Linux.Encoder.1
Linux.Encoder.1 (also known as ELF/Filecoder.A and Trojan.Linux.Ransom.A) is considered to be the first ransomware Trojan targeting computers running Linux.[1] There are additional variants of this Trojan that target other Unix and Unix-like systems. Discovered on November 5, 2015, by Dr. Web, this malware affected at least tens of Linux users.[2] Linux.Encoder.1 is remotely executed on the victim's computer by using a flaw in Magento, a popular Content management system app. When activated, the malware encrypts certain types of files stored on local and mounted network drives using AES and RSA Public-key cryptography, with the private key stored only on the malware's control servers. The malware then store a file called "readme_to_decrypt.txt" in every directory, containing a message, which offers to decrypt the data if a payment (through Bitcoin) is made.[3] Compared to other ransomware such as CryptoLocker, the malware does not state a deadline to pay and the ransom does not increase over time.
Discovery
On November 5, 2015, Dr. Web, a Russian anti-malware company added to its virus database Linux.Encoder.1. The company then published the malware description the day after. This ransomware is written in C using the PolarSSL library.[4]
Operation
Propagation
According to Bitdefender Labs, the most common infection vector is through a flaw in Magento, a shopping cart software. CheckPoint, reported this vulnerability in April 2015.[5] After this report, Magento issued a fix. However, a lot of small e-commerce sites did not apply this critical update.[6] Linux host might also be attacked using other exploits.
Files Encryption
Encrypted files
When launched with administrator privileges, the program load in memory two files containing the attackers' demands :
- ./readme.crypto
- ./index.crypto
After this the ransomware receives the public RSA key. The malware will then start as a daemon and delete all its original files. The trojan will encrypt files with the extensions : ".php", ".html", ".tar", ".gz", ".sql", ".js", ".css", ".txt" ".pdf", ".tgz", ".war", ".jar", ".java", ".class", ".ruby", ".rar" ".zip", ".db", ".7z", ".doc", ".pdf", ".xls", ".properties", ".xml" ".jpg", ".jpeg", ".png", ".gif", ".mov", ".avi", ".wmv", ".mp3" ".mp4", ".wma", ".aac", ".wav", ".pem", ".pub", ".docx", ".apk" ".exe", ".dll", ".tpl", ".psd", ".asp", ".phtml", ".aspx", ".csv".
The malicious program encrypts files with the aforementioned extensions in the following directories :
- /home
- /root
- /var/lib/mysql
- /var/www
- /etc/nginx
- /etc/apache2
- /var/log
After this, the malware will encrypt all the files from directories with a name starting by :
- public_html
- www
- webapp
- backup
- .git
- .svn
The program will not encrypt files in the following directories :
- /
- /root/
- .ssh
- /usr/bin
- /bin
- /etc/ssh
The program will then generate a file "readme_for_decryption.txt" in every folder. This file contains the bitcoin address generated specifically for the ransom and the website to download the decrypting tool hosted on a .onion website.
Encryption method
Like other ransomware, Linux.Encoder.1 use mixed-encryption algorithms to encrypt data. It first start by generating on the victim's computer an AES key and encrypt all the previous files using AES-CBC-128. Then the RSA-encrypted AES key is prepended to the beginning of every encrypted file, with the original file permissions and the IV used by the AES algorithm. All the encrypted files have ".encrypted" added at the end of their file name.[3]
The program use the libc rand() function with the timestamp at the moment of encryption as seed to generate the IV and the keys.
File Decryption
When the payment to the cybercriminal is made, the victim can download a PHP script to their computer. This script will use the RSA private key to recover the symmetric AES key and decrypt all the files with the ".encrypted" extension. Along with the file decryption, the decryption tool will also delete every "readme_for_decryption.txt" file on the hard drive.
Recovering files
Because of the use of the timestamp as a seed for creating the keys and the IV for encryption, decryption of files encrypted by the ransomware is trivial given that the original timestamp information is kept intact. Researchers at Bitdefender Labs have found and exploited this weakness to recover the files without having to pay the criminals.[3]
On other Unix systems
- Linux.Encoder.1 has been recompiled on Mac, called KeRanger.
- There is a version that infects FreeBSD.
References
- ↑ Bisson, David (November 10, 2015). "Website files encrypted by Linux.Encoder.1 ransomware? There is now a free fix". https://grahamcluley.com/2015/11/website-files-encrypted-linux-encoder-1-ransomware-free-fix/. Retrieved 2015-11-16.
- ↑ "Encryption ransomware threatens Linux users". November 6, 2015. http://news.drweb.com/show/?i=9686&c=5&lng=en&p=0. Retrieved 2015-11-16.
- ↑ 3.0 3.1 3.2 "Linux Ransomware Debut Fails on Predictable Encryption Key". November 10, 2015. http://labs.bitdefender.com/2015/11/linux-ransomware-debut-fails-on-predictable-encryption-key/. Retrieved 2015-11-16.
- ↑ "Linux.Encoder.1". November 5, 2015. http://vms.drweb.com/virus/?i=7704004&lng=en. Retrieved 2015-11-16.
- ↑ Rubin, Netanel (April 20, 2015). "Analyzing the Magento Vulnerability". http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/. Retrieved 2015-11-16.
- ↑ "Ransomware Now Gunning for Your Web Sites". November 15, 2015. http://krebsonsecurity.com/2015/11/ransomware-now-gunning-for-your-web-sites/. Retrieved 2015-11-16.
 |
