# data[].attributes.attachment_link.description
ZoteroBib is a free service that helps you build a bibliography instantly from any computer or device, without creating an account or installing any software.

# data[].attributes.body
[Mind Map] <- click here

# data[].attributes.body
Our sources, research content and materials used

# data[].attributes.body
reading task

# data[].attributes.attachment_link.readable_text
Continuing on in our Encryption 101 series, where we gave a malware analyst's primer on encryption and demonstrated encryption techniques using ShiOne ransomware, we now look at what it takes to break an encryption. In order for something as powerful as encryption to break, there needs to be some kind of secret flaw. That flaw is often a result of an error in implementation.

There are a number of things that can go wrong for someone who is implementing encryption. What's difficult is being able to identify and analyze the methods a programmer used for encryption and look for any weaknesses to exploit.

These weaknesses can be anything from weak encryption algorithms and weak key generators to server-side vulnerabilities and leaked keys.

Locating encryption algorithms

Before you can even attempt to find the weakness, you must first know what was the encryption algorithm being used. A lot of times, it's as simple as looking at the API calls. If this is the case, it can be quite simple to identify the algorithm. This was the case for the previous ShiOne walkthrough.

There are times, however, where the encryption is statically compiled into the malware or even a custom written encryption algorithm is used. When this is the case, you must be able to understand the inner workings of encryption algorithms to be able to identify code.

A file's content will be encrypted and written back into the file, so a quick method to narrow down the general region where the encryption lies is to simply xref the ReadFile and WriteFile API calls. The encryption implementation will likely be performed between these two points.

Identifying encryption code

When looking for statically compiled encryption code, as we mentioned, you will not have the luxury of searching for any API calls. A basic understanding of some of the low-level details of how these encryption algorithms work will be necessary.

Starting off, below, we have the high-level flow of AES algorithm. In general, most synchronous encryption algorithms have a similar flow to this; the differences may be the types of mathematical operations performed, but the core concepts remain the same. So, understanding AES will be enough of a starting point to help identify other types going forward in a real-world analysis.

With AES, being that it is a symmetric encryption algorithm, it performs a series of mathematical and logical operations on three things working together:

1. Plaintext data to be encrypted

2. Static bytes that are part of the algorithm (lookup table)

3. The key used for encryption

Depending on the flavor of AES and key size, the flow will be slightly different. In the picture above, you see a loop involving a few blocks:

What is happening in these steps is the file data is read into a matrix of a fixed number of bytes. In this case, it's 16 bytes, but depending on the algorithm, it could be anything. Here are the rounds of steps:

The add key round XORs the key data against the matrix of input data.

The shift rows round rolls the data using a shift operation. What I mean by rolling is the following: 4 5 2 1. If the roll shifted left one count, it would become 5 2 1 4. Rolled again it would become 2 1 4 5.

The sub bytes round involves a static array of bytes built into the algorithm. Each byte of data from previous steps is used as the index to a lookup array. Thus, there is a static substitution occurring. You can think of it as similar to an enum in programming.

In the m ix columns round, the bytes in the matrix are manipulated by some mathematical operations and linear transformations, and result in each byte of the matrix being different now.

Each set of these four series of operations is considered one round. AES can have 10 to 14 rounds. This means that when you are looking for the encryption code inside of a binary, it will likely be a long function with a lot of repetitive-looking code. This is one aspect that can help you identify it as encryption code when looking though the binary.

Here is another example of a round of encryption, likely from a different flavor of AES or similar synchronous crypto:

As you can see, the order of operations is a bit different. These kinds of details are not too important to us because we are not cryptographers. In general, we are not looking to find the weakness in AES algorithm itself, we are looking to find a weakness in the implementation. The reason for going into such detail on the inner workings of AES is only to give you an understanding of how it works so that you can identify it in code when you see it in the wild.

I will point you to a previous analysis we did of the Scarab ransomware. This was an example from which the code above was taken. They were encrypting files using statically compiled AES-no API calls. We had to do some research on the inner workings of various encryption methods to be able to properly identify what the algorithm was actually doing.

