I Wrote my Own Ransomware; did not make 1 iota of a Bitcoin

No ratings

Presented at SecuriTay 2018 by

Thomas Fischer

2016 saw a substantial rise in ransomware attacks and in some cases the return of some favourites with Cryptowall, CTB-LOCKER and TeslaCrypt being some of the most popular. The volume of attacks was in fact pretty steady for a good part of the year, with regular campaigns coming out on a weekly basis. It was interesting to see the variety in mechanisms used for the ransomware which not only included self-contained binaries but went all the way to the use of scripts. As part of the research I conduct last year, I wanted to understand why such a drive and lure for ransomware outside of the victims will pay as well as have some way of properly testing "anti-ransomware" solutions with an unknown variant. So to do that, I went ahead and built my own ransomware and drew some conclusions on why it became so popular.The intent of this talk is to demonstrate why ransomware has become a tool of choice for attackers beyond the notion of victims will pay. By analysing and investigating existing ransomware and delivery methods, I outlined a framework to easily build my own version of a ransomware.