Tracking Ransomware End-to-end Danny Y. Huang Maxwell Matthaios - PowerPoint PPT Presentation

Tracking Ransomware End-to-end Danny Y. Huang Maxwell Matthaios Aliapoulios, Vector Guo Li Luca Invernizzi, Elie Bursztein, Kylie McRoberts, Jonathan Levin Kirill Levchenko, Alex C. Snoeren, Damon McCoy

Ransomware causes financial damages

Ransomware causes financial damages

Ransomware causes financial damages

Ransomware causes financial damages How much ransomware revenue? How to shut down ransomware?

How typical ransomware works 1. Distribution 2. Infection Spam, compromised websites, etc 3. Victim pays bitcoins 4. Decryption 5. Criminal liquidates bitcoins

How typical ransomware works 1. Distribution 2. Infection 3. Victim pays bitcoins 4. Decryption 5. Criminal liquidates bitcoins

How typical ransomware works 1. Distribution All your files are encrypted! 2. Infection 3. Victim pays bitcoins Send 0.5 bitcoins to the following address. 4. Decryption 175mBiaNSSHAhoCbpv25y1rJYK4A7d7d1b 5. Criminal liquidates bitcoins

How typical ransomware works 1. Distribution All your files are encrypted! 2. Infection 3. Victim pays bitcoins Send 0.5 bitcoins to the following address. 4. Decryption Cerber: median ~$1,000 175mBiaNSSHAhoCbpv25y1rJYK4A7d7d1b 5. Locky: median ~$1,800 Criminal liquidates bitcoins

How typical ransomware works 1. Distribution All your files are encrypted! 2. Infection 3. Victim pays bitcoins Send 0.5 bitcoins to the following address. 4. Decryption 175mBiaNSSHAhoCbpv25y1rJYK4A7d7d1b 5. Criminal liquidates unique ransom bitcoins wallet address

How typical ransomware works Victim’s money 1. Distribution 2. Infection 3. Victim pays bitcoins 4. Decryption 5. Criminal liquidates bitcoins

How typical ransomware works Victim’s money 1. Distribution Exchange 2. Infection Victim’s bitcoins 3. Victim pays bitcoins 4. Decryption 5. Criminal liquidates bitcoins

How typical ransomware works Victim’s money 1. Distribution Exchange 2. Infection Victim’s bitcoins 3. Victim pays bitcoins Ransom wallet address 4. Decryption Ransomware’s 5. Criminal liquidates bitcoins bitcoins

How typical ransomware works Victim’s money 1. Distribution Exchange 2. Infection Victim’s bitcoins 3. Victim pays bitcoins Ransom wallet address 4. Decryption Ransomware’s 5. Criminal liquidates bitcoins bitcoins

How typical ransomware works Victim’s money 1. Distribution Exchange 2. Infection Victim’s bitcoins 3. Victim pays bitcoins Ransom wallet address 4. Decryption Ransomware’s 5. Criminal liquidates bitcoins bitcoins Exchange Ransomware’s money

Research questions How to estimate the total ransom paid (or revenue)? - $16 million over two years, 20k unique payments How to identify chokepoints? - 40% of revenue of one ransomware sent to BTC-e - 3% of affiliates of one ransomware caused 50% infections

Research questions How to estimate the total ransom paid (or revenue)? - $16 million over two years, 20k unique payments How to identify chokepoints? - 40% of revenue of one ransomware sent to BTC-e - 3% of affiliates of one ransomware caused 50% infections

Overview of results How to estimate the total ransom paid (or revenue)? - 10 families, >$16 million over two years; 90% made by two families How to identify chokepoints? - 40% of revenue of one ransomware sent to BTC-e - 3% of affiliates of one ransomware caused 50% infections

Overview of results How to estimate the total ransom paid (or revenue)? - 10 families, >$16 million over two years; 90% made by two families How to identify chokepoints? - 40% revenue of one ransomware sent to BTC-e - 3% of affiliates of one ransomware caused 50% infections

Overview of results How to estimate the total ransom paid (or revenue)? - 10 families, >$16 million over two years; 90% made by two families How to identify chokepoints? - 40% revenue of one ransomware sent to BTC-e - 3% affiliates of one ransomware caused 50% infections

Overview of results How to estimate the total ransom paid (or revenue)? - 10 families, >$16 million over two years; 90% made by two families 1 How to identify chokepoints? - 40% revenue of one ransomware sent to BTC-e - 3% affiliates of one ransomware caused 50% infections

