CryptoLocker: What is it? And how do you protect against it?

Share

Britain’s National Crime Agency (NCA) has issued an “urgent alert” to computer users about the threat posed by the CryptoLocker malware.

NCA alert on CryptoLocker

The NCA’s National Cyber Crime Unit has warned that online criminals have launched a major internet attack designed to hold victims’ computer data hostage, and demand a ransom of hundreds of pounds be paid.

The cybercops’ alert warns that the CyberLocker ransomware – which encrypts computer files and demands a ransom be paid for the decryption key – has been distributed via spammed-out emails claiming to come from banks and financial institutions.

Last week, US-CERT issued a similar warning to American computer users.

What types of computers does CryptoLocker target?
CryptoLocker targets computers running versions of Windows. Mac computers are not affected.

How is CryptoLocker spread?
CryptoLocker isn’t a virus or a worm, it’s a Trojan horse. That means – like most malware seen today – it can’t travel under its own steam, and doesn’t self-replicate.

Instead, CryptoLocker is typically distributed via spammed-out email messages, perhaps claiming to come from your bank or a delivery company. If you click on the attached file (which might pretend at first glance to be a PDF file, but actually use the .PDF.EXE double extension trick to hide its executable nature), your computer becomes infected.

Of course, it’s possible the criminals behind CryptoLocker could also distribute it in other ways. For instance, by compromising websites with malicious exploit kits that take advantage of software vulnerabilities to install CryptoLocker on visiting computers.

What files does CryptoLocker encrypt?
Once your computer is infected, CryptoLocker hunts for files to encrypt. It doesn’t just on your hard drive, but on any connected drives, including mapped network shares, and even folders that you might sync up with the Cloud – such as DropBox.

Filenames which match the following patterns are encrypted by CryptoLocker:

????????.jpe, ????????.jpg, *.3fr, *.accdb, *.ai, *.arw, *.bay, *.cdr, *.cer, *.cr2, *.crt, *.crw, *.dbf, *.dcr, *.der, *.dng, *.doc, *.docm, *.docx, *.dwg, *.dxf, *.dxg, *.eps, *.erf, *.indd, *.kdc, *.mdb, *.mdf, *.mef, *.mrw, *.nef, *.nrw, *.odb, *.odc, *.odm, *.odp, *.ods, *.odt, *.orf, *.p7b, *.p7c, *.p12, *.pdd, *.pef, *.pem, *.pfx, *.ppt, *.pptm, *.pptx, *.psd, *.pst, *.ptx, *.r3d, *.raf, *.raw, *.rtf, *.rw2, *.rwl, *.sr2, *.srf, *.srw, *.wb2, *.wpd, *.wps, *.x3f, *.xlk, *.xls, *.xlsb, *.xlsm, *.xlsx, img_*.jpg

So, you may well be saying goodbye to your documents, your databases, your photographs, your PowerPoint slides, your spreadsheets, and much else besides.

Will I see anything on my screen to tell me I’ve been hit?
Only when it’s too late.

After files have been encrypted, CryptoLocker displays a message that demands you electronically send the ransom payment (options may include Bitcoin, MoneyPak cashU, or UKash) in order to decrypt the files.

CryptoLocker message

Your personal files are encrypted!

Your important files encryption produced on this computer: photos, videos, documents, etc. Here is a complete list of encrypted files, and you can personally verify this.

Encryption was produced using a unique public key RSA-2048 generated for this computer. To decrypt files you need to obtain the private key.

The single copy of the private key, which will allow you to decrypt the files, located on a secret server on the Internet; the server will destroy the key after a time specified in this window. After that, nobody and never will be able to restore files…

To obtain the private key for this computer, which will automatically decrypt files, you need to pay 300 USD / 300 EUR / similar amount in another currency.

Click <<Next>> to select the method of payment and the currency.

Any attempt to remove or damage this software will lead to the immediate destruction of the private key by server.

CryptoLockerA 72 hour timer is displayed, which ticks down and explains that if you do not pay the ransom demand, your files will be permanently inaccessible and impossible to ever decrypt.

The clock is ticking…

MoneyPak? Bitcoins? Can’t I pay the CryptoLocker ransom with a credit card instead?
No, the criminals don’t give a credit card option.

One of the reasons is presumably because it would be easy for victims to “pay” the ransom using their credit card to have their files decrypted, and then use chargeback to claw back their money.

Of course, many people may not know how to send funds via Moneypak or Bitcoin – a possible stumbling block for the criminals.

So if I don’t pay the ransom in time, all of my data is lost?
Not quite. The first hope has to be that you have kept regular backups of your important data, separate from your computer, and that you can restore your system from them. If you weren’t keeping backups, then please learn something from this horrible experience.

Secondly, and I don’t recommend you take this this option, it has been reported that the criminals are now giving victims the ability to pay the ransom *after* the deadline has passed, and get their files decrypted that way.

Decryptor

This service allow you to purchase private key and decryptor for files encrypted by CryptoLocker.

