Tahadhari: Virusi vya Trojan katika mfumo mpya

Complex · 2014-07-27T20:12:42+00:00

News Trojan virus secretly uses Tor network to hide bitcoin extortionist July 27, 2014 10:44 AFP Photo / Hoang Dinh Nam An unusual ransomware Trojan, discovered by cybersecurity experts last month, is the first of its kind to secretly use a Tor anonymizing network to hide its communication with a command-and-control server. Ransomware is a malicious program that takes control of some functions of a computer and demands payment in exchange for giving it back. Some of them claim to be software used by law enforcement investigating the victim for possession of child pornography or pirated content and require a 'fine' to be paid. Others don't bother with such niceties and simply demand ransom. Often ransomware searches the computer for files valuable to the user like databases, photos or documents and encrypts them, so that they can no longer be read. Last year CryptoLocker ransomware trojan made waves across the world, netting its criminal operators millions of dollars in bitcoin ransoms before its command-and-control servers were busted in May 2014 by the FBI. In June, a new sample of such encryption malware called Critroni was discovered, and some cybersecurity experts call it a new generation of ransomware. Critroni is not a variant of previously known ransomware but rather a new development, which uses some techniques never before encountered in such computer viruses, reported the cybersecurity firm Kaspersky Lab, which analyzed Critroni's code. Critroni ransom demand screen. (Image from Kaspersky Labs) This encryption malware is the latest generation of trojan ransomware. The authors used some techniques tested by numerous previous viruses, like the demand to pay ransom in binconis, but also some solution absolutely new for this class of malware, said Fyodor Sinitsin, chief analyst at the lab. This is one of the most dangerous current cyber threats and one of the most sophisticated ransomware programs known today. The most unusual feature of Critroni (also dubbed Onion by Kaspersky Lab and named CTB-Locker or Curve-Tor-Bitcoin Locker by its author) is its use of a Tor anonymizing network to communicate with its command server. The malware has to send an encryption key to the criminal and receive the ransom figure for the extortion scheme to work. Other kinds of malware are known to utilize the protection offered by Tor to hide the attacker, but Critroni is the first ransomware to do it. And its the first malware to have Tor code embedded into its own files rather than using the legitimate Tor software to establish the communication. The ransomware also has a unique encryption scheme to lock the user's files. It first compresses them and then uses an encryption algorithm called ECDH (Elliptic Curve Diffie-Hellman). Unlike the combination of AES and RSA algorithms most popular among ransomware authors, ECDH would not allow the encrypted data to be rescued, even if the virus communication with its command-and-control server is intercepted. The initial versions of Critroni only had an English language interface, but some of the latest updates added not only a threatening countdown clock that tracks how much time is left to pay up before the 72 hour deadline is reached, but also a Russian-language version of the ransom demand. The majority of infection reports also came from Russia and Ukraine. These facts make Kaspersy Labs believe that the authors of the trojan must be from the former Soviet Union. Critroni ransom demand screen in Russian. A timer counts down to payment deadline. (Image from Kaspersky Labs)

Thread starter Complex
Start date Jul 27, 2014

Complex

JamiiForums uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.

Accept Learn more…

Back

Top Bottom

Forums

New posts

Tahadhari: Virusi vya Trojan katika mfumo mpya

Complex

JF-Expert Member

Our Community

Regional Communities