1. Ransomware Reality Check
Protecting Your Business Today
Hello and welcome to ESET’s presentation of Ransomware Reality Check, Protecting your Business Today.

2. Agenda 1 2 3 4 What is Ransomware Ransomware Infection vectors
Ransomware Prevention
How ESET keeps you safe from Ransomware 2 3
So today we will be going over:
What is Ransomware including the history of it.
Common Ransomware Infection Vectors
Best Practices related to Ransomware Prevention
And finally How ESET keeps you safe from Ransomware. 4

3. ? What is ransomware? Malware used for extortion.
When activated, prevents access to a device or the data on it until the victim pays a fee.
Can also have a built-in timer with a payment deadline. ?
First, the basics, What is ransomware. Ransomware is first just another type of malware, the unique thing about it is that it is used for extortion. When activated, it prevents access to a device or the date on it until the victim pays a fee.
It can also have a built-in timer with a payment deadline. If you do not pay by the deadline, you permanently lose access to your data.

4. Locker vs Crypto Ransomware
Locker Ransomware Denies access to the computer or device More easily removed Heavily utilizes social engineering
Crypto Ransomware
Prevents access to files or data
Preys on users who do not utilize offline backups
There are two main types of Ransomware – Locker and Crypto. Locker denies access to the entire computer or device, and does not actually encrypt any files. Because it is simply blocking access to you utilizing your device it is more easily removed. But this is where the social engineering comes in to play, while this screen is being displayed, their hope is that they can convince you to pay them to hopefully remove the screen. This actually functions very similarly to the Fake AV schemes, where they convince you that your computer is infected, and the only way to fix your computer is by utilizing their product. Crypto on the other hand does not lock you out from the device, but prevents access to actual files or data, sometimes this involves encryption but not always. And really this sort of ransomware is preying on users or companies who do not utilize offline backups. Later on we will talk about why offline backups are extremely important, rather than just any kind of backups.
No matter the ransomware, they have similar consequences which are potentially losing access to crucial resources such as your files, data, or entire devices. So this could include things such as pictures, tax returns and other important information you may have on that device or devices.
Similar Consequences

5. Ransomware Evolution 1989 AIDS Trojan
2006 Password Protected Zip files
2011 Paying Ransomware via SMS number
2011 Preventing Computer from booting up
2012 Ransomware impersonates Police/FBI
2013 Cryptolocker first seen(locked files)
2013 Cryptolocker gains ability to spread
2014 Rise of Bitcoin as Payment
2015 Exploit Distribution Vector
2016 PowerShell Distribution Vector
% JavaScript Crypto
Worm like behavior
Ransomware since its initial introduction in 1989 with the AIDS Trojan has constantly evolved its techniques. From taking certain files off your computer and dropping them in password protected zip files, to asking you to pay a ransom by sending a text to a premium sms number, to impersonating Fake AV or the Police or FBI, now almost all ransomware utilizies Bitcoins for payment to make the creators harder to track. Ransomware also has become more dangerous due to new distribution vectors such as leveraging exploits or power shell. Now in 2016 it has become even easier for Ransomware to run on a device by fully leveraging javascript, and it has become even easier for it to spread as we saw with WannaCry and its utilization of exploits on Windows
Looking through this timeline you can see Ransomware is not something brand new, but something that has existed for a while and has constantly evolved as the threat landscape has changed.

6. Some Notable Ransomware Variants
1989 (AIDS Trojan)
2012 Reveton (a.k.a. police ransomware)
2013 Cryptolocker
2014 Simplocker and LockerPin (Android)
2015 TeslaCrypt and Locky
2015 RaaS (Tox, Encryptor RaaS, Ransom32)
2016 KeRanger (macOS)
2017 KillDisk(Linux)
2017 WannaCryptor/WannaCry
Here are the names of some of the notable ransomware variants that we have seen throughout the years. I am sure you have heard of quite a few of these. It is important to stress that ransomware is not just a Windows problem but as you can see from the slide exists on Android, macOS, and Linux. In some instances, these sort of attacks can be worse, because still today most people do not protect their android, linux, or macOS device, and only protect their windows devices. That means that if someone deploys a threat on Windows, typically they need to bypass the OS, and their Endpoint Security product, however on other OSes they just need to bypass any OS protections that exist due to the lack of any Endpoint Security product being installed. So lets take a look at some of these ransomware variants in more detail.

