Partnered With:

Bitcoin as ransom, WannaRen ransomware attacks again

Read this article in 11 Minutes

Why does ransomware always favor bitcoin?

Original title: "bitcoin as ransom, WannaRen ransomware hits again!"
Program life (ID: coder_life)

Author: ma chao coordinating editor: hu weiwei

Recently, a new type of bitcoin ransomware virus named WannaRen appeared on the Internet. Similar to the previous "WannaCry" virus, "WannaRen" virus will enter the computer and encrypt almost all the files in the system.

Currently, there are two variants of WannaRen, one that sends ransomware via text and the other via pictures. Unlike the previous generation of ransomware virus WannaCry, which combined with the eternal blue vulnerability to spread rapidly in the Intranet, WannaRen ransomware virus did not take advantage of RDP, SMB and other high-risk vulnerabilities to spread actively. As a result, WannaRen's destructive power is relatively limited, but it does not rule out that subsequent variants of the virus will use the "eternal black" series of vulnerabilities for Intranet penetration attacks. According to the latest reports, the open source editor Notepad++ download link provided by a well-known download website in China was found to be tied with the code associated with WannaRen, making the ransomware may be through the domestic download station for a second outbreak.

The author by viewing the WannaRen viruses use COINS blackmail address 1 nxtgfgprvktuokv3zlhgcpcjckjxbswam, view the attackers use the wallet, there is no a ransom is paid. Fortunately, the authors of WannaRen have voluntarily released the decryption key and released a non-toxic decryption tool, but the effectiveness of the decryption tool has not been verified.

At present, WannaRen virus is only available in Chinese, so the author estimates that it is no problem that it is a domestic virus. The large-scale spread of WannaRen mainly relies on the way of forging other tools and software to cheat the download.

Why does ransomware always favor bitcoin?

The surge of bitcoin in 2017 is directly related to the global outbreak of WannaCry ransomware. WannaCry has infected at least 150 countries and 300,000 users, causing a loss of 8 billion us dollars worldwide, affecting many industries such as finance, energy and healthcare, and causing a serious information security crisis. In China, WannaCry makes use of the characteristics of the horizontal dissemination of the Intranet, so that the campus network bears the brunt of the serious damage, a large number of laboratory data and graduation project is locked and encrypted. Many tech institutions have bought bitcoins to pay a ransom to retrieve the data files. However, due to the limited capacity of bitcoin blockchain transactions, the maximum number of transactions per second is no more than 10, and the sudden trading volume brought by WannaCry is also believed to be one of the factors that caused the bitcoin blockchain network to split.

But WannaCry is notorious for not being able to recover damaged files even after paying a ransom. And this isn't the first time bitcoin has been used by hackers. CryptoLocker, which appeared in 2013, is the creator of the bitcoin ransomware. CryptoLocker will be disguised as a legitimate email attachment or. The private key is held on a server controlled by the CryptoLocker producer. If bitcoin is paid within a specified period, the files can be decrypted; otherwise the private key will be destroyed and the damaged files will never be recovered. So at this point CryptoLocker than WannaCry is also a thief, at least to collect money to help users recover files.

I see a lot of online articles are called WannaCry and CryptoLocker blackmail virus chose COINS, because of the currency trading is untraceable, but this theory is that the comparison, the currency is essentially a distributed books, everyone can like the author through extortion currency to address its trading information to find, so the currency is traceable.

The anonymity of bitcoin accounts is what makes them so widely used by hackers. The emergence of bitcoin, especially its anonymity, has also posed new challenges to the anti-money laundering objectives of the regulation. The regulatory approach for the existing real-name financial account system certainly does not apply to bitcoin. The lack of anti-money laundering regulations is also the main reason why hackers currently prefer bitcoin as a ransom.

Ransomware trends

Virus also open source: the second half of 2015, the Turkish security experts Utku Sen on the lot released named Hidden Tear open source virus (https://github.com/utkusen/hidden-tear)

The appearance of Hidden Tear is of great significance. It is only 12KB in size. Although the volume is small, it has all kinds of features. Although author Utku Sen has repeatedly stressed that the software is intended to help people learn more about how ransomware works, it has caused a lot of controversy as an open-source version of ransomware. The project is currently hidden on Github, but you can still get the source code by sending a request to the author. After reading the source code of the ransomware Hidden Tear, the author suddenly realized that the original ideas and methods of programming are really different, and destructive thinking and constructive thinking are totally different styles. It can be said that the appearance of Hidden Tear objectively makes the ransomware virus get a great development.

The virus also went commercial: a ransomware package called Tox, also launched in 2015, lets anyone create ransomware by signing up for a service that displays the number of infections, the number of ransoms paid, and the total revenue. However, The popularity of virus exploit kits, especially after The Shadow Brokers released The tools of The equation hacker group, made The vulnerability attack tools widely used by hackers, and ransomware was widely spread. The combination of a destructive virus and the spread of worms not only extorts a lot of money, but also wreaks havoc on a global scale. At this stage, ransomware has shown a trend of industrialization and continuous operation. In the whole chain, each link has a clear division of labor. A complete process of a ransomware attack may involve the ransomware author, the ransomer, the distribution channel provider, the agent, and ultimately the profit.

Anti-virus tips

1. Close high-risk port 445: we see that security vulnerabilities such as eternal blue used by WannaCry are all vulnerabilities using the SMB protocol, spreading wildly in the LAN, that is, as long as the virus attacks a machine under the same WIFI, then other computers will also be affected. Closing port 445 is the most effective response.

2. It is recommended to enable the built-in document guardian function of tencent computer butler and tencent royal point: this function can use the redundant disk space to automatically backup data, in case of ransomware virus damage, there is still a chance to recover the loss. 3. Update the patch in time: running Windows update repair patch is also an effective way to protect.

Is the so-called devil high one late, way high ten zhangs, according to the author's observation, in the information security side of the dominant defensive situation, is slowly changing with the situation, so the industry also needs to attach great importance to the new trend in security, in case of novel coronavirus tragedy in the IT world.

Source link:weixin.qq.com