The details on the number of sets of these operations in this function was one of the main indicators to us as to which algorithm this code belongs.

I am including this image from the previous article once again just to remind about many encryption methods are being used in a single ransomware. This is good to keep an eye out for and not to be confused when you find multiple encryptions being used. Here, we have the flow chart showing the file encryption but also the algorithm that encrypts the previous key. Although it is not the encryption that is modifying the file itself, it will be what is used to keep the file encryption key secure. Both areas are points of weakness when looking to break encryption.

The point is that any number of combinations of encryption can technically be used, as it is up to the author. You must be able to understand and identify each one and the role it plays in the overall scheme. It may be that a single encryption usage was implemented incorrectly and can be broken, and it may be a combination of a few things that together cause a hole in the overall scheme.

Random number generators

A good starting point when looking for weaknesses in encryption is by looking at the encryption key generators, which in most cases are just some form of a random number generator.

If you have ever read anything about encryption, you will likely have come across someone mentioning the importance of the random number generator. The reason for this is that if you can force the output of a random number generator to reproduce the same value that was generated during a previous encryption, you will likely be able to recreate the original encryption keys.

An example of this is shown below. The system time is being used as the seed for a weak random number generator.

For the most part, any computer algorithm can only perform a finite series of operations. If the inputs to a function are the same, the output must also be the same. It is quite logical. In the case of random generators, the ingenuity is in taking enough inputs to seed the random value so that the output is not east to recreate. For example, some weak generators take the time of day as an input. Although this is, in a way, obscure, the conditions can definitely be recreated. What is necessary is to use enough semi-random inputs to give you enough entropy.

As you can see above, a more solid random generator may sample audio data, in addition to the time of day, and use mouse input and a number of other elements to try to make the inputs as random as possible. This requires an unreasonable amount of operations to brute force or recreate.

Theoretical process of cracking weak RNG

Here is a theoretical example for ransomware using a weak generator referred to as RNG. Suppose that the ransomware used a RNG-seeded with the current time in microseconds and the encryption is a standard algorithm. These are the basic steps for an attack:

Network admin analyzes the ransomware and sees that the public key, which was used to encrypt, is used as the victim ID for the ransomware.

The network admin knows roughly the time at which the infection occurred on his network, possibly by looking at the network logs. Let's say it occurred sometime between 10:00:00am and 10:00:10am-a 10-second window.

Since the RNG uses the time in microseconds, that leaves him with 10,000,000 possible seeds.

The admin then says to himself, "If the ransomware used time as seed value , then the encryption code produces the key pair value "

He incrementally uses microseconds, one by one, starting at 10:00:00, to perform the key pair creation using some standard software.

Now he checks to see if that matches the public key (victim ID) he has obtained.

Nope, it did not match. That means the RNG did not use x (10:00:00AM) as the seed.

He tries again with x+1 and so on, until he reaches the final microsecond before 10:00:10am.

Eventually, a match will be made-the generated public key will match the victim ID.

He will now know that the private key generated is the same as the one which was generated during the encryption of his hard drive.

Now he can take that private key, run it through his off-the-shelf decryption software, and have the original file back.

In this scenario, a brute force attack is completely within reason. Now, if the RNG used milliseconds, in combination with the number of processes running at the given time, that adds a bit more complexity. It would take the initial 10,000,000 possibilities multiplied by the range of potential processes running on the machine. You can assume it might be somewhere between 5 and 25 processes. So now, that initial 10,000,000 attempts becomes 200,000,000. It is still iterate-able, but has added more complexity. You get the point.

If you add enough parameters, or parameters with a lot of possible outcomes, the number will eventually become so big where a brute force attempt would not be possible in your lifetime, as shown below.

Decryption in practice

Below is a list of a few examples of ransomware that were successfully broken and the methods used.

