A Tale of Ransomware, Key Management, and the CryptoAPI.
Ransomware such as WannaCry and Petya have been heavily focused upon in news but are their cryptographic models different from predecessors? Key management is crucial to these cryptoviral extortions and they harness the power of resident Crypto APIs available on host for convenience. In other words, they command victim’s resources to lock victim’s resources. In this talk, we examine key management models deployed in infamous cryptovirii with the ultimate objective of providing a deeper comprehension of exactly how resident APIs are being used against users. On a Windows host, CryptoAPI (CAPI) provides cryptographic services to applications. CSPs are sets of DLLs that are associated with CAPI implementing cryptographic functions such as CryptAcquireContext, CryptGenKey, CryptEncrypt, CryptImportKey, CryptExportKey, CryptDestroyKey etc. In Windows Vista and later, CNG replaces CAPI and the ransomware menace persists. We explain cryptographic functions exploited by several ransomware families and explore answers to crucial questions such as how and where the encryption key is generated, where it is stored, how it is protected while encrypting user data, and how it is securely purged. We explore several possibilities of key recovery without paying the ransom. We provide graphical representations combined with pseudo codes embodying real-world Crypto API function calls pertaining to key management in ransomware. We highlight limitations faced by ransomware with respect to key management and examine practical potential defenses. Finally, we explore options available to ransomware developers in absence of CAPI and CNG. For example, RAA uses the CryptoJS library. This talk delves deep into key management in present-day ransomware and is a direct result of real-world case studies of highly virulent infections.