Well, good afternoon.
We are going to make a presentation about a work that we presented at the 3rd National Security Research Day in June of this year and that was awarded.
And thanks to Patrocinio Incibir, we are here presenting the work.
The work was made by Pedro García Teodoro, Lucía Álvarez, who will make the presentation with me, and me, José Antonio Gómez.
Regarding the structure of the presentation, it is divided in two parts.
The work itself, which would be the point 2, which is the mechanism, the technique that we have used to block the ransomware in a team and be able to detect it before it does its job, obviously not good, in the team.
And what I am going to do is a little introduction to ransomware, what problems it has, in general, what kind of detection techniques there are, a little to fit where the technique that we have used would be.
And also thinking a little about a generic auditor, explain what a ransomware is and what problems it has today.
Well, ransomware is really a malware, that is, it is a malicious program or a family of malicious programs, which, when installed on the machine, what it does basically, and hence the name, is an extortion.
That is, normally it is an economic extortion, in which a ransom is requested so that the user can regain control of the team.
Specifically, we have focused more on, we will see it later, on encrypted malware, where what it does is access the hard drive of the infected machine, encrypt all the files.
Once the erasers are encrypted, and , obviously, from there, what it does is ask for a ransom to the user of the machine, or the network, or the teams, so that they can take control.
In that sense, well, as I say, it kidnaps the data from the machine that it infects, and in that sense it can be considered a service denial attack.
And currently another type of extortion is also emerging, where what it does is threaten the victim by publishing data of those who have the team.
Photographs, personal data, etc.
Well, the main distribution method is controlled by download.
Normally we can download it through Word documents, through the macro mechanism that the text processor has.
There are also some that are downloaded through PowerShell scripts, which is the order interpreter of current Windows systems.
There is also, or it is done in Trojan, another technique that is also widely used is phishing, through an email that normally includes an executable file with the ransomware, or a link that redirects us to a web page to download the malware.
Well, there you have a typical image of a ransomware, where it is one of the screens that appears once it has acceded to the team, it has encrypted the data and simply asks us for a ransom.
And it gives us a payment mechanism that is usually done in Bitcoin to make it difficult to track where the money is going.
There are different types of blocking, which are relatively easy to skip, where what is basically done is to look for a mechanism, either through the graphical interface or the browser, in which the user, for example, if we are in Windows, it is difficult to access,
for example, the start button or any other function to do the normal work.
As I said, these are usually more easily skippable and therefore do not generate many problems.
The most widespread currently, and what has been doing a lot of damage in recent years, are the Cryptolockers, that is, those ransomware that block the hard drive files.
And as I said, basically it asks for a ransom to supposedly return the key, which may or may not happen.
Therefore, we must be prepared not to return the key even if we pay the ransom.
Other minority types are those that affect the master boot record of the hard drive to prevent booting, or those that allow to recover system control through SMS.
So, what we are paying is the cost of SMS.
Well, although it looks small, the drawing is small, but what I wanted to show is, well, what looks like a subway map, is a bit of the evolution of ransomware families.
As you can see, obviously, if we look at, for example, the range 2015 to 2017, the number of families has increased exponentially.
And the forecast is that they will continue to grow.
In fact, here you have, in the graph below, in the interval 2016-2017, you can see how it continues to grow practically exponentially and the forecast is that it continues to grow exponentially.
Basically, what is it due to?
It is basically due to economic benefit.
For you to have an idea, the estimated cost for this year is 1,000 million dollars.
In many cases, ransomware obviously requires small amounts, I say small, we are talking about possibly 200-300 euros, but the benefit comes from the fact that normally a good ransomware, even if it does bad things, can infect hundreds of thousands of teams,
as happened a few months ago with WannaCry.
Therefore, the economic benefit of cybercriminals is quite high.
And that has made, as you can see there, all the ransomware families, the families have progressed in that way in recent times and obviously the forecast is that it will continue like this for a few more years.
Well, there you have a scheme of how a ransomware works, where what we basically do is, for example, in the case of a phishing email ad, what we do is an email ad, which is an executable, which infects the machine.
Once the machine has been infected, what the ransomware does in the machine is to generate a public key and a private key, which are sent to a control and command server.
So the criminal has the private key to decrypt the disk, or the files that have been decrypted.
Once the keys are generated, what is done is to encrypt, as I said, all the disk files.