7ev3n, XORist, Bart: Weak encryption algorithm

Petya: Mistakes in cryptography implementation

DMA Locker, CryptXXX: Weak key generator

Cerber: Server-side vulnerability

Chimera: Leaked keys

Weak encryption algorithm

The DES algorithm was developed in the 1970s and was widely used for encryption. It is now considered a weak encryption algorithm because of its key size. The amount of bits generated as the key for an encryption algorithm is one of the considerations for the strength of an algorithm. For example, there was a contest to crack a 40-bit cipher which was won by a student using a few hundred machines at his university. It took only three and half hours. The bigger the size of the key, the harder it will be to crack an encryption-that is, without knowing anything about it.

Not to say that the common analyst has access to such resources, but I just wanted to give you a better understanding of why an encryption algorithm might be considered weak.

Often times, you can get an initial idea of what the encryption method might be by simply looking at a visualization of the files.

As you can see here, there is low entropy, and the data within the encrypted file shows similarities to the original plaintext. This could be the result of a XOR type of cypher, and a few others

Let's compare this to a file encrypted with a another algorithm. You will be able to tell the difference in the high entropy result from encryption:

The file visualization can also be a good starting point when researching to see if a given ransomware is able to be decrypted, in that it can help you to figure out what the algorithm is and if it is a know weak one. It can also point you in the direction of which part of the process you may be looking to attack to break the encryption. But as you saw from the list above, Cerber was broken by exploiting a server-side vulnerability. So although the encryption itself was strong, a side channel was attacked in order to create a decryptor.

Conclusion

In this post, we covered the need for identification and classification of the encryption algorithm used in order to look for weaknesses. We then went through a primer on identifying what the code might look like. We covered various weaknesses that can potentially be exploited and walked through a theoretical example of a scenario where a network admin might be able to decrypt the ransomware.

Tune in for part four, the decryption case study to kick off the final parts of our Encryption 101 series, where we will go through the code of a weak ransomware and prepare the game-plan for writing a custom decryption tool.

# data[].attributes.attachment_link.description
Continuing on in our Encryption 101 series, we now look at what it takes to break encryption. In order for something as powerful as encryption to break, there needs to be some kind of weakness to exploit. That weakness is often a result of an error in implementation.

# data[].attributes.attachment_link.readable_text
Selecting the Right Encryption Approach

The Optimal Solution will Vary According to Use Case, Threats Addressed, and Acceptable Deployment Complexity

At the board-room level, data encryption may easily be viewed as a binary matter: data encryption is employed and the company's assets are secure, or they're not encrypted and it's time to panic. However, for the security teams chartered with securing sensitive assets, the realities are not so simple.

When determining which data encryption solution type will best meet your requirements, there are several considerations. At a high level, data encryption types can be broken out by where they're employed in the technology stack. There are four levels in the technology stack in which data encryption is typically employed: full-disk or media, file system, database, and application.

In general, the lower in the stack that encryption is employed, the simpler and less intrusive the implementation will be. However, the number and types of threats these data encryption approaches can address are also reduced. On the other hand, by employing encryption higher in the stack, organizations can typically realize higher levels of security and mitigate more threats.

Security and deployment complexity increases when implemented higher in the stack

Full-Disk Encryption

File-Level Encryption

DB Encryption (TDE)

App Encryption

Full-disk encryption (FDE) and self-encrypting drives (SED) encrypt data as it is written to the disk and decrypt data as it is read off the disk.
FDE/SED Advantages:

Simplest method of deploying encryption

Transparent to applications, databases, and users.

High-performance, hardware-based encryption

FDE/SED Limitations:

Addresses a very limited set of threats-protects only from physical loss of storage media.

Lacks safeguards against advanced persistent threats (APTs), malicious insiders, or external attackers

Meets minimal compliance requirements

Doesn't offer granular access audit logs

Key takeaways:

Mainstream cloud providers offer the functional equivalent of FDE with its attendant limitations listed above

FDE makes sense for laptops, which are highly susceptible to loss or theft. But FDE isn't suitable for the most common risks faced in data center and cloud environments

Learn More:

Relevant Thales solutions:

You can use Vormetric Key Management to manage encryption keys for on-premises FDE storage

To enhance compliance with organizational and industry mandates around encryption key management, users of cloud provider encryption (essentially equal to FDE) can use either the CipherTrust Cloud Key Manager to take control of data encryption keys from cloud providers.