7. 1989 – AIDS Trojan Floppy Disk
So the first piece of ransomware occurred in 1989 with a 5 ¼ inch floppy disk, yes some of you might not know what it is, so I have a picture of one right there. This disk was called the AIDS information Introductory Diskette and was mailed to several people. When run it displayed an Intro/Eula and gave a quiz on how likely e a person was to be infected by the virus based on their activities. Later on it hid the directory information and encrypted file names on the PC until a $189 license or EXTORTION fee was paid to a PO box in Panama, which would give the user a “year’s worth of access” to their system. Eventually the person behind this early ransomware was arrested, and was actually have found to have previously worked for the World Health Organization dealing with AIDS research.
Floppy Disk

8. 2012 - Reveton Reveton Pretended to be FBI File sharing violation
Utilized Moneypak
In 2012 Reveton began to spread, which payload displays a warning from a law enforcement agency claiming that the computer has been used for illegal activities such as file sharing. To make this alert seem more legitimate they actually displayed the computer’s ip address. Variants of this ransomware were localized with templated utilizing different logos based off the different law enforcement organizations in the users countries. In order to make the payment, rather than using a PO box like the AIDS Trojan did back in 1989, they utilized a service called Moneypak which could be bought at many pharmacies and grocery stores.

9. 2013 - Cryptolocker Cryptolocker Bitcoin File sharing violation
Extorted $3,000,000
In 2013, Cryptolocker burst onto the scene which utilized very strong encryption – actually a 2048 bit RSA key pair. After the creation of this encryption key, it uploaded it to their command and control server, and began encrypting only certain files on your computer. Then the malware threatened to delete the private key if the bitcoin payment was not made in 3 days of infection. After the deadline passed, this bitcoin ransom was increased to 10BTC. It was estimated that at least 3 Million dollars was extorted with the malware prior to it being shut down.

10. Android Ransomware LockScreen ransomware Crypto ransomware
LockerPIN ransomware
On the android OS side of ransomware, there are 3 main types. Lockscreen ransomware which constantly brings the ransom window to the foreground in an infinite loop so you are unable to do anything else on your device. Crypto Ransomware which encrypts files on your device or SD Card, and LockerPin which changed the pin code on the device so users were unable to restore access without factory resetting the device or having root access prior to the infection.

11. Android Ransomware Android/Simplocker Discovered in 2014
Encrypted contents on SD Card
First, back in 2014 Simplocker was discovered. Simplocker was unique due to the fact that this malware was location aware, so unlike Reveton where different variants were coded for different regions. Simplocker automatically displayed content based off of where the users device was. So for instance, in the United States they received a prompt saying the alert was from the NSA. This ransomware encrypted the contents on the SD Card quickly after install.

12. Android Ransomware Android/Lockerpin Discovered in 2015 Reset PIN code
Clickjacking
In 2015 on the Android side, we saw an even more nefarious version which acquired Device Administrator privileges unknowingly to the user. The malwares activation window was overlaid with the Trojan’s malicious window pretending to be an update patch installation prompt. As the victims click through this innocuous looking installation they also unknowingly activate the Device Administrators privileges in the hidden underlying Windows. This process is called Clickjacking. After the malware received administrator privileges the ransomware set a new PIN code for the lock screen. With this new Pin Code was a prompt asking users to pay a $500 ransomware, what they do not tell you of course is the fact that not even the malicious author in this case new what pin code was set on your device. So after you were infected the only way to recover the device is to previously have had Root access to your android device, if you did not your only option is to reset and restore factory settings.

13. MacOS Ransomware KeRanger Discovered in 2016
Spread via Transmission app
OSX(Mac OS) specific
KeRanger the MacOS or previously called OSX Ransomware, was unique due to the ransomware actually being embedded into a version of Transmission. For those who do not know Transmission is a widely used BitTorrent client on OSX. Version 2.90 of Transmission had the KeRanger Ransomware built in, so Transmission once they found out, quickly prompted all users to remove version 2.90 and install Even though the download was only available for 1 day the big problem with this malware was that it was signed with a legitimate developer certificate.
After infection the malware laid dormant for 3 days, then popping up requesting a 1 Bitcoin payment in order to decrypt your files.

