• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 643
  • Last Modified:

Cryptolocker

Hi Experts

Hot topic at the moment  I suspect :-)

We are all looking for an effective defense, in a moment of lateral thinking ?

Is there a way (group policy, whatever,etc) to prevent a process trying to encrypt currently unencryted files from being encrypted ?  

If the bad guys cannot achieve this, then there is no ransom?
0
cpmcomputers
Asked:
cpmcomputers
  • 4
  • 2
  • 2
  • +3
5 Solutions
 
Nick RhodeIT DirectorCommented:
You could user software restriction policies or an app locker

http://www.cnmeonline.com/news/cryptolocker-how-to-avoid-the-toxic-ransomware-and-what-to-do-if-you-get-infected/

Decent article about software restriction but it might cause a little bit of a headache for you.  But cryptolocker is a headache itself.
0
 
piattndCommented:
We are using the following:

http://www.foolishit.com/vb6-projects/cryptoprevent/

Direct download link:

http://www.foolishit.com/download/cryptoprevent/

This is not a group policy, though you could create a GPO to install it.  Make sure you test it thoroughly on a few computers to make sure it doesn't break anything specific to your environment before you deploy it.
0
 
aadihCommented:
Please do read the article, "CryptoLocker: A particularly pernicious virus." It shows how using Local Security Policy, you can prevent this virus. The article is at:

http://windowssecrets.com/top-story/cryptolocker-a-particularly-pernicious-virus/ >
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
Giovanni HewardCommented:
Here's a solution which will render Cryptolocker, it's variants, and a majority of all Malware threats inert-- those which do not feature 0-day vm escape exploits anyway (something EMET could possibly mitigate.)

http://www.experts-exchange.com/Security/Vulnerabilities/Q_28233648.html#a39474622

A variant could easily be created which avoids the %appdata% and %LocalAppData% folders altogether, securely deletes/encrypts your shadow volumes, etc.  

While SRP/AppLocker whitelisting is potentially viable, there appears to be trivial bypass techniques a subsequent variant could exploit.

http://blog.didierstevens.com/2011/01/24/circumventing-srp-and-applocker-by-design/
http://www.wilderssecurity.com/archive/index.php/t-291593.html
0
 
McKnifeCommented:
@x66_x72_x65_x65: don't call those techniques trivial - as you could read, applocker is different, it is not, like SRP, controlled in the user space, so the user cannot circumvent it that easy. So applocker is an option if you run win7 ultimate/enterprise or win8 enterprise.

Another option are simple backups. If the data is encrypted, so what? Restore it from backup.
0
 
Giovanni HewardCommented:
The context in which I mention "trivial" is relating to a competent malware author, not an end-user or IT professional.  LoadLibraryEx has a feature (LOAD_IGNORE_CODE_AUTHZ_LEVEL) to circumvent SRP and AppLocker.  Used in conjunction with dll hijacking or macro loading-- for example-- it's very possible to create a malicious dll (loaded by a white-listed application, such as Microsoft Office) which bypasses both.

Without the hotfix I referenced above:
...malware in the %TEMP% or %system drive%:\Users directory can be executed by using the SANDBOX_INERT and LOAD_IGNORE_CODE_AUTHZ_LEVEL flags, even if access to these directories is limited by AppLocker rules.
http://support.microsoft.com/kb/2532445

Privilege escalation techniques could also be deployed as needed (KiTrap0D (In Memory/User), etc.)

Don't get me wrong, I'm a defense in depth advocate-- hardening systems, data backup/recovery, business continuity, etc., etc. should all be part of the design.

I'm merely posing the question, which is much more effective and efficient?  

Having an vulnerable applications run in virtual containers which automatically revert to clean states upon infection or deploying human resources for diagnosing, recovering, reimaging, and restoring?

Encrypting documents aside-- Call me eccentric, but I'd rather have malware with remote access/reverse shell firewall extrusion capability (effectively giving the author access to the victims private network) occur in an (isolated network) virtual container, as opposed to my actual network.

My recommendation is a paradigm shift, which by its very nature is destined to be resisted by the archaic paradigms of the day.
0
 
McKnifeCommented:
Hi.
> ...to circumvent SRP and AppLocker.
Yes, I read so, but will the authors use it? It would require to trick people into using certain white listed applications and open an attached document that uses that dll trick, that might not even work with any (to-the-author-unknown-) version of (for example) word (if even present) or whatever program.
So applocker poses quite a problem to the authors.
0
 
Giovanni HewardCommented:
There are many other examples available.  Consider compromising the white listed applications themselves; a recent example is CVE-2013-3918 (MS13-090).  In this case the end user would need only visit a specially crafted web page to become exploited.  Exploitation could inject its payload directly into the memory space of the white listed application (IE).  The malware authors could also negate the need for initial C&C "phone home" requests (for the public key) by dynamically providing a (pre-generated) key upon introduction of the payload.  This could have the side effect of creating unique code for every payload instance-- which would easily bypass signature based solutions.

Again, I'd personally prefer exploitation to take place in an isolated protected space as opposed to my primary OS and private network.

Such attack vectors may be mitigated against by deploying EMET on all Windows systems.

So I pose the question, what is the wisdom in opposing "DMZ for your endpoint" architectures?  My recommendations are not made lightly.  They are thoroughly researched and proved.  I recommend you research FireEye, Invincea, EMET, and OpenDNS.

but will the authors use it?
Is your organization willing to accept the risk that they (and all other malware authors) won't?
0
 
cpmcomputersAuthor Commented:
Thanks for all the feedback
Some practical solutions and some information that made me realise just how little I know about these threats

Been surfing the net for hours following your links :-)
0
 
aadihCommented:
[If] known, no threat.
Unknown, menace.

:-)
0
 
Giovanni HewardCommented:
Your welcome.  Take a look at the following course syllabus on Securing Windows and Resisting Malware.  Much of the techniques described above are discussed.
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 4
  • 2
  • 2
  • +3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now