And once they have been encrypted, the original files are deleted, and from there the user has lost control of the computer, because he has no access to any of the data.
Once that has been done, as I said before, a screen appears where we are asked for a ransom, whatever it is.
I say whatever it is because for an individual user it can be 200 or 300 euros, for a company it can be 17, 18 thousand, 20 thousand dollars, etc.
In fact, usually the criminals in this case even tend to negotiate with the victim to lower the payment or reach an agreement on the payment.
In that sense, families have emerged, even to see the complexity, to facilitate the payment possible to the victim, what is done is even to open a chat in which the victim can chat with the criminal who tells him what is the form of payment, what is the process,
what he has to do, etc.
as I said, to possibly recover the keys.
From the point of view of protection, there I have a graphic of the company LMG Security, which is quite illustrative.
Basically, a mechanism is used that is called the three R's.
They come from recovery, respond and reduce the risk.
Basically, from the point of view of recovery, from the point of view of recovery, the most used technique, or that we must always have as a backup, that is, once we have possibly infected and we do not have access, what is always recommended is to have backups.
Recent backups, updated, and another important aspect, having a backup policy, depending on how critical the data is, it will be done daily, weekly or monthly, but the most important thing is that the backups are not accessible through the network.
Because the current ransomware are capable of not only infecting a team, but also of exploiting the network and infecting other teams of the network.
So, if we have backups in a network disk, evidently that disk will also end up encrypted.
Therefore, it must be disconnected.
From the point of view of response to ransomware, we have different techniques.
We have focused more on technical techniques, through a mechanism called deception, in which we are going to put a trap on ransomware.
Basically, that trap, what it tries to simulate is an infinite file, so what we do is block it.
In this case, our proposal, what it does is not only allow the ransomware to access an infinite file, but what we do is block it.
This happens in a blocked state, so it stops its activity and that gives us time to respond to the ransomware.
Specifically, for example, to detect what is the process that is executing the encryption and normally kill it or do whatever action it wants.
But there are many more types of responses, from awareness, to form a team of incident responses, etc.
We are not going to go into detail, because there is no scope.
And the risk reduction is to take the appropriate measures so that the infection does not occur.
Basically, there you have some.
Currently, many companies are using it to have insurance against ransomware or other types of attacks.
From a technical point of view, normally the most effective solutions are email and web trafficking to detect this type of infection.
Obviously, having a double authentication factor, performing exercises in front of the phishing company, where users of the different jobs are able to detect a phishing email and know when an email is not deceitful and when it is.
Maintaining the software, which is quite important to reduce the attack surface of the equipment.
And , obviously, having antivirus.
Although antivirus do not work 100%, at least we can stop known malware.
The main problem in the case of the latest malware and ransomware in particular, is that they exploit vulnerabilities from day zero.
And, therefore, many antivirus do not even know about the infection.
Therefore, it is a problem.
In fact, one of the advantages of the technique we use, as we will see later, is that it does not matter if it is from day zero or not.
Because it is really a trap and, therefore, any process that tries to open a file, that file that we are going to set as a trap, is going to fall into it.
Whether it is ransomware or not ransomware and, therefore, we are going to detect it.
Evidently, it also goes through regular security tests, system preservation analysis, etc.
All the known security techniques.
Well, as I always say, there is always the dilemma of paying or not paying.
Evidently, paying ransomware, the extortion that ransomware produces for us, has as a problem that we generate a chain where, as the cybercriminal collects money, he has benefits and, let's say, part of his job is to reinvest those benefits in new ransomware,
more and more perfected.
Therefore, the way to cut this cycle in which ransomware is being depurated, would be not to pay.
As I say, paying does not even determine that you get the keys back.
Therefore, you run the risk that you do not regain access to the system.
In general, to give you an idea of ​​last year, practically a third of infected users did pay ransomware.
In addition, the payment is given more in companies than at the individual level.
Evidently, the companies not only block the equipment, but also stop the operation of the equipment.
There have been infections in complete hospitals, in police stations, in large companies that, as I say, are not only the extortion itself, but also stop the operation of the company.
Therefore, as I say, in many cases, in different studies that have been done, the directors of the companies even have a certain amount of money reserved to pay for a possible extortion that is done against the blocking of the equipment.
From the point of view of defense mechanisms or defense systems, there are different types of systems.
I have put it a little, we will not go into details, to focus a little on our proposal.
