Conference Presentation
Michael Sikorski: Dude, Where Are My Files? Reverse Engineering Ransomware
- Financial and operational impacts from major ransomware events are significant, exemplified by the Maersk incident which caused $300 million in costs and required a complete system rebuild or re-imaging of infrastructure.
- The organization plans to expand its workforce from two individuals to 50 reverse engineers over the next 12 years to handle thousands of malware samples annually, with a continued focus on intelligence gathering, reverse engineering, and network monitoring.
- Future malware development is expected to evolve as attackers modify tools specifically to break analysis software like IDA Pro, utilize anonymous currencies like Bitcoin for extortion, and shift away from custom encryption toward symmetric algorithms or open-source implementations to simplify logistics.
- Specific ransomware strains like WannaCry are predicted to have spread rapidly via the EternalBlue exploit but ceased within four days due to a researcher-registered kill switch, which attackers likely modified by changing a single character or removed entirely in later iterations.
- Destructive variants such as Eternal Petya (NotPetya) are expected to encrypt the Master File Table and delete decryption keys to render systems unusable, often necessitating hardware replacement when keys are lost.
- Technical countermeasures include identifying Windows API functions (e.g.,
read file,write file) and crypto-signatures like AES S-boxes to locate encryption logic without full code reversal, as well as using "vaccine" files (e.g.,c:\windows\perfc) to prevent destructive routines and buy time for patching. - The reverse engineering process for complex or armored malware is projected to require hours, days, or weeks depending on protection mechanisms, with analysts often extracting encryption functions directly to determine data recoverability without fully understanding the underlying algorithm.
- State-sponsored actors like North Korea are expected to increasingly focus on financial theft via hacking due to economic embargoes, while global universities are predicted to invest significant effort into improving decompiler technology to reconstruct original source code.
- Malware deployment strategies often involve creating marker files to prevent multiple instances of the same malware from running, and attackers generally possess the capability to decrypt files for paying victims to incentivize future extortion, despite occasional programming mistakes that lead to lost keys.