When we think about hackers we first think about what was happening in the early times of the internet so before the mid 90s
there were people having fun and trying out new things.
The best representation, even if not the best movie, is the movie from
1995, Hackers, with young Angelina Jolie as well.
RISC architecture is going to change everything. Yeah, RISC is good. Because in this movie you can also see them
rollerblading going around with day with their computers
But now it's completely different, that's because since the
WWW (World Wide Web) has been invented we had a complete revolution where everything changed and
where
everything started to be stored and
Information being processed and so and so forth on the networks now. Also the banks are now online. Well, not only now but in the last decade
lets say, but that means again that we have a lot of important information a lot of money stored through
online
storages servers and networks that could be attacked.
It's not only for fun, but now hackers have a different motivation, there is money. Now hackers can try to,
for instance, infect a computer in order to steal information or
Change the advertisements in order to put their own that would cause a loss of money to other
Advertisers that wouldn't visualize their
Advertisements and so on and so forth. So maybe not even the victim is the infected computer
But that is the medium used to attack another computer. The idea today is to go through some of these kind of
Infections just to show/understant the motivation, Why is there money involved and its importance. The first infection
I want to go through is information stealing malware.
The two probably most famous ones are Zeus and torpig, but in general what does the information stealing malware
do. The attack is when a computer is infected
they intercept all the possible forms, so this means they are going to try to take
all the single
Forms you submit on the Internet, a login credential for instance, a bank credential, and they will try to steal it.
What happens is we have our computer where we write the things and our computer is infected.
Now when we log into a website
for instance the bank
To log in there we have to send the information that are our credentials, so
Login there is user and password.
This is a form, but because our computer is infected, the malware is going to also
intercept this form.
So the form will go to the bank
but will be also stored by the malware at a certain point
Usually as soon as possible in the moment it intercept the forms. The malware tries to contact
another
Machine that is usually called the Command and Control server (C&C)
When it intercept the form it sends it to the Command and Control in order to make the information available
to the criminal. When this happens the criminal is able to reuse this
information to login to your bank details for instance or to
Take your Facebook credentials and log into Facebook. Now. Is this valuable yes
it is while maybe mail or Facebook credentials could be worth a few dollars. If we steal for instance bank details or
Credit card details. These could be worth some hundreds of dollars and obviously like
Zeus or torvik were stealing much more than a few of them. As
an example the torpig botnet ,that I mentioned at the beginning, has been able to infect over
100,000
Computers per day. It was using another botnet, nabrit? ,for the first infection
and then it was managing everything from the Command and Control service.
The problem with the first botnets before torpig were that they only had one Command and Control server or maybe more than one
But they were hard-coded so that one infected machine was communicating with only one
Command and Control server. The moment you take down the Command and Control server the infected machine was not able to act anymore.
The torpig botnet was the first one or one of the first at least
to introduce the domain generation algorithm.
In order to find the domain, where they would have found a command and control server in a dynamic way during the infection.
But what has been done by researchers in 2009 was to
Reverse-engineer the code of the topic botnet in order to find out the algorithm that was generating the domain names
because this was the first one, it was pretty easy to find out how to
identify the domains before they were discovered by the different clients and the different bots.
In the moment they were about to be active those domains would have been taken by the
researchers in order to avoid that the command control server would have been active and
by doing this they were able to
Avoid that the infected machines were active because they weren't receiving any instruction
And they weren't able to send anything out because the command control servers weren't at the domains they were looking for
This was the first time they've been able to do something like that
but
after a few days then for the new
Infections there was a new version of torpig that was not so easy to detect the domain generation algorithm from there
It has always been a kind of arms race between
Researchers and defenders and cyber criminals in order to find out which algorithm
Of situations were able to generate the domains and being able to prevent these kind of issues
If you were a defender. A domain generation algorithm has to have as output a string, that is the domain itself
They have to kind of randomize the generation of the string and at the same time control this randomic generation
through putting some parameters that would block to a certain state in order to know what it is about to be created.
In this way what is about to be created by the bot
Will be the domain that they know they can
Buy and they can own in order to have the command control server active where the bot is looking for it.
How did that differ because surely then once it's gone to that command control server if you can see what it's communicating with
Presumably you can stop it, or is there a way of
Making it move on to another command and control server. [Enrico] So command control servers are usually active for about a day
Maybe two so when we are even able to identify one of them
We could put it down but most of the times
There is a new one going up
After a day and also now the most advanced botnets are able to redirect when you don't have the command and control server you were
Communicating with to a new one. So in this way even if we put down one of the command controls the bot would be able
to get the new command and control to communicate with we may have a certain quantity of
infected machines that are communicating to a
Command control and the same is happening with other infected machines and so on and so forth for other
Thousands and thousands of times.Now if we do put down this command control
Apart from the fact that there may be a new domain
Generated soon and so another command control being, well the same command control been able to take another domain and be inactive
Also, what can happen is that
These bots that have been infected, but cannot communicate here
They are going to try to communicate here or maybe to another C&C that is here with other ones in order to
Redistribute the load. By having different command and control servers
We have different
little networks of infected machines that can be used in different ways.