Our proposal would be in what is called behavior analysis.
The idea is that when a process is executed, in our case, in a machine, in an operating system, is to see what is the interaction with the environment and, depending on that interaction, deduce if it is malware or not.
Is it a legal program or is it malware?
For example, there are interactions with the file system, with the network connections, possible modifications of the operating system, etc.
And there you have different proposals that interact.
In our case, the tool that we have developed is behavior analysis, in which, as I say, it is not only a general analysis, but what it does is generate what is called a honey file, which would be traps, trap files, where what we do is block the ransomware when it tries to access the file.
As I say, it is very simple and quite effective because any process that tries to access the file is going to be blocked.
Well, then there are also some key deposit proposals that analyze the entire ransomware interaction with the system, especially with cryptographic calls.
And what it does, basically, is to store information about which calls are made, with which parameters, and, above all, to possibly obtain the recovery key.
Therefore, the idea is to detect the interaction of the ransomware with the files to see which key it has generated and, therefore, to deduce which is the encryption key.
Well, another technique is also the detection of cryptographic primitives.
And, basically, what it does is to analyze the binaries to see the behavior of the ransomware in terms of which calls the encryption system uses and how it uses them.
And, finally, some automatic learning techniques are also currently being used to characterize benign and malign programs and, from there, draw conclusions.
Obviously, all these techniques have a percentage of false positives and false negatives that, obviously, can cause problems.
The idea is that, well, the proposal we have made and, as I said, it is going to be published recently, a paper has been accepted in Computer and Security.
I don't know when it will be published, but I imagine that it will be published soon.
As I said, the proposal we make is that there are no false positives or negatives, it is zero, the rate is zero, because it really detects any process that interacts with the cheat file we have put.
Well, from the detection point of view, what problems does ransomware have?
Especially for those techniques that use some kind of behavior analysis of ransomware.
Well, one of the main problems is obfuscation.
Obfuscation would be altering the code or the data of the ransomware so that it is functionally equivalent, but the visual aspect would be different.
What this achieves is that obfuscation, especially for techniques such as using antivirus, which are largely based on ransomware signatures or, in general, malware, obfuscation means that the signatures are not valid.
Therefore, it would not work for ransomware or malware from day zero.
Well, there are also white-box cryptography techniques in which what is done is to vary the form of decryption, that is, to use different decryption techniques, so the behavior of decryption, which we expect to be traditional, is not the correct one.
Also, although it is appearing now and recently, the ransomware of things, that is, we are currently in the world of what we call the Internet of Things, the same thing that appears in the Internet of Things, the ransomware of things will appear, where we will find ransomware in sensor devices,
etc.
Therefore, currently it is not a big problem, but it will be soon, for sure.
Also, in that sense, one of the problems that we will possibly find would be the union of ransomware and rootkit.
Remember that a rootkit is a program that hides itself from the eyes of any observer.
For example, a system administrator, a network administrator, where what it does is hide.
Therefore, the possibility that we will soon find of ransomware that is going to hide itself and therefore it will be difficult to detect.
And, well, lately what is called socio-technical attacks are also appearing, where, for example, recently, a few months ago, a ransomware emerged where the extortion, in this case, they asked us to infect other users.
Therefore, at some point, when we are infecting more, a pyramidal effect occurs, and somewhere users will not be able to infect others.
Therefore, in the end, some will have to pay.
And, lately, what is also appearing is what is called data filtering for extortions, where they do not ask us for a ransom to unlock the equipment, but they ask us for a ransom not to publish information in the equipment.
Therefore, it is an attack, in this case, on the confidentiality of the data stored in the devices.
As you can see, the variety is very wide.
Among other things, as I say, the reason is because, economically, for cybercriminals, it is quite effective to collect money.
Well, once we have seen a general overview of the technologies and the problems of ransomware, what we are going to do is to present the proposal that we have made, as I say, to detect, in principle, any ransomware, known or unknown, and not only detect it,
but to use it or stop it as quickly as possible.
I leave you with Lucia to present the second part.
Well, as José Antonio has commented, we have focused on decrypted ransomware because they are the most harmful and the ones that are most present today.
And these ransomware, once they have affected our files, they have encrypted them.
If we do not have the private key, which would be on the attacker's server, we cannot decrypt it.
So we thought, we have to stop ransomware and detect it before it encrypts it.
