4 ms·

Can someone provide a simple (but not overly so) explanation of how the current generation of ransomware operate i.e., A) spread and B) lock up the computer? Do

by 110011 9y ago

Can someone provide a simple (but not overly so) explanation of how the current generation of ransomware operate i.e., A) spread and B) lock up the computer? Does it always require human intervention for A. ? Thank you.

dijit 9y ago
Depends on The ransomware. Usually if it says "0-Day" assume that it can be exploited without human intervention a-la stuxnet
- jonknee 9y ago
  > Usually if it says "0-Day" assume that it can be exploited without human intervention a-la stuxnet That's not at all what a 0-day means, it just means a previously unknown vulnerability. We've never seen a ransomware attack anywhere close to as sophisticated at Stuxnet. This latest attack is nothing new and is only affecting people who haven't kept their systems up to date.
  - dijit 9y ago
    I understand that this is not what it means. But generally speaking when an article says "0-day malware" it usually ends up meaning that no human involvement is needed. Please don't assume I don't know what 0-day actually means. I chose my words carefully as not not imply that I was saying the definition of the term.
- astrodust 9y ago
  "0-day" does not mean without human intervention. That just means "previously undisclosed".
  - dijit 9y ago
    I understand that. Which is why I said "usually". Typically when we see news using the term 0-day it's because there was no human element needed in the infection of machines. Thinking back in recent memory (17~ years) I can't remember a time when 0-day was used when it didn't mean autonomous infection. Although. I fully understand that the term means that it's a previously unknown issue. Which is why I chose my words as carefully as I did.
    - astrodust 9y ago
      It "usually" means "undisclosed". Everything else is entirely circumstantial and coincidental. The reason human intervention is generally required now is because Windows has been hardened enough that some idiot user has to click a button to bypass the built-in basic protection. There's still a possibility of a "0-day" exploit remote-owning a machine, though these sorts of exploits are a lot harder to craft due to that attack surface being exposed to more security scrutiny.
SCHiM 9y ago
There are indications that this new version uses a number of ways to spread. Where attacker == the ransomware executable: First is the EternalBlue exploit developed by and leaked from the NSA. EternalBlue exploits a flaw in Windows systems on port 445 TCP that can be used to take complete control of an unpatched system. So if an attacker can connect to a vulnerable Windows machine on port 445 tcp they can take control of that machine. There are also indications that this ransomware sample spreads using legitimate administrative tools in Windows systems such as WMI (execute commands on a remote system if you an administrator account on that PC), and PSEXEC (mount shares on the remote system if you have an administrator account, execute command if ''). These are legitimate (but legacy) Windows components that normally facilitate the management of client PC's when they're connected to a domain at a company or school. So if an attacker can connect to a Windows machine on port 445 tcp (PSEXEC) or 135 (WMI) AND have administrative credentials for that PC they can take complete control of that machine. These two are probably part of how the ransomware spreads once it gets inside your network. The wcry outbreak a few weeks ago gained access to networks by infecting one or several people via a phishing e-mail with malicious files/links-to-files inside. AFAIK it's currently still unknown/unconfirmed how this outbreak spreads precisely but I'd guess it's either actively being spread by phishing OR it's been present but dormant in these networks for a while after having been installed by phishing over a longer period of time. If an attacker possesses a 0-day then all bets are probably off, and even step A would not necessarily require any human interaction. This outbreak is particularly nasty because after it's done encrypting files it supposedly triggers a crash that forces the system to restart. (handy for servers where a user is not normally able to restart the system). Because the system restarts any, artefacts from the encryption process that might be used to decrypt files without paying or restoring backups are gone.
- jsizzle 9y ago
  Actually, I believe phishing / malicious attachment was debunked as the infection vector. Subsequent research found that WC starts scanning hosts and IP's on port 445 to try to find other machines to infect. Source:https://www.us-cert.gov/ncas/alerts/TA17-132A https://www.us-cert.gov/ncas/alerts/TA17-132A "Once the malware starts as a service named mssecsvc2.0, the dropper attempts to create and scan a list of IP ranges on the local network and attempts to connect using UDP ports 137, 138 and TCP ports 139, 445. If a connection to port 445 is successful, it creates an additional thread to propagate by exploiting the SMBv1 vulnerability documented by Microsoft Security bulliten MS17-010."
devopsproject 9y ago
a) No intervention required although many start that way because people click on everything. The general idea is: get into a computer using any means possible and then spread using any means possible b) They encrypt your files and make you pay usually with a time limit before they just delete the files
khedoros1 9y ago
A) It's got to find a victim (IP range scans or whatever), then try to infect it. WannaCry used a vulnerability in SMB (CIFS/Windows file sharing) to get the virus payload onto a new machine and get it to run. B) Once a piece of ransomware is running on your computer, it can generate an encryption key and send that back to its controller machine, then start encrypting files on the computer. "A" shouldn't be able to happen on its own on a properly firewalled network, I think. So the start of the spread might be someone clicking an e-mail link that they shouldn't, and the infection works to spread on its own once inside a network.

by 110011 9y ago

dijit 9y ago

Depends on The ransomware. Usually if it says "0-Day" assume that it can be exploited without human intervention a-la stuxnet

jonknee 9y ago
> Usually if it says "0-Day" assume that it can be exploited without human intervention a-la stuxnet That's not at all what a 0-day means, it just means a previously unknown vulnerability. We've never seen a ransomware attack anywhere close to as sophisticated at Stuxnet. This latest attack is nothing new and is only affecting people who haven't kept their systems up to date.
- dijit 9y ago
  I understand that this is not what it means. But generally speaking when an article says "0-day malware" it usually ends up meaning that no human involvement is needed. Please don't assume I don't know what 0-day actually means. I chose my words carefully as not not imply that I was saying the definition of the term.
astrodust 9y ago
"0-day" does not mean without human intervention. That just means "previously undisclosed".
- dijit 9y ago
  I understand that. Which is why I said "usually". Typically when we see news using the term 0-day it's because there was no human element needed in the infection of machines. Thinking back in recent memory (17~ years) I can't remember a time when 0-day was used when it didn't mean autonomous infection. Although. I fully understand that the term means that it's a previously unknown issue. Which is why I chose my words as carefully as I did.
  - astrodust 9y ago
    It "usually" means "undisclosed". Everything else is entirely circumstantial and coincidental. The reason human intervention is generally required now is because Windows has been hardened enough that some idiot user has to click a button to bypass the built-in basic protection. There's still a possibility of a "0-day" exploit remote-owning a machine, though these sorts of exploits are a lot harder to craft due to that attack surface being exposed to more security scrutiny.

SCHiM 9y ago

There are indications that this new version uses a number of ways to spread. Where attacker == the ransomware executable: First is the EternalBlue exploit developed by and leaked from the NSA. EternalBlue exploits a flaw in Windows systems on port 445 TCP that can be used to take complete control of an unpatched system. So if an attacker can connect to a vulnerable Windows machine on port 445 tcp they can take control of that machine. There are also indications that this ransomware sample spreads using legitimate administrative tools in Windows systems such as WMI (execute commands on a remote system if you an administrator account on that PC), and PSEXEC (mount shares on the remote system if you have an administrator account, execute command if ''). These are legitimate (but legacy) Windows components that normally facilitate the management of client PC's when they're connected to a domain at a company or school. So if an attacker can connect to a Windows machine on port 445 tcp (PSEXEC) or 135 (WMI) AND have administrative credentials for that PC they can take complete control of that machine. These two are probably part of how the ransomware spreads once it gets inside your network. The wcry outbreak a few weeks ago gained access to networks by infecting one or several people via a phishing e-mail with malicious files/links-to-files inside. AFAIK it's currently still unknown/unconfirmed how this outbreak spreads precisely but I'd guess it's either actively being spread by phishing OR it's been present but dormant in these networks for a while after having been installed by phishing over a longer period of time. If an attacker possesses a 0-day then all bets are probably off, and even step A would not necessarily require any human interaction. This outbreak is particularly nasty because after it's done encrypting files it supposedly triggers a crash that forces the system to restart. (handy for servers where a user is not normally able to restart the system). Because the system restarts any, artefacts from the encryption process that might be used to decrypt files without paying or restoring backups are gone.

jsizzle 9y ago
Actually, I believe phishing / malicious attachment was debunked as the infection vector. Subsequent research found that WC starts scanning hosts and IP's on port 445 to try to find other machines to infect. Source:https://www.us-cert.gov/ncas/alerts/TA17-132A https://www.us-cert.gov/ncas/alerts/TA17-132A "Once the malware starts as a service named mssecsvc2.0, the dropper attempts to create and scan a list of IP ranges on the local network and attempts to connect using UDP ports 137, 138 and TCP ports 139, 445. If a connection to port 445 is successful, it creates an additional thread to propagate by exploiting the SMBv1 vulnerability documented by Microsoft Security bulliten MS17-010."

devopsproject 9y ago

a) No intervention required although many start that way because people click on everything. The general idea is: get into a computer using any means possible and then spread using any means possible b) They encrypt your files and make you pay usually with a time limit before they just delete the files

khedoros1 9y ago

A) It's got to find a victim (IP range scans or whatever), then try to infect it. WannaCry used a vulnerability in SMB (CIFS/Windows file sharing) to get the virus payload onto a new machine and get it to run. B) Once a piece of ransomware is running on your computer, it can generate an encryption key and send that back to its controller machine, then start encrypting files on the computer. "A" shouldn't be able to happen on its own on a properly firewalled network, I think. So the start of the spread might be someone clicking an e-mail link that they shouldn't, and the infection works to spread on its own once inside a network.