Slashdot Mirror
Critroni Crypto Ransomware Seen Using Tor for Command and Control
Trailrunner7 writes There's a new kid on the crypto ransomware block, known as Critroni, that's been sold in underground forums for the last month or so and is now being dropped by the Angler exploit kit. The ransomware includes a number of unusual features and researchers say it's the first crypto ransomware seen using the Tor network for command and control.
The Critroni ransomware is selling for around $3,000 and researchers say it is now being used by a range of attackers, some of whom are using the Angler exploit kit to drop a spambot on victims' machines. The spambot then downloads a couple of other payloads, including Critroni. Once on a victim's PC, Critroni encrypts a variety of files, including photos and documents, and then displays a dialogue box that informs the user of the infection and demands a payment in Bitcoins in order to decrypt the files.
"It uses C2 hidden in the Tor network. Previously we haven't seen cryptomalware having C2 in Tor. Only banking trojans," said Fedor Sinitsyn, senior malware analyst at Kaspersky Lab, who has been researching this threat. "Executable code for establishing Tor connection is embedded in the malware's body. Previously the malware of this type, this was usually accomplished with a Tor.exe file. Embedding Tor functions in the malware's body is a more difficult task from the programming point of view, but it has some profits, because it helps to avoid detection, and it is more efficient in general."
The Critroni ransomware is selling for around $3,000 and researchers say it is now being used by a range of attackers, some of whom are using the Angler exploit kit to drop a spambot on victims' machines. The spambot then downloads a couple of other payloads, including Critroni. Once on a victim's PC, Critroni encrypts a variety of files, including photos and documents, and then displays a dialogue box that informs the user of the infection and demands a payment in Bitcoins in order to decrypt the files.
"It uses C2 hidden in the Tor network. Previously we haven't seen cryptomalware having C2 in Tor. Only banking trojans," said Fedor Sinitsyn, senior malware analyst at Kaspersky Lab, who has been researching this threat. "Executable code for establishing Tor connection is embedded in the malware's body. Previously the malware of this type, this was usually accomplished with a Tor.exe file. Embedding Tor functions in the malware's body is a more difficult task from the programming point of view, but it has some profits, because it helps to avoid detection, and it is more efficient in general."
Tor has only ever been an enabler for spammers and other criminals, making it possible for them to hide their tracks. Time to get rid of it.
Disinfect the GNU General Public Virus!
not trying to blame the victim, but I wonder if antivirus or anti-malware software will detect these ransomware programs? Just asking. I guess firewalls might be able to detect the Tor server/connections.
not trying to blame the victim, but I wonder if antivirus or anti-malware software will detect these ransomware programs? Just asking. I guess firewalls might be able to detect the Tor server/connections.
All a firewall will see is encrypted traffic from the computer in the LAN (inside) initiate a connection to a random computer (IP address) on the Internet (outside interface). Its not able to see what is being sent/received, which is the entire reason for TORs existence.. protecting you from Man in the Middle attacks, which in this case, the firewall would be.
How is it you manages to not once mention Microsoft Windows in that whole article?
How does the Critroni ransomware get onto the victim’s PC in the first place?
Time will come when firewalls inspect all outgoing packets and use heuristics to guess how dangerous encrypted traffic might be.
For example:
In the middle three groups, give the user a chance to approve/block/whitelist the traffic or, if the user just wants such traffic logged or just wants to see an on-screen alert but doesn't want to be bothered with the "should I block it" question, log it and/or put up a visible notification to the end-user.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If Bitcoin if traceable, shouldn't it be possible to trace these malware assholes cashing in?
Which is more evil:
Telling employees "we block all encrypted traffic and snoop on everything else"
or telling them
"We MITM all encrypted traffic we can so we can snoop on it, we snoop on everything we can and block the rest"
or telling them
"we block all traffic except traffic to the few Internet resources we know you need, and oh by the way we snoop on that"
or telling the
"we don't think you need a computer to do your job, if you do need a computer to do your job then talk to your boss and he MAY give you the keys to the one room where there is a computer. Oh, by the way, there are TV cameras all over that room so don't even think about using it for non-business purposes."
