[intro music]
CryptoLocker is a type of Ransomware, and Ransomware locks you out of your computer, or in this case personal computer files. You are prevented from accessing the files until you pay a ransom to the writers of the malware.
In this video I’ll show you CryptoLocker actually running.
So, this is my computer and if we have a look in My Documents there are several Office files.
If I try and open them (with PowerPoint, Excel, Word) they all open fine.
Let’s try and get the malware program onto this computer. You may receive it via email, a USB pen drive, or perhaps your computer has undetected malware already running on it (i.e. a ‘botnet’ computer) and the malware is download without you knowing.
In this case I’ll try and paste the program onto the Desktop of the computer.
As Sophos Anti-Virus is running (up to date and on-access scanning enabled) the program is blocked. Infection of the computer cannot occur.
If you face this situation you are fine.
To show you the malware running I will stop the Sophos on-access scanner.
I’m logged on an administrator of the computer and if I go the Anti-Virus settings you’ll see the on-access scanning option is grayed out.
That’s because I’ve got Tamper Protection enabled and even as an administrator I have to authentication – an extra level of protection Sophos offers.
So now we can configure on-access scanning and uncheck the option.
The program warns us about what we are doing. We get a pop-up balloon in the corner. If we acknowledge that the operating system pops up a warning too.
Now we’re totally unprotected. Let’s try and paste that file again.
This time it works and isn’t detected.
Let’s open the zip, drag out the file and have a look at the extension of the file.
It says it is a dot PDF. This is a trick used by malware writers to fake the extension if you have ‘Folder Options’ set to hide known file types.
If you show all file extensions you can see that the file is a .pdf.exe
If we double-click on it now it disappears (deleting itself to prevent submission to an antivirus vendor for analysis).
Looking at the whole desktop nothing appears to be happening. If we open Task Manager and look at the running processes we see a couple of strange processes.
You may think there is no problem as if we look back at the files they seem to be fine and open OK. We can even save them.
The malware first has to contact a central server on the Internet. The server creates a unique encryption key pair (public key for encryption and private key for decryption).
The public key is sent to the local computer and then encryption can being. The private key is not sent to the local computer.
After a few minutes the computer wallpaper changes and there is a pop-up flashing orange on the Desktop.
The CryptoLocker program has now revealed itself and the ransom threat beings. There is a countdown timer showing 71 hours 59 minutes and is ticking down - the time left before the private key is deleted. The encryption used is very strong.
If you click ‘Next’ the only option is to select a payment method. Either MoneyPak (US only) or Bitcoin is accepted. There are no other options to choose.
The Desktop wallpaper has a warning and explains what to do if the program closes – basically how to download the file and re-run it (link is blurred out).
The program does not allow itself to be closed.
Let’s switch on the on-access scanner and delete the malware.
To speed up detection I’ll run a quick scan.
The malware is immediately detected in memory so we can stop the scan and cleanup is automatic (cleanup depends on your local settings).
The malicious software has gone, but what about those Office files we could open earlier?
The files look OK in that they are still shown in the folder. Let’s try and load them.
The presentation doesn’t load. Opening the spreadsheet Excel says the extension is not valid (actually it’s encrypted). Try the Word document and the file appears corrupt.
Opening the second Word document suggests converting the file. However the preview is grabbled and so is the content – it’s encrypted.
So, that’s CryptoLocker running. The private key to decrypt the files is never on your computer (only the central server) and that’s the only thing that will decrypt the files.
Takeaway message: Ensure your antivirus software is up-to-date and running. Don’t download files from emails that you were not expecting. And scan your computer regularly.
Thanks for watching.
[outro music]