14. Linux Ransomware KillDisk Discovered in 2017 Linux Specific
Windows version in 2015
KillDisk was originally discovered in late 2015 and at that point targeted Windows Oses, however in 2017 a new variant renders Linux machines unbootable, after encrypting files and requesting a large ransom. In fact the ransom on KillDisk is set at 222 Bitcoins which as of this week is around $600,000

15. Ransomware as a service(RaaS)
Tox(2015)
No tech knowledge required
Hidden Tear(Open Source)
In 2015, Ransomware and the deployment of it has become even easier, with the rise of Ransomware as a service. Now from a darkweb website, someone can choose the type of ransomware they want, the amount of ransom to ask for, additional notes and features, and they are provided with everything they need for a successful ransomware attack. This new ransomware as a service actually is a service where they provide support, troubleshooting, to make sure the product the customer that was purchased was happy with the service they received. It is important to stress that this requires no tech knowledge at all.

16. WannaCryptor (aka WannaCry)
Discovered in 2017
Wormlike behavior
Spread using Eternal Blue exploit
Then in 2017 we saw WannaCryptor also known as WannaCry strike. WannaCry infected Windows machines and unlike typical ransomware that may infect one or 2 people in a company if they both open an infected or website. This quickly spread through the company infecting multiple people, or entire organizations. The reason it was able to spread or function like a worm of old, was due to the inclusion of the Eternal Blue exploit. The eternal blue exploit was one of the NSA exploits released by the Shadow Brokers weeks prior to the WannaCry attacks.

17. Ransomware Future Cars, Smart Devices (IoT), and more
Restrict access to car, house or thermostat until ransom is paid
Finally the future of Ransomware, as more and more people acquire smart devices, smart cars, and smart homes and enjoy the convenience of internet connected devices. Malicious actors may begin attacking these devices directly and holding them for Ransom. If you lock someone out of their house, then they are unable to utilize anything contained inside of it, rather than with ransomware today you are only locking them from using their computer. But they also could do this to any internet connected devices for instance they could restrict access to your car, your house, or your thermostat until the ransom is paid.

18. Ransomware Infection Vectors
Now, Ransomware Infection Vectors

19. Common ransomware infection vectors
Malicious attachments (social engineering)
Drive-by downloads from malware-laden websites
Installation by another trojan - downloader or backdoor
The most common infection vectors for Ransomware, is first via malicious attachments. s come in and contain malicious attachments, most malicious attachments need to be opened in order to properly execute and infect computers, so they have to utilize social engineering to convince users that they should open the attachments. What malicious actors will do is pretend to be a mail service, colleagues at work, family members, or many other things, all with the hopes that someone will open the attachment. Oh and people definitely do open those attachments, according to the Verizon Data Breach Report of 2016, 12% of people opened attachments in phishing s last year.
Next most common is from malicious websites and the utilization of drive by downloads. Drive by downloads is basically when you go to a website and a download either tells you it is something that you want and not actually a piece of malware, or when you go to a site and something automatically gets downloaded to your computer without your knowledge.
Then finally, ransomware can infect you by being installed by another piece of malware, downloader or backdoor. So after you are initially infected by a piece of malware, that piece of malware then downloads a ransomware variant that infects you.

20. Common ransomware infection vectors on mobile devices
Visit untrusted sites
False warning: update required
Automatic downloads of malicious apps
Manual installation by user
On the mobile side, there are a view different ways that you get infected. First visiting untrusted or unsafe sites. Next False warning popups indicating that you are required to update something. When you click update you are brought to a malicious payload. Automatic download of malicious apps, once again this is similar on the computer side, where this download can happen automatically. Then finally manual installation by the user, where the user may think they are downloading something safe or benign, and in fact they just downloaded malware directly to their mobile device.

21. What to do if you are infected
Immediately disconnect the device from the internet and power off the device.
Contact your endpoint security vendor’s support and law enforcement.
If you ever get infected by ransomware, you should immediately disconnect the device from the internet, and power off the device. Next you should contact your IT Department, who should then contact both the Endpoint Security Vendor’s support team and law enforcement. Typically Law enforcement have teams that handle electronic crimes including ransomware.

