Insights from Our Experts
Lukitus and Diablo: Ransomware threat always hunt, but with a new mask
Ransomware are Snippets of Code that will be forcefully downloaded and executes into your system, which can encrypt or damage your files. This mostly affects who have business docs / hosting files / medical records or other such important files without proper security or backups. Attackers take advantage of what the situation to make payments.
Most of us face a lot of malicious emails every day. Though Reputed mail servers categorize them and try to avoid them or warn us, if you are not prepared, you might have to pay even thousands or millions for a click! Because "NO ONE CAN CHEAT YOU WITHOUT YOUR PERMISSION"
THE NEW LOCKY RANSOMWARE VARIANT
Locky Ransomware usually comes with spam emails which request you to download a zip file, which contains Visual Basic Script (.VBS) file that is nested inside a secondary ZIP file. Once clicked, VBS file initiates a download that reaches out to a malicious website to pull down the latest variant of Locky Ransomware. Somehow once it finishes downloads, it starts encrypting your personal files into a compressed version with an extension [ .lukitus ] these files are getting renamed into a 16 character long random name.
Let's look at how encryption is done!
There are two ways symmetric and asymmetric encryption.
Symmetric encryption creates a random key using which files are encryption are done! In order to decrypt them, the same key is required. This type of encryption is quicker.
In the case of Asymmetric Encryption, it creates a particular pair of keys known as public key and private key. Encryption done by public key can only be decrypted using its corresponding private key.
The Whole encryption takes place in the background and until shut down, we do not feel, we are getting encrypted! After the attack, attacker Indirectly contact us to pay some amount in the form of Bitcoin. [ Bitcoins are a type of Digital coins, which is hard to trace out the source and destination of generation or transfer] There currently are no publicly shared methods to reverse this Locky strain.
The victim is instructed to install the TOR browser and is provided a .onion site ( Darkweb sites, like .in, .com etc) to process payment of 0.5 Bitcoins, which currently amounts to approximately 97700.45 Indian rupee rupees(15th Sep 2017). Once the ransom payment is made the attackers promise a re-direct to the decryption service
HOW PREVIOUS RANSOMWARE WERE DETECTED
Usually, once they get the link of Ransomware, Security Analysts try to analyze the flow of action by monitoring it inside a sandbox. Usually, the Keys are generated inside the system and hope its scratches can be regenerated from Memory! anyway, Once you feel the system is compromised, disconnect every device from that network and isolate the compromised system. DO NOT TURN THE SYSTEM OFF!
- Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, this data should be kept on a separate device, and backups should be stored offline.
- Keep the operating system third party applications (MS office, browsers, browser Plugins) up-to-date with the latest patches.
- Maintain updated Antivirus software on all systems
- Don't open attachments in unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization's website directly through browser
- Follow safe practices when browsing the web. Ensure the web browsers are secured enough with appropriate content controls.
- Establish a Sender Policy Framework (SPF) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
- Check regularly for the integrity of the information stored in the databases.
- Regularly check the contents of backup files of databases for any unauthorized encrypted contents of data records or external elements, (backdoors /malicious scripts.)
- Ensure integrity of the codes /scripts being used in database, authentication and sensitive systems
- Application white listing/Strict implementation of Software Restriction Policies (SRP)to block binaries running from %APPDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations.
- Network segmentation and segregation into security zones - help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks.
- Disable ActiveX content in Microsoft Office applications such as Word, Excel, etc.
- Disable remote Desktop Connections, employ least-privileged accounts. Limit users who can log in using Remote Desktop, set an account lockout policy. Ensure proper RDP logging and configuration.
- Restrict access using firewalls and allow only to selected remote endpoints, VPN may also be used with dedicated pool for RDP access
- Use strong authentication protocol, such as Network Level Authentication (NLA) in Windows.
- Additional Security measures that may be considered are
- Use RDP Gateways for better management
- Change the listening port for Remote Desktop
- Tunnel Remote Desktop connections through IPSec or SSH
- Two-factor authentication may also be considered for highly critical systems
- If not required consider disabling, PowerShell / windows script hosting.
- Restrict users' abilities (permissions) to install and run unwanted software applications.
- Enable personal firewalls on workstations.
- Implement strict External Device (USB drive) usage policy.
- Employ data-at-rest and data-in-transit encryption.
- Consider installing Enhanced Mitigation Experience Toolkit, or similar host-level antiexploitation tools.
- Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
- Carry out vulnerability Assessment and Penetration Testing (VAPT) and information security audit of critical networks/systems, especially database servers. Repeat audits at regular intervals.
- Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee files will be released.
Ransomware School, Kerala Police CyberDome
INDICATORS OF COMPROMISE:
- Block the below malicious domains/IPs at the perimeter
- files with extension “ [.]lukitus” or “[.]diablo6”
- file Win[.]JSFontlib09[.]js
- Locky ransomware post-infection URL: hxxp://220.127.116.11/imageload[dot]cgi
- Fake dropbox sites: