Conference Presentation
Michael Sikorski: Dude, Where Are My Files? Reverse Engineering Ransomware
- Real-world impact of ransomware:
- Maersk suffered a $300 million loss after a ransomware attack crippled their operations, forcing a complete system rebuild and causing significant delays in global shipping.
- Baltimore City's municipal services were paralyzed, preventing residents from paying taxes and water bills online due to network downtime.
- Speaker and organizational background:
- Speaker Michael "Sicko" Sikorski is a malware analyst and researcher at FireEye with 12 years of experience at Mandiant.
- Mandiant evolved from physical penetration testing to becoming the global leader in incident response, specifically regarding Chinese state-sponsored hacking groups (e.g., the APT1 report).
- FireEye acquired Mandiant to combine incident response with their firewall and endpoint security products.
- The FireEye malware analysis team has grown from two analysts to 50, processing thousands of samples annually through automated scaling and manual reverse engineering.
- Malware analysis methodology:
- Static analysis: Involves examining the binary without execution, extracting strings, hashes, and using tools like FLOSS to decode hidden strings.
- Dynamic analysis: Involves running malware in isolated, snapshot-capable environments (sandboxes) like Flare VM and FakeNet to observe network and host behavior without risking the real infrastructure.
- Deep reverse engineering: Required when automated tools fail to trigger malware behaviors (e.g., delayed execution or sleep timers), necessitating disassembly into assembly code.
- Key tools: Industry standards include IDA Pro and the NSA-derived open-source tool Ghidra, which converts binary into assembly and control flow graphs.
- Financial malware landscape:
- Nation-state actors, particularly North Korea, have shifted from intellectual property theft to direct financial extortion via ransomware and crypto-mining botnets to bypass economic embargoes.
- Specific financial malware types include crypto stealers, banking trojans, credit card scrapers, and Point-of-Sale (POS) malware.
- Case study: A POS malware infection was traced to a retailer's compromised "gold image" (master installation image), meaning every new store opened subsequently received the malware automatically.
- Ransomware mechanics and encryption:
- Ransomware popularity surged with the advent of anonymous cryptocurrency (Bitcoin) payments.
- Encryption types:
- Symmetric encryption (e.g., AES, RC4) is common due to speed; attackers often generate a key on the victim's machine and upload it to a Command and Control (C2) server, or hardcode it into the binary.
- Asymmetric encryption (public/private keys) is slower and rarely used for bulk file encryption by attackers due to key management complexity.
- Recovery possibilities: Analysts determine if files are recoverable by reverse engineering the encryption routine, sometimes extracting the key from the malware or reusing the encryption function for decryption.
- WannaCry analysis (2017):
- Spread globally via the EternalBlue exploit against SMB, causing an estimated $4 billion in damages and disrupting healthcare systems (e.g., MRI scanners).
- Kill switch discovery: Malware analyst Marcus Hutchins (MalwareTech) discovered the malware queried an unregistered domain; registering this domain caused the malware to exit, effectively halting the global spread.
- Anti-sandbox technique: WannaCry checks for the existence of specific domains; if found (as in a sandbox), it avoids encryption, but if the domain is unregistered, it proceeds to encrypt files.
- Attribution: Widely attributed to North Korea based on infrastructure and behavior analysis by multiple government agencies.
- EternalPetya/NotPetya analysis (2017):
- Classified as "destructive malware" rather than ransomware because it encrypted the Master File Table (MFT) and overwrote the Master Boot Record (MBR), rendering systems unrecoverable without re-imaging, despite displaying a ransom note.
- Maersk connection: Maersk was a primary victim, requiring the replacement of approximately 2,000 computers and 1,800 servers due to total system corruption.
- Vaccine/Kill switch: Analysis revealed the malware checked for the existence of a specific file (
c:\windows\perfc.exe). Creating this file would trigger a self-termination, protecting the system. - Technical implementation: The malware truncates the filename
perfc.dattoperfcvia XOR operations and checks for the existence ofc:\windows\perfcto decide whether to execute the destructive routine or exit.
- Forward-looking statements and conclusions:
- Malware authors actively target analysis tools (e.g., IDA Pro) with anti-debugging and anti-sandbox techniques to hinder researchers.
- Reverse engineering is essential not only for immediate containment (vaccines/kill switches) but also for providing clients with realistic data recovery assessments (e.g., confirming data is unrecoverable in NotPetya cases).
- The industry relies on a "cat and mouse" dynamic where security tools must constantly evolve to keep pace with rapidly changing malware obfuscation techniques.