Overview of results How to estimate the total ransom paid (or revenue)? - 10 families, >$16 million over two years; 90% made by two families 1 How to identify chokepoints? - 40% revenue of one ransomware sent to BTC-e 2 - 3% affiliates of one ransomware caused 50% infections

1 Blockchain Analysis

Methodology: Follow the money 1. Identify known victims 2. Infer unknown victims 3. Estimate total ransom 4. Identify exchanges

Methodology: Follow the money 1. Identify known victims 2. Infer unknown victims 3. Estimate total ransom 4. Identify exchanges

Methodology: Follow the money 1. Identify known victims 2. Infer unknown victims 3. Estimate total ransom 4. Identify exchanges

Methodology: Follow the money 1. Identify known victims 2. Infer unknown victims 3. Estimate total ransom 4. Identify exchanges

Methodology: Follow the money 1. Identify known victims 2. Infer unknown victims 3. Estimate total ransom 4. Identify exchanges

Methodology: Follow the money 1. Identify known known 0.5 victims victim 2. Infer unknown victims 3. Estimate total ransom 4. Identify exchanges

Methodology: Follow the money 1. Identify known known 0.5 victims victim 2. Infer unknown victims 3. Estimate total ransom 4. Identify exchanges

Methodology: Follow the money Co-spending 1. Identify known known 0.5 victims victim 2. Infer unknown victims 3. Estimate total ransom 4. Identify exchanges

Methodology: Follow the money Co-spending 1. Identify known known 0.5 victims victim 2. Infer unknown victims 3. Estimate total ransom 4. Identify exchanges

Methodology: Follow the money Co-spending 1. Identify known known 0.5 victims victim 2. Infer unknown victims 1.0 3. Estimate total ransom 1.3 4. Identify exchanges

Methodology: Follow the money Co-spending 1. Identify known known 0.5 victims victim 2. Infer unknown victims 1.0 potential 3. Estimate total victim ransom 1.3 4. Identify exchanges

Methodology: Follow the money 1. Identify known artificial victims “victim” 2. Infer unknown victims 3. Estimate total ransom 4. Identify exchanges

Methodology: Follow the money 1. Identify known artificial 0.001 victims “victim” 2. Infer unknown victims 3. Estimate total ransom 4. Identify exchanges

Methodology: Follow the money Co-spending 1. Identify known artificial 0.001 victims “victim” 2. Infer unknown victims 3. Estimate total ransom 4. Identify exchanges

Methodology: Follow the money Co-spending 1. Identify known artificial 0.001 victims “victim” 2. Infer unknown victims 1.0 potential 3. Estimate total victim ransom 1.3 4. Identify exchanges

Total ransom received USD per month

Total ransom received $7.7m $1.8m $69k $6.6m $100k USD per month

Potential liquidation at exchanges $2.6 m $24 k Fraction of revenue sent to exchanges

2 Reverse Engineering Cerber’s C&C

Cerber’s outbound UDP traffic IP: x.y.z.1 IP: x.y.z.2 IP: x.y.z.3 Infected host IP: x.y.z.254

Cerber’s outbound UDP traffic IP: x.y.z.1 two-week data IP: x.y.z.2 victim IP victim ID IP: x.y.z.3 affiliate ID Infected ... host me IP: x.y.z.254

Number of infected IP addr per affiliate Affiliate ID

3% of affiliates caused 50% of infected IPs Affiliate ID

3 Summary

Summary Key Methods Tracked ransom payments for 10 ransomware families using co-spending wallet addr Reverse engineered C&C protocol for Cerber ransomware

Summary Key Methods Tracked ransom payments for 10 ransomware families using co-spending wallet addr Reverse engineered C&C protocol for Cerber ransomware

Summary Key Methods Key Results Tracked ransom payments for Estimated revenue: 10 ransomware families using 10 families, > $16 million co-spending wallet addr over two years Reverse engineered C&C Possible chokepoints: protocol for Cerber exchanges and affiliates ransomware

Summary Key Methods Key Results Tracked ransom payments for Estimated revenue: 10 ransomware families using 10 families, > $16 million co-spending wallet addr over two years Reverse engineered C&C Possible chokepoints: protocol for Cerber exchanges and affiliates ransomware Danny Y. Huang — Postdoc at Princeton — http://hdanny.org

4 Appendix

Ransom payments over time Median ransom amount per day (USD) Number of payments per day

Potentially missing Locky’s ransom payments Google results binaries found bitcoin payment