If you already purchased private key using CryptoLocker, then you can download private key and decryptor for FREE.

Regardless of whether you approve of encouraging blackmailers by paying the ransom or not, the fact that this late decryption service is only accessible via TOR, and not the conventional web, probably puts it beyond the reach of typical computer users.

Can’t anti-virus software remove CryptoLocker and save my data?
Good anti-virus software should be able to detect and remove CryptoLocker – however, removing CryptoLocker isn’t the same as decrypting your data files. And anti-virus software cannot unscramble your data.

If you do remove a CryptoLocker infection you won’t be able to pay the ransom to have your files decrypted.

Fascinatingly, the criminals behind CryptoLocker anticipated this, and change the Windows wallpaper on infected computers to explain how users can download and reinstall CryptoLocker!

Cryptolocker wallpaper

CryptoLocker

Your important files encryption produced on this computer: photos, videos, documents, etc.

If you see this text, but do not see the “CryptoLocker” window, then your antivirus deleted “CryptoLocker” from computer.

If you need your files, you have to recover “CryptoLocker” from the antivirus quarantine, or fine a copy of “CryptoLocker” in the internet and start it again.

How do you protect against CryptoLocker?
Cryptolocker is a serious threat. If you’re unlucky enough to have your computer infected by it, and haven’t taken precautions, you may find yourself in the unpleasant situation of having to choose whether to pay the ransom, or never gain access to your data again.

That means you’re saying goodbye to your family photographs, and any other personal data you have amassed over the years. If you’re a business then the potential losses could be even more significant.

The answer is three-fold.

Firstly, protect your computer from becoming infected by keeping it up-to-date with anti-virus and security patches. Also be cautious of opening unsolicited email attachments or clicking on unknown links. If you are security savvy you can reduce the chances of being hit by a threat like CryptoLocker.

Secondly, consider setting a software restriction policy on your Windows PCs that prevents executables from running from certain locations on your hard drive.

Finally, for goodness sake, make backups of your important data and keep them separate from your computer (to prevent malware like CryptoLocker from encrypting your backups as well) That way, if the worst does happen, you should be able to restore your valuable data and not pay up to the crooks.

Further reading
To learn much more about CryptoLocker, and how you should respond to it, I recommend you check out the FAQ from BleepingComputer.

Have you encountered CryptoLocker? Share your thoughts and experiences by leaving a comment below.

Share

Tags: , , ,

, , ,

23 Responses

  1. Manjusri November 18, 2013 at 5:58 am #

    check out CryptoPrevent
    http://www.foolishit.com/vb6-projects/cryptoprevent/

  2. AJ North November 18, 2013 at 4:57 pm #

    Surf Right's companion to their HitmanPro, a free application named HitmanPro.Alert is now in stable beta with an added component they call 'CryptoGuard' designed to inoculate against encryption ransomware — http://www.surfright.nl/nl/alert/cryptoguard .

  3. Ilias November 19, 2013 at 8:36 am #

    Given that somebody had a partial backup, wouldn't be possible to make a known plaintext attack on particular files and derive the RSA key? It may require time probably but is it possible?

    • Phil November 19, 2013 at 10:42 am #

      It seems that this particular malware fiendishly generates a unique AES256 key for every file, encrypts the file using this new key and then encrypts the unique key with the master key and stores it. You'd need a LOT of time.

  4. Keith November 19, 2013 at 1:02 pm #

    Got hit by this Ransomware this morning on my works PC after opening an email in Hotmail that supposedly came from my local council. Subject was BACS Remittance and the attached file was DFA_15113_1_email.zip
    My Company IT group have taken away but it appears a network drive has corrupted that I clicked on before the window appeared.
    Dreading the consequences if this has got on my Home PC & NAS. 30 Years of memories.

  5. Tim November 19, 2013 at 7:00 pm #

    would be helpful to have said that Linux PCs are not
    affected…

    • Graham Cluley
      Graham Cluley November 20, 2013 at 1:55 pm #

      Sorry, for not being clear.

      Right now, CryptoLocker is only affecting Windows computers.

      Computers running flavours of Unix, Mac OS X, iPhones, iPads, Android, BlackBerrys, Nokias, Windows Phone, and internet-enabled fridges (imagine your groceries being encrypted and taken hostage) are not impacted.

      Of course, if the bad guys make a good deal of money out of CryptoLocker we might see future incarnations (or malware written by other criminals) impacting other platforms… although I suspect your fridge is probably safe.

      • ben December 2, 2013 at 11:46 pm #

        so how long would my macbook be safe for

        • Graham Cluley
          Graham Cluley December 3, 2013 at 7:20 am #

          Current versions of CryptoLocker don't infect Macs, just Windows.

          Of course, there is other malware which *does* infect Macs – so make sure you are running a good anti-virus.

      • Steve February 17, 2014 at 12:05 am #

        Stop using Win the only reasonable solution. MS should suffer a lot. If win were properly secured from inside out that wouldn't be possible ai ? But 3dt party security solution only kills hardware performance but offering false security.