In this context, we have designed an early ransomware detection technique based on HoneyFiles.
HoneyFiles is the name we have given to our trap, which I will now explain in a little more detail how we have done it.
The tool, well, we have called it RLocker, as it is a word game between ransomware and blockade.
And the system, the general architecture would be the following.
Our traps would be distributed throughout the entire file system, well, strategically placed, so that ransomware accesses the traps before any other file.
This trap is a loop, well, it is an infinite file, so that when ransomware accesses the trap, it stays in a loop and gives us time to have it blocked, to detect it, to notify the intrusion and to carry out the necessary countermeasures.
Therefore, we want our system to block ransomware, that it does not affect the valuable files, notify the user and carry out the countermeasures.
This procedure is conceptual, therefore, it would be extrapolable to any platform.
What requirements do we want?
Well, first of all, that it is efficient and effective, that is, that it has real results for ransomware and that it really does not encrypt our files.
Secondly, we want it to be low-consumption, so that the user does not need to dedicate a lot of resources to his computer, or even if we are going to introduce it into the embedded system, because of the Internet of Things, that it does not consume resources,
neither of storage, nor of computers.
It does not require special privileges, that the user is totally transparent, and simplicity, simplicity attracts.
Well, initially, as a proof of concept, we have developed this idea in the IONI system.
Specifically, we have based it on Linux, but once we have proven that it works and that it can be extrapolated to other more used systems, we are working on it.
Well, now we need to see how we do these traps, because, as I said, it is a very good idea, but how?
Well, first of all, we think of an infinite file, but that consumes a lot of resources, both of storage and of computers.
So, we thought of simulating an infinite file, modifying the operation of reading the libraries that Ransomware would use.
This is not simple, and it would not work for Ransomware from day zero, that is, new Ransomware.
We have to know the behavior of Ransomware, so we would not be based on signatures.
It does not work for us either.
And finally, we decided, we came up with the idea of doing it with FIFO threads.
FIFO threads are processes that synchronize reading and writing processes.
So, all this would meet all the requirements.
Why did we choose FIFO?
FIFO are files that exist in the file system with name and hierarchy, that is , we can refer to them as a normal file.
They allow us to communicate processes not related to reading and writing, that is, I do not need them to be processes that are known, they do not have to be father-son processes.
It is persistent, that is, the moment there is no process acting on FIFO, it continues to work.
And finally, the most important thing, which is the synchronization of reading and writing processes.
In this image, it shows more or less, well, the operation is clearly shown.
What we do is create a thread in which we start a writing process.
In this writing process, its file descriptor is never eliminated.
Therefore, when a reading writing process arrives, which is going to be the ransomware, it will be reading what is inside the thread, and as it never ends, it is blocked.
At that moment, our process, which was blocked, realizes that they are accessing it, and we can develop countermeasures.
As we can see, this would be useful for any ransomware, because if there is something common in absolutely all ransomware, is that if they want to encrypt us, they have to open and read the file.
And if they open us, we have already arrested them.
Well, this is a simple diagram of the operation, in which on the right side is our tool, Relocker, which has two processes.
Initializing the environment, that is, when the user installs the application, the tool, the trap would be installed, well, all the traps, which now I explain how they are distributed, and the processes on the KUC are created.
The writing process.
Once a ransomware arrives, that is, they read it, the reading process that we had created is unlocked, and in this way we were not consuming resources, and now we only have to execute the order, the software that lists the processes that are operating on a file,
find the intruder process identifier and eliminate it.
That is, we kill the ransomware process.
How do we deploy the traps?
Well, as we said, we do not want to consume storage resources.
We cannot distribute traps through all the directories to make sure that it is not going to distract us.
So what we do is create a single trap to which links are placed towards it.
That is , we only occupy memory positions, we do not occupy disk memory.
These links are placed strategically so that the first ransomware to enter the directory is the first file it reads.
This is done by Inodo and others.
And they have an attractive name because some ransomware are based both on extensions and on file names.
What are the benefits of our tool?
The ransomware is completely unblocked.
The countermeasures are launched automatically because as soon as the ransomware enters the trap, the writing is unblocked by itself without us having to monitor the system.
And the countermeasures are carried out.
It does not consume resources and does not affect the rest of the file systems.
That is, if now the user came and opened a FIFO, it would simply say, this cannot be opened.