Encrypting data at the file or volume (typically used for databases) level offers security controls with software agents installed in the operating system. Agents intercept disk reads and writes and apply policies to determine if the data should be encrypted or decrypted. Mature file-system encryption products offer strong policy-based access controls, including for privileged users and processes, and granular logging capabilities.
File-Level Encryption Advantages:

Transparent to users and applications, meaning organizations don't have to customize applications or change associated business processes

Supports both structured and unstructured data

Establishes strong controls that guard against abuse by privileged users and that meet common compliance requirements

Offers granular file access logs and SIEM integration that can be used for security intelligence and compliance reporting

File-Level Encryption Limitations:

Encryption agents are specific to operating systems, so it is important to ensure the solution selected offers coverage of a broad set of Windows, Linux, and Unix platforms
Key takeaways:

For many organizations and purposes, file encryption represents the optimal approach. Its broad protections support the vast majority of use cases, and it is easy to deploy and operate.
Relevant Thales solutions and capabilities: Other considerations:

File-level encryption can protect any database that is in a file on a supported operating system. This is common in Microsoft Windows SQL Server for smaller databases. Volume-level encryption can provide encryption for very large databases. Database protection is typically multi-layered. A good security practice beyond database encryption is a database activity monitoring (DAM) product to protect against such threats as malicious database administrator or compromised DBA credentials, or SQL injection attack.

This approach enables security teams to encrypt a specific subset of data within the database or the entire database file. This category includes solutions from multiple database vendors that are known as transparent data encryption (TDE).
Advantages:

Safeguards data in databases, which are critical repositories.

Establishes strong safeguards against a range of threats, including malicious insiders-even in some cases a malicious database administrator.

Limitations:

Offerings from one database vendor can't be applied to databases from other vendors.

Doesn't enable central administration across multiple vendor databases or other areas in environment.

Only encrypts columns or tables of a database, leaving configuration files, system logs, and reports exposed.

The takeaway:

While database encryption technologies can meet specific, tactical requirements, they don't enable organizations to address security across heterogeneous environments. As a result, they can leave organizations with significant security gaps.
Learn more:

Relevant Thales solutions:

When employing this approach, application logic is added to govern the encryption or tokenization, of data from within the application.
Advantages:

Secures specific subsets of data, such as fields in a database.

Encryption and decryption occur at the application layer, which means data can be encrypted before it is transmitted and stored.

Offers highest level of security, providing protections against malicious DBAs and SQL-injection attacks.

Tokenization can also significantly reduce PCI DSS compliance costs and administrative overhead.

Limitations:

These approaches need to be integrated with the application, and therefore require development effort and resources.
The takeaway:

These approaches may be optimal in cases in which security policies or compliance mandates require specific sets of data to be secured. In addition, variants of application-layer encryption, including tokenization and format-preserving encryption, can help reduce the impact on databases.

Look for solutions with well-documented, standards-based APIs and sample code to simplify application development.

Learn more:

Relevant Thales solutions:

Resources

# data[].attributes.attachment_link.description
The Optimal Solution will Vary According to Use Case, Threats Addressed, and Acceptable Deployment Complexity At the board-room level, data encryption may easily be viewed as a binary matter: data encryption is employed and the company's assets are secure, or they're not encrypted and it's time to panic.

# data[].attributes.body
"Should cryptographic mechanisms have backdoors implemented exclusively given to criminal prosecution authorities?"

# data[].attributes.attachment_link.readable_text
Apple boss Tim Cook told his employees on Monday that the company's refusal to cooperate with a US government to unlock an iPhone used by Syed Farook, one of the two shooters in the San Bernardino attack, was a defense of civil liberties.

The Apple CEO called for the Department of Justice to withdraw its order in an email to staff sent the morning after the FBI director, James Comey, said the company should comply in order to help bring justice to the victims.
Apple or the FBI... whose side are you on in the iPhone privacy battle? | Will Hutton
"This case is about much more than a single phone or a single investigation, so when we received the government's order we knew we had to speak out," Cook said in an email to employees.

