Safeguarding user data with
Kaspersky Cryptomalware
Countermeasures Subsystem

Kaspersky Lab

Cybercriminals are quick to adopt techniques developed by villains in the offline world,
including extorting money from victims. One of the most common ransomware attack
scenarios sees the user’s data encrypted before a ransom demand is delivered. Users placea high value on their data and many of them are willing to pay to get those precious files
back. However, paying the ransom is unwise, primarily because it does not guarantee thatthe corrupted data will be decrypted. At the same time modern cryptomalware uses
encryption schemes that – up to now – seem to be unbreakable, so victims face a choice
between paying up or losing those files. Of course, reliable internet security software
installed on the computer will react to malicious activity but even best antimalware solutions
successfully can only detect newly developed cryptomalware after it begins to corrupt data.
So from time to time previously unseen malware, which does not appear in any database, isable to encrypt a couple of files before being neutralized. That is why Kaspersky Lab
developed its cryptomalware countermeasures subsystem.

Cryptomalware menace
Usually cryptomalware is distributed through spam messages with executable files attachedand purporting to be documents, but it can be planted by other means. For example, there
are registered cases of cryptomalware installation made by another piece of malware — a
Trojan of the ZeuS/Zbot family.
The cryptomalware threat is increasing — Kaspersky Security Network shows that in 2013
about 2.8 million crypto-attacks were registered – that is nine time more than in 2012 – andall the evidence suggests that their number will continue to rise because many people arestill willing to pay the ransom. According to a survey, conducted by Interdisciplinary ResearchCentre in Cyber Security at the University of Kent in February 2014, more than 40% of
Cryptolocker victims agreed to pay. Moreover, Dell SecureWorks report shows that the same
malware rakes in up to $30 million every 100 days.
Furthermore, the inability to decipher files encrypted by the modern malware spawns anadditional threat — false remedy. Desperate users who lose their files search the Internet for
any help and sometimes find software that claims to “fix” encrypted data. In the best case, it
is a swindle selling a useless ‘solution’; at worst it distributes additional malware.

Evolution of encrypting malware
Criminal methods become more and more sophisticated each year. The first cryptomalware
used a symmetric-key algorithm, with the same key for encryption and decryption. Usually,
with some help from anti-malware vendors, corrupted information could be successfully
deciphered. Then cybercriminals began to implement public-key cryptography algorithms thatuse two separate keys — public, to encrypt files, and private, which is needed for decryption.
One of the first practicable public-key cryptosystems to be used by cybercriminals was called
RSA (named after Ron Rivest, Adi Shamir and Leonard Adleman, who first described thealgorithm). Back in 2008, Kaspersky Lab’s experts managed to crack a 660-bit RSA key
used by the GPCode Trojan but soon its authors upgraded key to 1024 bits, making it harderto decrypt.

1
Safeguarding user’s data with the Cryptomalware Countermeasures Subsystem
June 2014Kaspersky Lab

One of the most recent and most dangerous pieces of cryptomalware, the previouslymentioned Cryptolocker Trojan, also uses a public-key algorithm. After each computer isinfected, it connects to the command-and-control server to download the public key, so
another key, the private one, is accessible only to Cryptolocker’s authors. Usually the victim
has no more than 72 hours to pay the ransom before their private key will be deleted forever.
It is impossible to decrypt any files without this key. Kaspersky Lab’s products successfully
detect this Trojan, but if the system is already infected, than nothing can be done with thecorrupted files.

Figure 1. Cryptolocker’s ransom demand screen

Kaspersky Lab’s Cryptomalware
Countermeasures Subsystem
At present it is impossible to decipher files encrypted by modern cryptomalware so the only
countermeasure that will keep user’s data safe is file backup. But general backup, even a
regular one, is not enough, because it leaves recently changed files unprotected. That is why
Kaspersky Lab developed an alternative countermeasure, based on the System Watcher
module.
Kaspersky System Watcher analyses the most relevant system event data, including
information on the modification of files. When it registers a suspicious application attempting
to open a user’s personal files it immediately makes a local protected backup copy of them1.
1

Backed-up files should be no bigger than 10 Mb each2
Safeguarding user’s data with the Cryptomalware Countermeasures Subsystem
June 2014

Kaspersky Lab

If the application is then judged to be malicious, Kaspersky System Watcher automaticallyrollbacks unsolicited changes. Therefore, the user does not need to do anything at all about
cryptomalware — there will just be notifications updating the progress of the protection
process.

Figure 2. System Watcher finds that an application is making suspicious changes to files and warns
the user. At this moment it creates protected backup copies of files and analyses the nature of thesechangesFigure 3. The application is confirmed as malicious, and file that contains the malware is deleted.
Affected files stay encrypted

Figure 4. System Watcher replaces encrypted files with the backup copies and, when all
consequences of the cryptomalware are eliminated, System Watcher reports that all malicious actions
were successfully undone

Therefore, even if newly created cryptomalware uses a zero-day vulnerability and manages
to avoid all security systems, it will not cause any harm, because any changes it makes will
be rolled back automatically. In other words, the cryptomalware countermeasures subsystem
keeps user’s data safe and stops the indirect funding of cybercriminals, because paying theransom will only encourage them to carry on, prompting the creation of more malicious
software.

3Safeguarding user’s data with the Cryptomalware Countermeasures Subsystem
June 2014

Kaspersky LabAvailability
The Cryptomalware Countermeasures Subsystem is integrated in the System Watcher
component, which is part of the following products for home users and business:

For home users

Kaspersky Internet Security
Kaspersky Internet Security – Multi-Device (for Windows only)
Kaspersky Total Security – Multi-Device (for Windows only)
Kaspersky Anti-Virus

For business

Kaspersky Endpoint Security for Business
Kaspersky Small Office Security

4
Safeguarding user’s data with the Cryptomalware Countermeasures Subsystem
June 2014