Feeds

Fiendish CryptoLocker ransomware survives hacktivists' takedown

Proper post-op analysis would have killed it for good, says ex-rozzer

The Essential Guide to IT Transformation

An attempt by security researchers to take down command and control nodes associated with the infamous CryptoLocker malware appears to have been unsuccessful in its ultimate aim of putting the Bitcoin-hungry crooks behind the scam out of business.

Activists from the group Malware Must Die put together a list of scores of domains associated with communications channels for the malware, which encrypts files on infected machines before demanding a ransom of up to 2 BTC (worth just over $2,000 at the time of writing), before beginning a takedown operation on Sunday (1 December).

Most of the 138 targeted domains were suspended but failed to kill off CryptoLocker, which was quickly resurrected, according to anti-botnet firm Damballa.

Adrian Culley, a former Scotland Yard detective turned technical consultant at Damballa, said that the take-down effort might have been more successful with post-takedown analysis.

"It is no surprise that the announcements of the death of CryptoLocker appear to have been somewhat premature. An essential part of the process is post-takedown analysis, which may turn out to be a post-mortem, or a triage of the zombie remnants of a botnet, or may indeed confirm that the botnet is very much still alive and kicking."

"It is essential to undertake this analysis post any sinkholing activity,” continued Culley, “which does appear to have happened in this instance. CryptoLocker appears to have the same resilience as many other C&C based attacks.”

“Efficient post-mortems lead to better surgery, and this is just as true of botnet remediation as it is medically," he added.

CryptoLocker normally arrives in email as an executable file disguised as a PDF, packed into a .zip attachment. A spam run targeting millions of UK consumers prompted a warning from the UK National Crime Agency last month. For now, at least, only Windows machines can be infected by the malware.

If it successful executes, CryptoLocker encrypts the contents of a hard drive and any connected LAN drives before demanding payment for a private key needed to decrypt the data. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.