Cook's email - with the subject line: "Thank you for your support" - is the latest salvo in the public dispute between the US government and one of the largest companies in the world.

Cook said Apple has "no tolerance or sympathy for terrorists" but that following the Department of Justice's orders would set a dangerous precedent.

"At stake is the data security of hundreds of millions of law-abiding people and setting a dangerous precedent that threatens everyone's civil liberties," Cook said.

On Sunday night, Comey said the order was not about setting a legal precedent, but is instead about providing the victims with a complete investigation.

"We simply want the chance, with a search warrant, to try to guess the terrorist's passcode without the phone essentially self-destructing and without it taking a decade to guess correctly. That's it," Comey wrote in a public letter. "We don't want to break anyone's encryption or set a master key loose on the land."

A federal court in Riverside, California, on Tuesday granted the justice department the order. Apple must respond by Friday to formally protest against the ruling.

Some victims of the attack plan to support the government's efforts, attorney Stephen Larson told Reuters.

"They were targeted by terrorists, and they need to know why, how this could happen," he said.

Larson said he was approached by the justice department last week about representing the victims. He did not specify how many victims he was representing.

Farook and his wife, Tashfeen Malik, carried out the 2 December attack in which 14 people were killed and 22 people were injured.

Apple said it had the technical capability to obey the government's order, but it was "something we believe is too dangerous to do".

Cook said if such a system were developed, the company would try to protect it from being released, but it "would be relentlessly attacked by hackers and cybercriminals".

Cook said: "The only way to guarantee such a powerful tool isn't abused and doesn't fall into the wrong hands is to never create it."
Topics

# data[].attributes.attachment_link.title
Tim Cook says Apple's refusal to unlock iPhone for FBI is a 'civil liberties' issue

# data[].attributes.attachment_link.description
Apple boss Tim Cook told his employees on Monday that the company's refusal to cooperate with a US government to unlock an iPhone used by Syed Farook, one of the two shooters in the San Bernardino attack, was a defense of civil liberties.

# data[].attributes.body
fill out this quiz during the reading task

# data[].attributes.body
The factory brought to its knees by ransomware hackers

# data[].attributes.attachment_link.readable_text
When malicious hackers disable your business and demand a ransom, should you pay up? Many firms do out of desperation, turning to intermediaries to help broker the deal. But law enforcement says this just makes things worse.

Imagine the excitement when hackers gained a foothold in the computer system of Norsk Hydro, a global aluminium producer.

We don't know when it was, but it's likely that once inside they spent weeks exploring this group's IT systems, probing for more weaknesses.

When they eventually launched their ransomware attack, it was devastating - 22,000 computers were hit across 170 different sites in 40 different countries.

Huge aluminium plants hit by cyber-attack

Chief information officer Jo De Vliegher reopens the ransom note that appeared on computers all over the company. It read: "Your files have been encrypted with the strongest military algorithms... without our special decoder it is impossible to restore the data."

The entire workforce - 35,000 people - had to resort to pen and paper.

Production lines shaping molten metal were switched to manual functions, in some cases long-retired workers came back in to help colleagues run things "the old fashioned way".

In many cases though, production lines simply had to stop.

Imagine the hacker's anticipation as they waited to receive a reply to their ransom note. After all, every minute counts for a modern manufacturing powerhouse. They probably thought they could name their price.

But the reply never came. The hackers were never even asked how much money they wanted. Imagine the shock.

All that work. For nothing.

It's been more than three months since Norsk Hydro was attacked and they are still many months away from making a full recovery. It's so far cost them more than £45m.

But what they've lost in productivity and revenue, they've arguably gained in reputation.

The company's response is being described as "the gold standard" by law enforcement organisations and the information security industry. Not only did they refuse to pay the hackers but they've also been completely open and transparent with the outside world about what happened to them.

But there are many other companies and organisations who make the opposite choice, and evidence is growing that ransomware hackers are increasingly being paid off secretly by victims - and their insurance companies - looking for the easy way out.