Substitute "school," "institution," or "parent" for "employer" and substitute "student," "client/end-user," or "minor child who the parents deem too young/immature to use the Internet unsupervised" for "employee."
Speaking of parents, many parenting experts highly recommend that if a kid under a certain age/maturity level wants to use the Internet, he only be allowed to do so under close supervision, as in mom or dad in the room within eyesight of the screen. What age? Experts disagree, but almost all would put the cutoff age where mom can leave the room for a few minutes at somewhere in the elementary school (age 5-12) age range.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If counteracting the detecting and blocking bridge notes becomes a problem - and it probably will as soon the the Chinese get good at it - someone will find a solution.
A resource-intensive solution would be to layer the TOR/bridge traffic on top of and steganographically embedded into some seemingly-normal traffic, such as an encrypted streaming video, so that a traffic analysis would say "it's probably just someone watching online TV."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
but under-informed end users are much more consistently available
Question: What's more common and arguably more dangerous than a Windows XP computer that hasn't received any OS updates in the last 2 months?
Answer: An "unpatched" (naive/uninformed) human operating the keyboard.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
To place the Tor.exe file INSIDE the main executable!
Fairly clever, & FAR easier than duplicating Tor functionality in the exe used itself, by far!
I've done something QUITE like it in a "Dr. Who" screensaver I wrote in 2006 in fact...
(I.E./E.G.-> Embedding the .avi for the introduction sequence of the "new" Dr. Who series INSIDE the screensaver & then extracting it out of the .scr Win32 Portable Executable, and playing it back from memory... very fast, & worked - even the folks @ the BBC liked it, but gave me guff over "copyright infringement" & I was giving it away free, no charge, & even offered it to them (more efficient than "FLASH" based ones by far is why, it was a TRUE "stand-alone" Win32 Portable Executable written in Borland Delphi 7.1 is why))
Anyhow/anyways:
The technique used, in & OF itself, is cool (& like bitmaps you use in programs, you can store ANYTHING YOU LIKE in an executable really) in & of itself , except these morons (which is what I think of ANY malware maker) are using that technique for bogus stuff like this instead...
APK
P.S.=> I don't care HOW they *try* to "hide" their C&C Servers either... why? Once they're known, they are EASILY DEFEATED by another program of mine (even FastFlux &/or Dynamic DNS utilizing botnets, the MOST dangerous + advanced type there is which also functions on host-domain names as well) here & EASILY mind you -> http://start64.com/index.php?o... using a TRUE "Sun-Tzu like idea" of taking advantage of the strengths &/or nature of the opponent himself (in these botnets' usage of host-domain names in this case)... apk
Once I imaged a computer and opened IE to go download Firefox and other apps and my webcam went on instantly! Ad appeared doing a fake AV scan all from msn.com since computer had 0 updates yet it was 0wned.
Had to reimage again.
XP users really are in trouble and you don't need social engineering. Just IE, no updates, reader, or Java. Scary stuff.
It is why I don't run ancient operating systems, updates, and never use a root or admin account.
http://saveie6.com/
+ AVG:
http://www.avg.com/us-en/avg-r...
+ AVG ARL: The latest release version of the AVG Rescue CD GNU/Linux (ARL) with daily updated virus database,
latest alpha or beta version of the ARL and all the resources needed to build the ARL from scratch.
Releases are signed!
https://share.avg.com/arl
+ Avira:
https://www.avira.com/en/downl...
+ BitDefender:
http://download.bitdefender.co...
+ Comodo Rescue Disk (CRD):
https://www.comodo.com/busines...
+ Dr.Web LiveCD & LiveUSB:
http://www.freedrweb.com/livec...
http://www.freedrweb.com/liveu...
+ F-Secure:
https://www.f-secure.com/en/we...
https://www.f-secure.com/en/we...