Another kind of malware from a malware family that is on the edge
now is ransomware. As we have heard there has been the wannacry attack for instance recently and
There is already a computerfile video on wannacry and we know that
Ransomware what they do is to lock the computer and encrypt the data. Now first before the ransomware
is already advanced there have been screen lockers
They were working more or less in the same way, but they weren't encrypting the data that means that your data wasn't affected
but they were just blocking yourself on that screen so if
Like technicians were able to get out of that screen you wouldn't have had to pay the ransom
In what happens since that with ransomware is that
What they have is
They lock the screen, and they start encrypting your data. This way while maybe you are looking at the screen and
You don't know what to do the your computer gets encrypted and encrypted and encrypted. Now
There is an interesting fact on psychology
Because what they tell you is give me the money there are also quite nice
Tutorials that are linked about that and how to pay in bitcoins. For instance give me the money
and I will give you the key to decrypt and the guide on how to decrypt with that key
and that's good if only you are sure that this is going to happen and
You are sure that this is not going to happen again with another infection
Because what you don't really know is if maybe you are able to decrypt
But the malware may still be there and maybe activated further on so you will have to pay again ransom for instance
That's obviously more money, but also the problem is what if I don't give you the right key.
I may ask you again for money for having another key, but then you may decide not to pay any more
and if I do it all the time
People may not want to pay me anymore so my whole economy would crash. So the idea is I have to
Give you the key in order to decrypt because otherwise you're going to stop paying me
there is what suggested by the law enforcement for instance and
in this way I may want to leave the malware there in some stealthy way in order to be able to reuse it if I
want.
This could be
Particularly good for criminals, but that's why
law enforcement say is to have a backup and
To avoid problems with the backups now ransomware are also checking for local backups
so if you do a backup of your data on your local machine this would be identified from the most new malware samples and
The ransomware would delete the local machine the local copy and you wouldn't have the backup
So what happens there is that the
Backup has to be more on an external hard drive or on the net
But if that is connected in the moment of the infection. That's again a problem because
Ransomware tries to spread also over the network apart from the wanna cry example where there was a worm involved that is another
family of malware
In general ransomware look for all the devices that are connected to the computer that is infected
And if there is any device with a storage that is connected for instance shared documents in an office
They would encrypt also those shared documents
and that's obviously a problem because if you have your
External hard disk where you have the backups that is connected at the moment when the infection is there
The ransomware will try to encrypt also that part. That's also
Why when you see a runs from your infection
And you know you have the backup what they suggest is to close as soon as possible the computer by just
Taking out the plug in order to avoid the ransomware to continue encrypting
Because the encryption part takes time it's not an immediate process, and they need to
Let you stay in maybe trying to understand how the pavement is and so on and so forth but
If you just plug off then you can do the backup and obviously you may lose the most recent data
But you would avoid paying a lot of money. I think it makes sense to just pull the plug
What would happen then I suppose is not turned the computer on but take the hard disk out I suppose and and get someone
To deal with it
If
because that's again against the economy itself of the malware because if
If you immediately pull it off and you do the backup over the encrypted data, then the malware can't do anything
because it would be taken out as you wipe the hard disk from how it is and you put the backup on and
then the malware can't do anything and
It's just you disinfect it and you didn't pay yeah
I think the key is was like you said is making sure none of these devices are connected all the time
Yes, it's got a backup. It's just for doing the backup. It's not because for instance if you have your backup on Dropbox
Just to make an example of a crowd, but you are still connected on Dropbox all the time
then what would happen is that in the moment it infects you it's able to get your Dropbox and infecr your Dropbox part and
it's not the Dropbox responsibility, but it's just what happens and
Dropbox would see just as something that is changing on your space, but it's not something they are managing
But they think you are managing it well
It's the ransomware that is infecting your computer and is managing your drawer at the same time
I'd be interested to see because Dropbox keeps deleted files, and if you change your files name. I wonder if it
Yeah, I don't know I wasn't very interested to try that because it's possible maybe and I never tried
It's possible
Maybe that Dropbox keeps a kind of record of what you have changed and is able to restore maybe to the most recent situation
But I'm not sure about that. I never tried to do something like that
So sometimes he fought please wood dies he often would make backup copies
Let's try this one
Sounds more hopeful and
So there was this game called lambda which became the full games arch and
When this game was released it was sort of full 3d graphics, which