Tracking Ransomware End to End

Black Hat USA 2017

Presented by: Elie Bursztein, Luca Invernizzi, Kylie McRoberts
Date: Wednesday July 26, 2017
Time: 17:05 - 17:30
Location: Mandalay Bay EF

A niche term just two years ago, ransomware has rapidly risen to fame in the last year, infecting hundreds of thousands of users, locking their documents, and demanding hefty ransoms to get them back. In doing so, it has become one of the largest cybercrime revenue sources, with heavy reliance on Bitcoins and Tor to confound the money trail.

In this talk, we demonstrate a method to track the ransomware ecosystem at scale, from distribution sites to the cash-out points. By processing 100k+ samples, we shed light on the economics and infrastructure of the largest families, and we provide insight on their revenue and conversion rates. With a deep dive in the two largest groups, we show the details of their operation. Finally, we uncover the cash-out points, tracking how the money exits the bitcoin network, enabling the authorities to pick up the money trail using conventional financial tracing means.

Luca Invernizzi

Luca Invernizzi is a Research Scientist in Google's anti-abuse team. His current research focuses in understanding and modeling the underground economy of abuse, and detecting malware at scale on desktop and mobile. Luca holds a Ph.D. in Computer Science from the University of California, Santa Barbara.

Kylie McRoberts

Kylie McRoberts is a senior strategist with Google's Safe Browsing where she is currently focused on binary analysis in support of enforcement of Safe Browsing policies. Before joining Google, she conducted political and military analysis for the Australian Department of Defence.

Elie Bursztein

Elie Bursztein leads Google's anti-abuse research, which invents ways to protect users against cyber-criminal activities and Internet threats. Elie helped redesign Google's CAPTCHA to make it easier, and made Chrome on Android safer and faster by implementing better cryptography. Recently he got the best paper award for his research on Secret Questions at WWW 2015 and malicious Ads injectors at S&P; 2015\. He also received the IETF Applied Networking Prize for his work on email security. Elie was born in Paris, France, wears berets, and now lives with his wife in Mountain View, California.


KhanFu - Mobile schedules for INFOSEC conferences.
Mobile interface | Alternate Formats