+ Kaspersky:
http://support.kaspersky.com/f...
http://support.kaspersky.com/v...
http://forum.kaspersky.com/ind...
by way of comparison! It also self-checks itself @ startup vs. std. exe alteration (every program SHOULD do that, but they don't).
you're right, self-checks are another good under-used protection, even if they can be bypassed through tunneling etc.
another thing is, CA enforcement of websites is one thing - standard CA enforcement of signed-executables would be nice at the OS level.
not just driver subsystem.
sure it wont defeat scripts and exploits as mentioned earlier.
but man would that cut down on fast-flux executables.
and it's waaaaaaaaay better than a traditional white-list.
The C&C Servers are what is communicated back against (as well as serving up exploits payloads etc. @ times also & IF they don't? Blocking out the payloads servers does the job... which hosts CAN do) - IF/WHEN I block that, should it NOT be disabled for communication, even via TOR?
* Fill me in...
(As far as "porting" it to Linux? I've thought about it... wouldn't be hard - & I WISH Borland didn't KILL Kylix (was Delphi for Linux for the most part) - however - there IS FreePascal & it's "Lazarus" IDE, which is VERY CLOSE to the Delphi IDE, & from what I understand, an ALMOST clone of its compiler commandset too! Thus, it IS, doable...)
APK
P.S.=> See - I guess I don't *fully* understand TOR (as I don't use it myself, tried it once - TOO damned slow, just like anonymous proxies are, same idea iirc for the most part afaik - correct me IF I am wrong/off here too... I can stand to learn by it as I *admit* I do NOT "know it all" & can learn as much as the next guy since this field changes so fast & dynamically)
... apk
As so often, the solution is called "Backup".
CLI paste? paste.pr0.tips!
I think XP users are in trouble too, and there is not much to save them.
There's a registry hack that I've applied to Windows XP and I'm getting security updates ...
It little behooves the best of us to comment on the rest of us.
Hosts are, as I stated in my original reply you 1st replied to, the 1st resolver queried (overriding ALL others, especially external ones, & iirc, even a local DNS server you run yourself, needless complexity & redundancy though it is unless it is specifically a DNS server for a network that is, & yes, ROOM for BREAKDOWN).
E.G. from Windows registry:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\ServiceProvider]
"Class"=dword:00000008
"DnsPriority"=dword:00000007
"HostsPriority"=dword:00000006
"LocalPriority"=dword:00000005
(LOWER = more priority/first in order)
Hosts ARE part of the IP Stack, & thus? Even a DNS "rides on that" & has to obey them...
---
Blocking the C&C Servers also STOPS communicaie BACK to the "hq" of the botnet, even IF/WHEN you are already infested too (not just stopping integration BEFORE it can even start mind you, because of that blockage I just noted...)
* :)
APK
P.S.=> I don't bother with TOR - from what I understand, it puts you on an "NSA hitlist" & other law enforcement agencies as well (NOT worth it for that reason alone, as well as slowness, imo @ least)... apk
On the opposite side, even though this sounds horrid, maybe ransomware might do some good. Back in the MS-DOS/early Windows days, it took viruses blasting out the BIOS firmware, bricking motherboards, zapping controllers on hard disks, and frying monitors (back in the days where you tell a multisync monitor to use a frequency it didn't know, it blew the flyback transformer.)
Maybe ransomware being common may be a good thing. It would spur users to be proactive and not depend on the OS to protect them against themselves.
I've got tons of rogue DNS servers blocked in hosts, so that's not effective either. In fact, THAT's why it's done: Those rogue DNS servers are provided by the makers of the hosts file data my application imports it from (12 of them from the security community in fact) for that very reason...
APK
P.S.=> Your point on encrypting the HDD is also moot when blocking access to the infestor/infector in the 1st place (which hosts does) occurs - you can't get sick by what you can't be exposed to, period... apk
The 'silver lining' of all this is of course that millions more people will get added to the NSA/GCHQ/etc 'watch lists' for using Tor. That's great news for everyone because:
1) It floods the watchlists with lots of innocent people, all of whom have to be checked, verified and cleared in some manual (aka. expensive) way
2) Should anyone ever say "you use Tor, that means you must be a terrorist/paedo/whatever", you can probably say "Tor? No, I don't use that, but I did have a nasty bout of malware on my kids computer".
