The New Scourge of Ransomware - A Study of CryptoLocker and Its Friends

Explore the evolving threat of ransomware in this Black Hat conference talk. Delve into the emergence of CryptoLocker, the first ransomware to implement encryption correctly, and its impact on security research and countermeasures. Learn about the threat intelligence community's response, including the development of near-real-time infrastructure tracking. Examine various ransomware campaigns, their techniques, and the collaborative efforts between industry and law enforcement to combat this growing threat. Gain insights into the differences between symmetric and asymmetric encryption, domain generation algorithms, and Bitcoin's role in ransomware operations. Discover the importance of backups, community response, and working groups in addressing ransomware challenges. Analyze the impact of ransomware on businesses and individuals, and explore strategies for resilience and prevention against this lucrative cybercrime trend.

Introduction
Introductions
What is ransomware
Types of ransomware
Ransomware in general
Ransomware is not new
New ways to leverage ransomware
Difference between symmetric and asymmetric
Ransomware is a growing threat
Ransomware is a marketing threat
CryptoLocker appears
Theyre getting the data back
How we met
Working group
David Diggin
Mafia Rules
ASDF
OPSEC
Recovery
Backups
Updated Directory
Domain Generation
Reverse DGA
No Domains Registered
Community Response
Working Groups
Industry Law Enforcement
FBI
CryptoLocker
Gameover Zeus
Single Flux Networking
Following the Money
Targeted Businesses
Money Packs
The good goes takedown
DNS tools
Passive DNS
Bias
Bitcoin Value
Politeness
sufficiency
we are sending a message
a lot more events
there comes a time
theres nothing wrong with that
this was a very lucrative cash crop
what do you do next
they tended to do trouble
Flashback
Algorithm
sinkholes
no physical evidence
law enforcement
impact
working with industry
ransomware examples
ransomware techniques
resiliency