"It's become a simple business case for many organisations to pay, and at this point it's a known secret that this is happening," says Josh Zelonis, cyber-security analyst at Forrester.

Secrecy surrounds the practice because organisations are concerned about the possibility of litigation and the damage to their reputations following an attack, says Mr Zelonis.

"And a lot of the time incident response companies are being brought in to broker the transaction with the adversaries themselves in order to ensure that the payment is made and recovery is possible," he says.

Sources in the information security industry have described multiple occasions when large, well-known companies have paid out thousands of pounds - in some cases hundreds of thousands - to hackers and not told the public or even shareholders.
More Technology of Business

Why the age of electric flight is finally upon us

How a struggling airline went soaring through the cloud

The super-tough drones and robots going where we can't

How to cope with email overload

How fish and shrimps could be recruited as underwater spies

Just last week, a Florida town paid hackers $600,000 (£475,000) to get its computers working again after a ransomware attack disabled email, hit emergency response systems and forced staff to use paper-based admin systems.

It's a troubling trend that's prompted Europol, the European Union's law enforcement agency, to re-issue its warning that paying ransoms fuels hackers and often leads to more organised crime.

One US-based company, Coveware, specialises in negotiating ransoms between hackers and their victims. Visiting its offices in Connecticut, it's clear it operates at the sharp end of cyber-crime.

There is no permanent office, instead people move around shared workspaces. The entire team is dispersed around the world.

Chief executive and founder Bill Siegel admits that the service is an "unpalatable" one, but insists that it is needed. He wouldn't give details on the companies that he's helped but says: "At any one time we have half a dozen to a dozen cases, some of the companies are big, including public companies and name brands."

The company's own research indicates that the hackers' demands, usually an exchange of untraceable Bitcoin, are increasing.

"Ideally we wouldn't pay or we'd negotiate down a lot," says Mr Siegel, "but we recognise that when a company needs to pay - and it's a large number - then that's what needs to happen, and that can be seven figures.

"Everybody recognises that this is not a good outcome but you're dealing with the life or death of a company."

The most infamous ransomware virus was called WannaCry and infected 200,000 computers in at least 150 countries, including causing notable disruption to the National Health Service in the UK.

Since then ransomware attack numbers have actually declined significantly.

Cyber Security vendor Trend Micro estimates that numbers could have dropped 91% in the past year. But data from many other vendors points to a rise in more targeted attacks, where companies and organisations, instead of individuals, are in the cross-hairs.

Researchers at cyber-security company Malwarebytes say that compared to the same time last year, business detections of ransomware have risen more than 500%.

Back at Norsk Hydro, Mr De Vliegher said he tries not to think of the hackers and takes no satisfaction in knowing he foiled their plans.

"I think in general it's a very bad idea to pay," he says. "It fuels an industry and it's probably financing other sorts of crime. It goes against our company values and we have good foundations and good people.

"But I understand why, for some companies who are less secure, this can be the only option."

His words are echoed by Europol's head of the European Cybercrime Centre, Steven Wilson.

"Companies need to understand that if you continue to pay a ransom it perpetuates the crime," he says. "It encourages the criminals to commit further crimes.

"If you pay, you're fuelling organised crime on a global basis."

Follow Technology of Business editor Matthew Wall on Twitter and Facebook

# data[].attributes.attachment_link.title
How a ransomware attack cost one firm £45m

# data[].attributes.attachment_link.description
When malicious hackers disable your business and demand a ransom, should you pay up? Many firms do out of desperation, turning to intermediaries to help broker the deal. But law enforcement says this just makes things worse. Imagine the excitement when hackers gained a foothold in the computer system of Norsk Hydro, a global aluminium producer.

# data[].attributes.body
about cryptography/encryption with a small evaluation afterwards

# data[].attributes.attachment_link.title
AnswerGarden " What keywords/themes do you link with encryption?

# data[].attributes.attachment_link.description
AnswerGarden is a new minimalistic brainstorm tool for online brainstorming, real time audience participation and classroom feedback.

# data[].attributes.body
Wait for the presenter to share the invite code!