3) Tor gets in the news some more. Any publicity is good publicity and all that
Yay! bring on the malware - remember folks, to take advantage of this fantastic offer, please don't use Linux ;-)
Now on IP addresses : They're FAR less used (& you'd have to be silly to click on a link that uses one, as you have literally NO real way to check on it first ordinarily in a browser alone typically (there are tools for it though)).
IP Addresses are also FAR easier to shutdown vs. say, Dynamic DNS using botnets for instance (& tying MANY hostnames to a single IP in FastFlux botnets merely involves finding another hosting provider - yes, usually a bogus one - to change that for the "flocks" of host-domain names those use too)
You're meandering from the topic, which IS that this botnet (our subject) usese host-domain names iirc (feel free to correct me there if you wish though).
So it's @ least good to see your "point" on DNS was easily nullified regarding rogue DNS servers malware uses (possibly/potentially, however - not usually, as it represents a LOT more work, or, changing DNS settings in the Operating System for the IP stack (e.g. -> DNSChanger, look that up, IF you have to...)).
HOWEVER: On your point?
I use Firewall rules tables, & even vs. tracking (on /. & other sites too -> http://yro.slashdot.org/commen... )
* :)
(As you can plainly see? I've got "All the bases covered" & (can't resist this, lol) "ALL YOUR BASE, ARE BELONG TO US" as far as your points of contention vs. my own...).
Additionally - hosts CAN ALSO DEFEAT DNSBL's like TOR by the way (via hardcodes) as well as DNS request logs (& does so, FAR FASTER than the incredibly SLOW TOR... hosts actually ADD speed - whereas TOR steals it, and puts you on NSA "hitlists" for using them as well iirc which is in & of itself, NOT worth it imo!)
APK
P.S.=> I *think* you'll really LIKE that firewall rules table (speeds you up & secures you vs. what you DON'T see HERE, & yes - on other sites too, served up by IP Address - which admittedly, hosts do NOT stop (but is FAR LESS USED as well vs. host-domain names which hosts DO stop))... apk
*IF* you truly *think* that all TOR nodes are legit? You've got another think coming...
(E.G./I.E.-> think the NSA isn't on THAT like "white-on-rice"? Guess again IF you think not! Using TOR is a risk to get THEM on your back as well, which again, imo @ least? IS NOT WORTH IT by a longshot as well as the tremendous speed-hit incurred using TOR!)
APK
P.S.=> That's in addition to my other points (like TOR stealing speed, whereas hosts add it AND do much more as well in terms of security, reliability, & even anonymity (vs. DNS request logs + DNSBL's, doing what TOR can, faster) -> http://it.slashdot.org/comment... )
... apk
but no one wants to do that. Doing it would mean to be responsible for subsequent takedowns, and what is seen as illegal in one country may be the opposite in another country, and you would need to establish a system for takedown, which can be misused for censorship.
By blocking sources of malware you note: Your point's moot & you run HUGE risks via TOR http://it.slashdot.org/comment... (you say NOBODY wants to stop TOR & it's tech? Beg to differ - Do YOU know who the NSA is & what they do vs. it, by setting up bogus TOR nodes & endpoints?) - think about that.
* You may wish to verify my firewall rules table I pointed out too (which I verified using either netstat -ano OR network latency viewer by Nirsoft) - it works on the IP addressed stuff you DON'T SEE (ala trackers here on /., & yes, other sites too...).
APK
P.S.=> Again - you CAN'T BE BURNED by what you CAN'T TOUCH in the 1st place... apk
This says it all -> http://it.slashdot.org/comment...