22. Ransomware Prevention
Onto Ransomware Prevention

23. Ransomware prevention: Multi-layered
Web Filter
Malicious websites
Non-approved content
Filter
Spam
Attachments
Patching
Entry point
Mitigates spreading
Endpoint Security
Latest version
Enable cloud(LiveGrid)
When it comes to Ransomware prevention a multi-layered approach is very important and is made up of a few different categories.
First Filtering, due to the fact that a majority of ransomware is entering via attachments, you can provide a first layer of defense by having a solution that properly filters for spam and phishing s. Then based off your company policies you can block all attachment types that your business does not traditionally want being sent via . Of course the more types you block, the less you will have to worry about malware being delivered via attachments. Keep in mind lots of Ransomware has historically been delivered via Office files such as Docs, so you need to block more than just .exe.
Next Web Filter, by implementing a Web Content filter, you should be able to block malicious websites as well as any websites that you deem inappropriate for work use. Filtering internet access can help to reduce the infection rate of your organization.
Next Patching, as we saw with WannaCryptor, an unpatched system allowed the Ransomware to enter the system as well as spread from system to system. So making sure first that your OS is as up to date as possible, but also making sure 3rd party software is up to date is extremely important. Along the same lines you might want to think about locking systems down in order to stop Ransomware and other threats that enter a computer through office macros or require administrator privileges.
Next, Endpoint Security, When it comes to Endpoint Security or Antivirus/Antimalware products you want to make sure that you are utilizing the newest version of the company’s product, and that the product is successfully retrieving its daily updates. If the vendor has a cloud component make sure it is turned on, as this allows even faster response, reaction to new zero day threats. ESET calls this component LiveGrid.
User Training is next, and user training is important to reduce the amount of incidents your company has, by teaching users what to look for and what to avoid when it comes to phishing and other malicious content. This also helps the users to report to the IT department when they noticed something, which can allow the IT department to tweak the spam filter, or bolster other defenses
Finally, Backups, if you are ever hit with a Ransomware attack, having backups will allow you to easily recover all of the data. However, it is important to stress that Offline backups is what you need. Due to Ransomware and its ability to encrypt network drives and now spread. You want to make sure that your backups are never vulnerable to this sort of attack. So by having them in an offline state, guarantees that they will be available when you need them.
User Training
Reduces incidents
Increases reports
Backups
Allows recovery
Offsite/Offline recommended

24. Should you pay the ransom?
ESET advises its business customers as well as all other users not to pay the ransom.
There is no guarantee that the cybercriminals will unlock your device or that the decryption process will work.
Paying the ransom is fueling future cybercrime.
Cybercriminals can come back for more.
After looking at that last slide, how many of you currently utilize a patch management system or offline backups? We will take a look at the results after this slide.
If you get a Ransomware infection, should you pay the Ransom?
At ESET we advice all of our business and consumers not to pay the ransom.
First there is no guarantee that the cybercriminials will unlock your device or that the decryption process will work
If you do pay, that is providing them a reason to continue their attacks as well a fuel future cyber attacks
Then even if they do decrypt your files, cybercriminals now know you are a person who pays, and can immediately attack you again.

25. Decryptors available Sometimes locked files can be decrypted.
Most endpoint security providers have a list of Decryptors on their website.
This could save time rather than recovering all files from a backup as well as provide a more recent version.
After infection, another thing to look into is Decryptors. Decryptors are available from Endpoint Security Vendors websites, including ESETs. Because sometimes encrypted files can be decrypted. This could save time rather than recovering all files from a backup. Also depending on when your last backup was, a Decryptor could provide a much more recent version.

26. How ESET keeps you safe from Ransomware
Now, How does ESET specifically keep you safe from Ransomware.

27. About ESET 30 Years 1200+ Employees Worldwide
Partners spanning 200 Countries
4th largest Business Endpoint Security Vendor
First a little of information about ESET the company. ESET has been doing Endpoint Security now for 30 years, we have 1200 employees worldwide, partners spanning 200 countries, and are the 4th largest Business Endpoint Security Vendor.

28. ESET is very much a global organization and we have offices, and virus labs around the world, that help us to see attacks in one region before they make their way to another region.

