils/blob/master/file2png.py Encrypted by zCrypt
  8. Identifying the encryption algorithm What the visualization can tell us?

    Original file Encrypted by DMA Locker Encrypted by 7ev3n Lower entropy, patterns visible: block ciphers (i.e. AES ECB), possible: XOR & XOR-based https://github.com/hasherezade/crypto_utils/blob/master/file2png.py
  9. Identifying the encryption algorithm Find the file encryption function: 1.

    Where the content is read from the file 2. Where the content is written to the file 3. Search the call to the encryption function in between 1 and 2! 4. Search from where the encryption key comes 5. Search how the key is stored after use
  10. Checking the correctness of implementation •Fast check: •Dump the key

    from malware’s memory •Save the file encrypted by the malware •Encrypt the original file by a valid implementation of the identified algorithm •Compare the results
  11. Checking the correctness of implementation Comparing the output of given

    algorithm vs the valid one can give us hints! https://asciinema.org/a/87388
  12. Checking the implementation correctnes •Analysis of the algorithm implementation and

    comparing with the correct code static int16_t s20_littleendian(uint8_t *b) { return b[0] + (b[1] << 8); //... } static uint32_t s20_littleendian(uint8_t *b) { return b[0] + (b[1] << 8)} + (b[2] << 16) + (b[3] << 24); } Versus - the same function from the valid Salsa20:
  13. Identifying the key generator •Is the key unique for each

    file? •Make a simple test: •let the ransomware encrypt two identical files •is the output same?
  14. Identifying the key generator •What is used for code generation?

    •Hardware identifiers? •Random generator? Weak or strong?
  15. Exploiting the weak algorithm: Example – 7ev3n Challenge: • reverse

    the custom algorithm Approach: •Analyze the code and reverse the steps •Implement the decoder https://blog.malwarebytes.com/threat-analysis/2016/05/7ev3n-ransomware/ https://github.com/hasherezade/malware_analysis/tree/master/7ev3n
  16. Exploiting the weak algorithm: Example – 7ev3n Difficulties: •Many variants

    of the custom algorithm (no generic solution) •Additional data required (i.e. path to the file) https://blog.malwarebytes.com/threat-analysis/2016/05/7ev3n-ransomware/ https://github.com/hasherezade/malware_analysis/tree/master/7ev3n
  17. Exploiting the implementation vulnerability: Example – Petya Challenge: •find the

    key (8 characters from 54 character set) hxLxhxbxdxVxMxGx sHxxrSxxpCxxoKxx
  18. Exploiting the implementation vulnerability: Example – Petya Approach: •Reimplement the

    corrupt version of Salsa20 •Search the key space (using dumped validation buffer and nonce) •Possible to bruteforce (54 ^ 8 = 72301961339136)
  19. Exploiting the implementation vulnerability: Example – Petya •Interesting observation by

    @leo_and_stone (only in Red Petya): •Due to the specifics of the vulnerability, we can measure the progress in cracking •Genetic algorithms can be used, to make the correct key “evolve”
  20. Exploiting the implementation vulnerability: Example – Petya •When the genetic

    approach works? •Only in cases when we can measure the progress! Example: The closer we are to the correct key, the less unmatching characters we get in the verification buffer Demo of Genetic Algorithms applied: 1) Red Petya : • https://asciinema.org/a/87075 2) Green Petya : • https://asciinema.org/a/87077
  21. Exploiting the weak key generator: Example – DMA Locker Challenge:

    •Find the seed (start time), used to initialize rand() •Then, find a correct key for each file https://github.com/hasherezade/dma_unlocker
  22. Exploiting the weak key generator: Example – DMA Locker Approach:

    •approximate the timestamp by knowing date of the ransom note and/or file modification timestamp •Validate the key by header typical for file format https://github.com/hasherezade/dma_unlocker
  23. Exploiting the weak key generator: Example – DMA Locker DMA

    Unlocker https://github.com/hasherezade/dma_unlocker
  24. Exploiting the weak key generator: Example – DMA Locker DMA

    Unlocker https://github.com/hasherezade/dma_unlocker • Challenge: easy adding support for a new file format • Solution: Make a folder that is set of format’s samples. File name is a number of bytes to match. Some formats needs to be handled in a special way...
  25. Exploiting the weak key generator: Example – DMA Locker Difficulties:

    •Some file types are hard to validate •Finding one seed is not enough https://github.com/hasherezade/dma_unlocker
  26. Making use of the leaked keys: Example – Chimera Challenge:

    •find the proper key for the particular victim https://blog.malwarebytes.com/cybercrime/2016/08/decrypting-chimera-ransomware/
  27. Making use of the leaked keys: Example – Chimera Approach:

    •Use/implement the decryption algorithm •Make a “dictionary” attack on the encrypted file (using as a dictionary set of leaked keys) https://blog.malwarebytes.com/cybercrime/2016/08/decrypting-chimera-ransomware/
  28. Conclusions •Cryptography is difficult: multiple places where the implementation can

    go wrong •Some people still ignore the advice to not roll own crypto •Ransomware authors keep improving their products, so the decryptors have a short life span... •The most important is prevention