You note censorship: Unfortunately, it IS a fact of life (that hosts help you get around too, & speed you up doing it via hardcodes, unlike TOR slowing you down + putting you @ legal risk as well) - @ least communist block nations (ala China for example) are honest about it... it happens here too though (even on /. via the MAIN sockpuppet driven unjustifiable downmod "truncheon used in lieu of conversation" by parties looking to "further their OWN agenda" when logical factual information is put forth they cannot validly combat with counter point facts & logic... or doesn't the term "sockpuppet marketing" &/or HBGary ring a bell there too?)
APK
P.S.=> It's YOUR LIFE man, not mine... & TOR is slow, there is NO real way around it (unless you run your own local setup serving it I suppose, & per that link above, THEN, you are *REALLY* running a risk (lol, unless you're the NSA doing it, right?))...
... apk
They also use less moving parts + electricity than local DNS, & are proof vs. Kaminsky flaw redirects which 99.999% of ISP DNS' are STILL not patched vs., even ~ 10++ yrs. AFTER a patch exists (they avoid it due to MX records screwups iirc).
Hosts also aiding in securing you there, & making your connects MORE reliable (easily verified by reverse dns ping tech for those "favs" of yours in my app here too -> http://start64.com/index.php?o... in it's "Speedup Favorites" tab... )).
APK
P.S.=> TOR's slow no matter WHAT you do (unless you run your own node/endpoint/exit node etc. & serve it too) - especially vs. the speed hosts yield (blocking banners & faster local favs resolutions vs. remote dns with FAR less moving parts + direct end user control too), as well as the reliability + security features (vs. malicious code bearing sites, all types of botnets & vs. DNS redirect security issues), reliability (vs. downed or redirect poisoned DNS), & anonymity as well (like TOR, vs. DNSBL blocks + dns request logs)... apk
Even Aryeh Goretsky of NOD32/Eset won't take my challenge the other day -> http://it.slashdot.org/comment...
See subject!
Even Symantec/Norton ADMITS their tech is "Only 55% effective" vs. TODAY'S threats http://it.slashdot.org/story/1... ...
Why?
They're mostly delivered via bogus javascript & self-altering .exe files (I note it here http://it.slashdot.org/comment... using exe resources to store things, a viable way of doing that, altering the file vs. detects, + using self-encrypting exe's to go with it + exe compression)
"Complex" techniques once mastered are effective vs. antivirus.
I note it in a program I wrote that's not "REACTIVE" TECH & is PROACTIVE in nature by way of comparison!
Self-checks itself @ startup vs. std. exe alteration (every program SHOULD do that, but they don't) too.
(Works on a simple principle of "what you can't touch, can't harm you" blocking out SOURCE + C&C Servers used in hosts generated by 12 reputable sources in the security community e.g. MalwareBytes' hpHosts (who host it for me & recommend it as "best of breed"), MVPS, etc.))
It works vs. resource embedding malicious executables, since hosts blocks the SOURCE (once C&C is known)
As a BONUS?
IF you're infected this method STALLS THE MALWARE'S ABILITY TO "talk to HQ for orders" too!
Multiple bonus + MORE speed, security, reliability, & even anonymity from 1 single file you already have.
(An unjustifiable downmod vs. the last time I posted this -> http://it.slashdot.org/comment... = YOU FAIL!& you know it, I KNOW IT, & so do all reading (proving my points)).
APK
P.S.=> Another simple effective principle it works on is this (even disassembler of the MORRIS worm, Spafford, recommends using what you natively have vs. bolting on more complexity & room for breakdown + exploit):
"The premise is quite simple: Take something designed by nature & reprogram it to make it work for the body rather than against it..." - Dr. Alice Krippen: "I am legend"
...apk
am seriously considering assing client side resistance to the medical software I write designed for use across the public internet because of people like you who collect data you have no business collecting.
Please do.
The only one of the examples I listed in the grandparent post that I plan on implementing are those in a role of a parent.
When I have a 6 year old kid who is using the Internet, no amount of "client-side resistance" that you add is going to stop me from seeing what's on the screen as I watch my kid use the computer.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.