29. ESET’s Endpoint Security Offerings
Windows
Mac OS
Linux
Android (AV + MDM)
IOS (MDM only)
Servers
Mail Security
File Security
Sharepoint Security
Gateway Security
ESET offers products for all the major OSes.
Our Endpoint Products do not just protect against Malicious content, but have the ability to serve as a web content filter, and Device Control solution. ESET Mail Security filters not just for Malicious content, but also for Spam at the server level and works with Exchange, Domino, Kerio, and Linux Mail servers.
Implementing ESET Mail Security + ESET Endpoint Products with Web Control and Device Control gives you a multi-tiered or multi-layered approach to stop Ransomware.
Then within our Endpoint Security product itself there are multiple layers of defense as well.

30. ESET’s Evolution 30 years ago… CMPS/DNA Hash ..NOD was born
1987
30 years ago…
..NOD was born
CMPS/DNA Hash
Device Control
Exploit Blocker
Advanced Memory Scanner
2014
Botnet Protection
2013
1995
Heuristic Detection
2015
Network Detections
ESET Shared Local Cache
ESET believes a multi-layered approach is the best approach to protect users from the newest malware including ransomware. ESET continues to evolve and ADD new protection technologies to stay one step ahead of the newest malware. This shows the additions we have made over the years, to create a fully multi-layered approach, as we do not think a single one of these technologies is a silver-bullet.
2012
Network Attack Protection
2002
Advanced Heuristics
Behavioral Detection
2005
DNA Detections

31. Network Attack protection
Prevents the spread of ransomware by protecting against vulnerabilities.
When it comes to Ransomware we have a few protections that are the most important
Network Attack Protection is an extension of firewall technology and improves detection of known vulnerabilities on the network level. By implementing detection for common vulnerabilities in widely used protocols, such as SMB, RPC and RDP, it constitutes another important layer of protection against spreading malware, network-conducted attacks and exploitation of vulnerabilities for which a patch has not yet been released or deployed. Network attack protection was instrumental in the WannaCryptor or WannaCry outbreak. Network Attack protection was actually blocking all of the NSA exploits released by Shadow Brokers already, so we were preventing the Eternal Blue exploit it was utilizing with this module.

32. DNA Detections
Perform deep analysis of code, extracting the “genes” that are responsible for its behavior.
Pattern matching can be bypassed easily by simple modification of the code or use of obfuscation techniques. However, the behavior of objects cannot be changed so easily. ESET DNA Detections are precisely designed to take advantage of this principle. We perform deep analysis of code, extracting the “genes” that are responsible for its behavior. Such behavioral genes contain much more information than the indicators of compromise (IOCs) that some so called “next-gen” solutions claim to be ”the better alternative” to signature detection. ESET behavioral genes are used to construct DNA Detections, which assess potentially suspect code, whether it’s found on the disk or in the running process memory. Additionally, our scanning engine extracts many discriminator genes, which are used for anomaly detection: anything which does not look legitimate is potentially malicious. Depending on the adjustable threshold level and matching conditions, DNA Detections can identify specific known malware samples, new variants of a known malware family or even previously unseen or unknown malware which contains genes that indicate malicious behavior. In other words, a single well-crafted DNA behavioral description can detect tens of thousands of related malware variants and enable our antivirus software not only to detect malware that we already know about, or have seen before, but also new, previously unknown variants. Moreover, automated clusterization and application of machine learning algorithms to our malicious sample sets allows us to identify new malicious genes and behavioral patterns for detection by our scanning engine. Such genes can be easily matched against a huge whitelist set to ensure that they generate no false positives.

33. Cloud Malware System
Analyzes submitted malware and provides results to endpoints without requiring an update.
The ESET Cloud Malware Protection System is one of several technologies based on ESET’s cloud-based system, ESET LiveGrid. Unknown, potentially malicious applications and other possible threats are monitored and submitted to the ESET cloud via the ESET LiveGrid Feedback System. The samples collected are subjected to automatic sandboxing and behavioral analysis, which results in the creation of automated detections if malicious characteristics are confirmed. ESET clients learn about these automated detections via the ESET LiveGrid Reputation System without the need to wait for the next detection engine update. The mechanism’s turnaround time is typically under 20 minutes, which allows for effective detection of emerging threats even before regular detections are delivered to users’ computers.
These technologies sound nice, but the real question you probably have is, do they work?