This is an image to give you an idea of the prototype version we made in which we had a process that we put in the background and left it working.
We run a ransomware sample on a virtual machine and it notified us of the threat.
This is how we manage and decide if we kill the process or not.
The experimentation we did was, first of all, directed to the CAUCE to check if we were really going to be able to control those reading and writing processes.
Then we used the Bash ransomware which is a proof of concept developed by SoftwareLibre.
As I said, we developed the tool first in Linux and we used this proof of concept of ransomware to simulate it and check that it worked.
Then we did real tests that we will show now a short video of one.
And finally we checked that it did not affect the rest of the programs that were running on the machine.
The most characteristic test we did, as it has had so much repercussion this year, everything about WannaCry and so on, to be able to simulate it in Ubuntu environment, we used Wine, which simulates in Windows environment.
And here I have a short video of how we did it, I don't know if you can see it.
The first thing we did was download the sample of WannaCry.
Then, I have told you that...
Well, this is the program we did.
This creates a folder that is really hidden, but here you can see it, which is the one that says MyDeer, so you can see it in the video.
We start the process and we leave it in background.
As we can see, inside the folder we have created the honey file, which is the real FIFO file, and in each directory we have created a symbolic link.
I have created some files in directories so you can see if it encrypts or not.
And...
well, we run Wine, because we have to simulate it in Windows environment.
And we run WannaCry.
It takes a while, because at the beginning it starts downloading all the files it needs to encrypt, then it stops downloading and unloading.
And as we can see, the first directory is encrypting it, because I have not set the trap in the first one.
First it has notified...
because it notifies all the processes that are accessing.
As I have started Wine, well, Wine is also accessing my FIFO, so it notifies me.
Well, we delete it.
And there it is already notified the WannaCry process, which is also accessing the FIFO.
If we go to Documents, we see that it has not kept encrypting, that is, it has not reached the Documents directory, because WannaCry started encrypting through the desktop, but it does not have to start there.
We see that it has not touched those files, in any directory, it has only stayed in the desktop.
Well, that's where all the files have been downloaded.
And, well, if we kill the process with the identifier, obviously it stops.
I leave it for a long time so that it can be seen that it does not keep encrypting.
And that's it.
In that sample, some have really been encrypted, it is not a sample that does not work.
Let's see if it would be completely encrypted.
All those in the directory.
By getting caught in the first trap that has been found, which has been in the link in the desktop, it has not been able to continue going through the directory.
And, well, we see that those here are not encrypted.
Well, the results we had were that, indeed, the ransomware was completely blocked.
We had the time we needed to kill the process.
The storage resources we use are 2K because it is what the FIFO occupies.
But, well, it is despicable.
The system resources can also be said to be null because while there is no ransomware reading our FIFO, the process is completely stopped, that is, it is not consuming resources.
The response time.
If we have to do a stream of time, well , maybe 500, 80 milliseconds, but obviously it depends on the machine where it is.
It is totally transparent to the user and the idea is simple.
Well, once we have tested it and we see that it works, we said, well, we are going to test it in other systems more used by users.
And we have been doing tests in systems such as Android and Windows.
The problem of Android is not really an operating system, it is a layer on an operating system, so you do not have all the possibilities that an open platform like Linux allows us.
So we find problems when making symbolic links and in directory, you can only do FIFO in a certain directory.
It can be done by programming in the module, in the Android kernel, you program it and it should work.
As a future route, regarding the deployment, well, these are future routes that we are currently working on because we are still working on the project, we can ensure a coherent deployment of the system, that is, the symbolic links are there, but who tells me that the user does not delete them by mistake?
We have to take this into account so that the system really works.
As functionalities, we manage the process automatically, we are doing it based on data, we determine the process, if the program is benign or not, and the database is updated, delete the malware files, that is , we have stopped it, but there I have all the shit,
and move it to other platforms.
Android would be viable because it is based on Uni, macOS as well, and Windows, we are working on it since it would be a very good proposal if it works because almost all users use Windows.
Well, as conclusions, so fast, we can implement a novel methodology with which we have obtained very good results, and we rely on a characteristic that is common in all ransomware.
The tool has been designed that meets all the requirements we wanted, we have implemented it online, we have studied its extrapolation in other platforms, and finally we have compared it with results of other proposals, and we have seen that it even improves the results we have.
And well, that's all, if you have any questions...