Ransomware detection with Bro Mike Stokkel 13 Sept 2016 - - PowerPoint PPT Presentation

▶
ransomware detection
SMART_READER_LITE
LIVE PREVIEW

Ransomware detection with Bro Mike Stokkel 13 Sept 2016 - - PowerPoint PPT Presentation

Sep 05, 2022 684 likes •986 views

Ransomware detection with Bro Mike Stokkel 13 Sept 2016 Introduction Who am I? Mike Stokkel Security Analyst @ Fox-IT Internship at Fox-IT Bachelor July 2016 Introduction Agenda What am I going to talk about?

slide-1
SLIDE 1

Ransomware detection

with Bro

Mike Stokkel 13 Sept 2016

slide-2
SLIDE 2
  • Who am I?

– Mike Stokkel – Security Analyst @ Fox-IT – Internship at Fox-IT – Bachelor July 2016

Introduction

Introduction

slide-3
SLIDE 3
  • What am I going to talk about?

– Fox-IT – Ransomware – Bro Policy – Results – Demo

Agenda

slide-4
SLIDE 4

Fox-IT

slide-5
SLIDE 5
  • Located: Delft, The Netherlands
  • IT security

– Managed Security Services – Auditing – Cryptographic solutions

Company

Fox-IT

slide-6
SLIDE 6
  • Snort-based detection
  • Bro

Security Operation Center

Fox-IT

slide-7
SLIDE 7

Ransomware

slide-8
SLIDE 8
  • Malware

– Encryption – Payment – Decryption

  • Rising concern

Explanation

Ransomware

slide-9
SLIDE 9
  • Process

– Master key (public and private key) – Generating a key for the victim – Encrypting the victim’s key

Encryption

Ransomware

slide-10
SLIDE 10
  • Personal Computer

– Local files

  • Company

– Network Share

  • To pay or not to pay?

Impact

Ransomware

slide-11
SLIDE 11
  • Exploit Kits

– Browser vulnerabilities

  • E-mail

– Malicious document – Macros

Spreading Methods

Ransomware

slide-12
SLIDE 12
  • Version check
  • IP check
  • Download ransomware payload
  • Run payload

Exploit Kit

Ransomware

slide-13
SLIDE 13
  • Macro
  • VBS script
  • Download & execute payload

Malicious document

Ransomware

slide-14
SLIDE 14
  • TeamViewer hack
  • RDP brute force

Remote desktop programs

Ransomware

slide-15
SLIDE 15
  • IDS

– Snort rules

  • Problem

Detection Methods

Ransomware

slide-16
SLIDE 16

Bro Policy

slide-17
SLIDE 17
  • Ransomware behavior

– SMB

  • Possible solutions

– File extension listing – Threshold SMB commands – Command-and-Control communication

Approach

Bro Policy

slide-18
SLIDE 18
  • Randomness of data
  • 0 – 8 bits per character

Entropy

Bro policy

slide-19
SLIDE 19
  • Compressed files
  • Images
  • PDF
  • Mime/Media type

What about ….

Bro policy

slide-20
SLIDE 20
  • SMB parser

– Events

  • File over new connection
  • Chunk event
  • SumStat

– Threshold

  • Notice.log

Functions

Bro Policy

slide-21
SLIDE 21
  • Check for SMB traffic
  • Check for certain filenames
  • Check for Mime type
  • Check for SMB action
  • Check if SMB action equals Write
  • Add File analyzer

File over new connection

Bro Policy

slide-22
SLIDE 22
  • Check if the offset equals 0
  • Calculate entropy of data collected from SMB

write command

  • Use SumStat to add +1 for the threshold
  • Write to log file
  • Write a Notice.log

Chunk event

Bro Policy

slide-23
SLIDE 23

Results

slide-24
SLIDE 24
  • Two new kinds of Ransomware

Live Testing

Bro Policy

slide-25
SLIDE 25
  • Two new kinds of Ransomware

– Google Chrome & Mozilla Firefox

  • Encrypted cache
  • Encryption tools

– TrueCrypt – VeraCrypt

  • Documents

– Printing – Creating

Live Testing

Bro Policy

slide-26
SLIDE 26

Demo

slide-27
SLIDE 27
  • Locky/Zepto
  • Cryptowall
  • CTBLocker
  • Jigsaw (and all families)
  • Mobef
  • Shade
  • Maktub
  • Cerber/Alpha
  • Teslacrypt
  • Rokku
  • Crysis
  • Cerber
  • Bandarchor

Samples

Demo

slide-28
SLIDE 28

Thank you for having me!