  6. hujorgen November 20, 2013 at 2:23 am #

    I own and run a one man computer business in central MN. I
    am not an expert but wanted to add some experience that
    I've had recently with what I think is CryptoLocker or a
    clone of it. In both cases (1 Vista and 1 XP I think) I was able to
    remove the infection by booting with the HitmanPro trial from a USB
    flash drive. Both systems had the same graphics and desktop
    wallpaper image, both had the countdown timer. One was down to ~68
    hours and the other was ~48 hours. I didn't know about
    this Malware and just attacked it as normal with Hitman booted from
    a flash drive, ComboFix and Malwarebytes after booting clean.
    Anyone else been able to disable/remove this? Hu

    • justmebeingme November 20, 2013 at 4:41 pm #

      Its my understanding that you can remove it, but that they
      will still keep the files hostage. Were you able to retrieve the
      files after removing it with hitman?

  7. JB November 26, 2013 at 1:55 pm #

    All those people running W7 Home Premium are left without a means to set up policies to prevent CryptoLocker? Unless they run a 3rd-prty application which of course they should trust because…(it's not CryptoLocker … is it?)

    how can local policies be set up in W7 Home Premium without a policy editor … are the registry settings for the above policies available? would the registry have to modified on a per-user basis?

  8. Tomi Bozur December 4, 2013 at 8:20 pm #

    Hello!
    Maybe there's a simple solution, we have not tested ourselves but it could work.

    WINDOWS 7, right click on the folder that is encrypted and select properties> then go to the tab previous versions in properties you will see an earlier version of the folder that your computer has been saved. Then you can simply choose one from the day before you got the virus, and then click the Copy button, make a new folder and copy your work in the new folder – you will get back almost all your files unencrypted, maybe not the last job you have done, but most will be there.

    Myzone Team Sweden

  9. Db December 5, 2013 at 4:35 am #

    If you have already encrypted your files with bit locker, is crypto locker still able to encrypt your files?

    • Tom December 16, 2013 at 11:06 pm #

      Yes. BitLocker encrypts your HDD so if someone stole your
      laptop and didnt know your computer password…your data is safe.
      However cryptolocker encrypts files after the OS is booted thus has
      access to the your files. In a nut shell, the files get encrypted
      twice. Once by you and once by the virus.

  10. gawdelpus December 22, 2013 at 7:18 am #

    What about System restore, back to before the infection ?
    after you have removed the offending trojan of course :) cheers ~
    JD

  11. Alan Ladde December 22, 2013 at 12:21 pm #

    That's it! I am now switching all my PCs to Linux
    (Mint 13 LTS). Bye-bye Windoze.

    • Steve February 16, 2014 at 11:57 pm #

      Damn Microsoft not securing Windows from inside out isolated app spaces sandboxes user secure user space and so on all that is missing in win. Tech available but MS simply does not want to do it so their 3dt party partners making huge money on insecure win fixing holes in win that ms left open and so on but user have even more problems. MS should suffer a lot.
      For home computer one do not need win use Linux or similar for internet ! If you have powerful hardware then use SmartOS and Win as guest for playing games for internet i recommend some Linux Distro at choice. Why SmartOS ? Its a hypervisor OS and one have backup the whole OS at fingertips of the mouse click ! Something that MS misses to implement ! I too will replace Win with other OS but for specialized work there is no replacement for it. So the best what you can do is cut of network/internet from such computer and pas data/files to it manualy trough USB HDD or flash.

      MS should suffer a lot. Did you know that NSA is heavily involved in win development and even financially support MS as long they obey NSA directive. And now use Win for serious work.

  12. Mike Wood December 23, 2013 at 11:27 pm #

    How about disabling the EFS service, or Bitlocker service,
    or both as a prevention?

  13. Jen December 23, 2013 at 11:40 pm #

    Hi how can I remove the cryptolocker?

  14. Cthulu December 24, 2013 at 8:52 pm #

    Hmmm…. maybe I'm a cynic, but try this on for
    size? Cryptolocker is coded by GCHQ/NSA whoever and floated out
    onto the web…. mass media do their best to stoke up fear and
    pandemonium within the World internet
    "unintelligensia"…. the authorities pinpoint
    the source of the problem as "the dark web" or
    whatever other ominous name said press has coined for those who
    refuse to be spied on by their "democratic
    governments"…. the uneducated masses urged on by the
    mind control machine"…. sorry mass media then clamour
    for a timely crackdown on the unfettered criminality of those
    "freedom fighters" and introduce more draconian
    legislation to protect the wealth of the "super
    elites". As David Eike puts it… Problem – reaction -
    solution. Pass me my tin foil hat…they're out to get
    me….

  15. Robert Marchais December 29, 2013 at 6:58 pm #

    Ooh "Cthulu," the lizard men from outer
    space have encrypted my data! I'd better call David Icke,
    son of God, psychic, and noted computer security expert, to recover
    my files. ;)

Leave a Reply