Crypto Gone Rogue A Tale of Ransomware, Key Management, and the CryptoAPI -Pranshu Bajpai, Richard Enbody

2 1. Introduction 2. Key Management 3. Implementation Details 4. Understanding the CryptoAPI Functions 5. Ransomware Pseudo Code 6. Conclusion Agenda

1. Introduction -About us -The problem of ransomware 3

About Us 4 Pranshu Bajpai @amirootyet ▪ PhD candidate at Michigan State University ▪ Previously worked as an independent penetration tester ▪ Active speaker at security conferences: DEFCON, GrrCon, ToorCon, BSides, APWG eCrime... ▪ https://www.linkedin.com/in/pranshubajpai ▪ http://www.cse.msu.edu/~bajpaipr/ Richard Enbody ▪ Associate Professor at Michigan State University ▪ Books: Targeted Cyber Attacks, The Practice of Computing using Python ▪ http://www.cse.msu.edu/~enbody/

5 Ransomware Alive and Kicking!

Necessary Elements of a Ransomware 6 Infiltrate Acquire encryption secret (key) Encrypt Demand ransom Ransomware

2. Key Management -Why key management? -Evolution of key management 7

Why Key Management? Key management is crucial to ransomware operation: 8 ▪ Attacker needs exclusive access to the decryption key ▪ Key management is complex and attackers frequently make errors ▪ Ransomware will always find victims – flaws in key management imply we can recover files without paying the ransom

Evolution of Key Management ▪ Hybrid encryption ▪ A Key-Management-Based Taxonomy for Ransomware – Pranshu Bajpai, Aditya K Sood, Richard Enbody https://ieeexplore.ieee.org/document/8376213/ 9

3. Implementation Details -How is key management implemented by ransomware? 10

The Windows CryptoAPI, CSPs, and CNG CryptoAPI ▪ Microsoft’s Cryptographic API (CAPI) ▪ Maliciously used by ransomware ▪ Provides cryptographic services to userland applications ▪ Cryptographic primitives are buried in DLLs and divided among CSPs ▪ Provides abstraction to programmers CSPs ▪ Cryptographic Service Providers ▪ Each CSP offers cryptographic primitives ▪ Responsible for actually implementing the CAPI ▪ CAPI is just a bridge between application and CSP – CSP is the crux of cryptographic functionality ▪ Must be signed by Microsoft CNG ▪ Cryptography API: Next Generation ▪ Started with Windows Vista ▪ Replacement for CryptoAPI 11

Ransomware and the CryptoAPI 12

Why Use the Native CryptoAPI? Ransomware developers: 13 ▪ Make design, implementation, and operation errors ▪ Frequently engage in cargo-cult programming ▪ Often end up creating ineffective ransomware that is actually scareware

4. Understanding the CryptoAPI functions -CryptAcquireContext -CryptGenKey -CryptEncrypt … 14

Place your screenshot here NotPetya Ransomware 15

NotPetya Ransom Message 16

List of Imports 17

List of Imports 18

CryptoAPI Calls 19

CryptAcquire Context 20

CryptAcquire Context ▪ Acquires handle to a key container within a CSP ▪ Returned handle use to make calls to selected CSP 21 // Get a handle to the default PROV_RSA_FULL provider if(!CryptAcquireContext(&hProv, NULL, NULL, PROV_RSA_FULL, 0)) { printf("Error %x during CryptAcquireContext!\n", GetLastError()); return; }

CryptGenKey 22

CryptGenKey ▪ Generates a random symmetric key or a public- private key pair ▪ Handle is returned to the key/key-pair 23 if(CryptGenKey( hCryptProv, ENCRYPT_ALGORITHM, KEYLENGTH | CRYPT_EXPORTABLE, &hKey)) { printf("A key has been created.\n"); } else { printf("Error during CryptGenKey.\n"); exit(1); }

CryptEncrypt CryptDecrypt 24

CryptEncrypt CryptDecrypt ▪ Encrypt and decrypt data 25 ▪ Handle to the key to use for encryption and decryption ▪ Key determines the encryption and decryption algorithm deployed

CryptImportKey 26

CryptImportKey 27

CryptImportKey ▪ Transfers a key from a key blob to a CSP 28 if(CryptImportKey( hProv, pbKeyBlob, dwBlobLen, 0, 0, &hPubKey)) { printf("The key has been imported.\n"); }

CryptExportKey 29

CryptExportKey ▪ Securely transfers a key from CSP 30 if(CryptExportKey( hKey, NULL, dwBlobType, 0, NULL, &dwBlobLength)) //Allocate memory for public key blob if(CryptExportKey( hKey, NULL, dwBlobType, 0, *ppbKeyBlob, &dwBlobLength)) // Actual exporting into key blob

CryptDestroy Key 31

CryptDestroyKey ▪ Releases the handle to the key parameter ▪ Invalidates key and ensures it cannot be used again 32 BOOL CryptDestroyKey( HCRYPTKEY hKey );

CryptRelease Context 33

CryptRelease Context ▪ Releases the handle to the CSP 34 BOOL CryptReleaseContext( HCRYPTPROV hProv, DWORD dwFlags );

5. Ransomware Pseudo Code -Pseudo code pertaining to a generic modern ransomware 35

Ransomware Design 36 void thread_encrypt() { // main calling function ... HCRYPTKEY symKey; // handle to key HCRYPTPROV hProv = [...]; // handle to CSP symKey = generateKey(hProv); // call to key generation function encryptData(hProv, symKey); // call to file encryption procedure cleanup(symKey); // clean up procedure CryptDestroyKey(symKey); // destroy key in memory CryptReleaseContext(hProv, 0); // release handle to CSP } HCRYPTKEY generateKey(hProv) { HCRYPTKEY symmKey; // handle to key CryptGenKey(hProv, CALG_AES_128, 1u, &symmKey); // generate AES-128 key DWORD mode = CRYPT_MODE_CBC; // use CBC cipher mode CryptSetKeyParam(symmKey, KP_MODE, &mode, 0); DWORD padData = PKCS5_PADDING; // PKCS 5 padding method CryptSetKeyParam(symmKey, KP_PADDING, &padData, 0); // set the padding mode return symmKey; // return generated key } void encryptData(hProv, symKey) { for each file type F: // search for specific file types cryptFile(hProv, symKey); // locate and encrypt files } void cleanup(hProv, symKey) { HCRYPTKEY asymPubKey = getasymPubKey(hProv): //acquire RSA public key void* symKeyEncryptb64 = exportKey(symKey, asymPubKey); //encrypt and encode AES key //...write ransomnote.txt... //...write base64 encoded encrypted AES key... //... LocalFree(symKeyEncryptb64); //free allocated memory }

6. Conclusion -Final notes 37

Conclusion ▪ Assume ransomware has infiltrated host. What can we do from here? ▪ Empirical analysis suggests that many vulnerabilities lie in the key management in these ransomware ▪ Ransomware developers continually introduce design, operation, and implementation flaws ▪ Understanding key management allows us to quickly attack flaws in ransomware to recover files 38

Thank you! 39 Questions @amirootyet