Darktrace Blog

The best signature move: Detecting ransomware without any signatures at all

Across Darktrace’s global customer base, ransomware is rapidly on the rise. And unlike the indiscriminate ransomware worms — like WannaCry and BadRabbit — that we’ve discussed in the past, the trend of today’s attacks is toward selective “big game hunting.” The Ryuk ransomware incident I blogged about last month demonstrates how criminals now seek to exploit the particular vulnerabilities of their strategic targets.

Despite the increasing sophistication of these attacks, however, detecting them is ultimately just a classification problem — albeit a highly complex and consequential one. To understand what makes this problem difficult, consider three ways of identifying ransomware. The first and most common way is to cross-reference new activity with the digital ‘signatures’ of known malware strains, catching attacks that the security community has already catalogued. Of course, such fixed signatures are blind to the novel malware variants that dominate the modern threat landscape.

The second level uses supervised machine learning, which entails training an AI on lots of historical examples of ransomware attacks in an attempt to find their commonalities. While this approach can, in theory, detect ransomware that isn’t identical to training data, the supervised learning approach is essentially just signatures on steroids, failing to flag malicious behavior that is fundamentally unlike anything seen before. Rather, addressing the ransomware epidemic once and for all requires unsupervised machine learning. By understanding how each particular employee and device functions while ‘on the job’ — without any signatures or training data — Cyber AI does just that.

An education in ransomware

When a world-leading education institution was hit with a strain of the Dharma ransomware family this past October, Darktrace Cyber AI immediately alerted on the attack using this learnt knowledge of the institution itself — rather than with signatures. The following timeline details each phase of the incident:

Figure 1: An overview of the attack.

In summary, the threat-actors brute-forced their way into the institution’s network by exploiting a server that lacked protection against such RDP brute-forcing — compromising an admin’s credentials. They then proceeded to scan the network until they located an open port 445, whereupon they moved laterally using the PsExec tool that allows for remote administration. The initially compromised server copied the ransomware, named “system.exe,” to hidden SMB shares on the other machines via the SMB protocol. Finally, that ransomware began encrypting data on all of these devices.

Cyber AI traced every step of the above attack by contrasting it with the institution’s normal online behavior. The graph below shows the infected server’s activity throughout the entire incident.

Figure 2: Every colored dot represents a high-confidence Darktrace alert indicating significantly anomalous activity.

Beyond just detecting the attack, however, Darktrace’s AI Autonomous Response tool, Antigena, would have taken targeted action to neutralize it within seconds. When hit with machine-speed threats like ransomware, human security teams need such AI tools to contain the damage, as Antigena would have done:

An alternate reality with Autonomous Response

The attack would have gone quite differently had it been met with Autonomous Response. To start with, Antigena would have blocked the threat-actor’s repeated login attempts over RDP, since these attempts originated from external IP addresses that had never communicated with the organization before. Antigena works by enforcing the normal ‘pattern of life’ for each impacted user and device, meaning that it would not have blocked IP addresses that regularly communicate with the RDP server. This ensures that activity necessary to daily operations isn’t interrupted during even serious threats.

Figure 3: Darktrace alerts on one of the multiple unusual IP addresses that attempted brute-forcing.

By this point, the threat would already have been neutralized by the blocked brute-forcing. But had the attackers somehow still managed to scan the network for open SMB services, Antigena would have intervened once again to surgically restrict that behavior, as Darktrace recognized that the infected server almost never scanned the internal network.

Figure 4: Darktrace alerts on the anomalous scanning behavior, which Antigena would have autonomously blocked.

Continuing on with the hypothetical, though, the server now employs PsExec to move laterally to other devices — activity that Darktrace identified as anomalous immediately. Antigena would have escalated its response at this point, stopping all outbound connections from the server for several hours. Ultimately, Autonomous Response would have completely disarmed the threat, as it has successfully demonstrated on millions of occasions already.

Uncovering the Unpredictable

It has never been easier for threat-actors to devise novel ransomware strains and to gain access to new command & control domains. Using fixed signatures, IP blacklists, and predefined assumptions is therefore insufficient, since no security tool can predict the next fundamentally unpredictable attack. Only Cyber AI — which learns what’s normal for each unique user and device it defends — is equipped for such a challenge.

Of course, detection alone won’t cut it. Modern ransomware is increasingly automated; in this particular case, the entire incident took less than two hours, from the initial brute-forcing to the concluding encryption. And although Darktrace alerted on the threat in real time, the security team was occupied with other tasks, leading to a compromise. That’s where Autonomous Response has become business-critical across every industry — it’s on guard 24/7, even when the security team can’t be.

To learn more about how Autonomous Response neutralizes ransomware without relying on signatures, check out our white paper: Darktrace Antigena: The Future of AI-Powered Autonomous Response.

• Share on Facebook
• Tweet
• Share on LinkedIn
• Send email

Leakproof by law: Previewing the 2020 data protection landscape

From credit card details and medical records, through to private conversations and even dating preferences, the modern consumer entrusts an unprecedented number of organizations with their most sensitive information, hoping against hope that it will be stored on the digital equivalent of Fort Knox. The reality, however, is that robust data privacy has thus far proven elusive. Almost 13 billion records were breached over the last two years — including from Facebook, Google, and the US Postal Service — demonstrating once again that no network perimeter can keep motivated attackers at bay.

For governments whose principal responsibility is to safeguard their citizens, implementing a strong data protection regime is therefore as challenging as it is critical. At a time when cyber-criminals find vulnerabilities in the most ostensibly airtight systems, these regulators have tended to shy away from mandating concrete security practices, since no one can anticipate which measures will repel the next unpredictable attack. Instead, most data protection laws default to ambiguous calls for “reasonable,” “adequate,” or “appropriate” cyber defenses — language that arguably renders any breached company noncompliant by definition.

While such ambiguity makes prediction pieces like this one speculative to some extent, the coming year will almost certainly witness both an increase in data protection laws around the world as well as a less forgiving interpretation of their requirements. Ultimately, as governments attempt to address growing public concern over data privacy, the mere fact of having suffered a breach could be seen as grounds for significant fines. Avoiding these fines — and doing right by one’s customers — entails assuming that the bad guys will inevitably get past the perimeter.

Figure 1: Noncompliance penalties are only getting larger as the 2020s near. Data source: CSO.

GDPR goes global

The EU’s adoption of the General Data Protection Regulation (GDPR) in April 2016 was the watershed moment in the history of data protection legislation. Its enumeration of individual privacy rights, its 72-hour breach notification requirement, and its broad data protection directives continue to serve as a blueprint for countless others, such as Brazil’s General Data Protection Law (LGPD), Thailand’s Personal Data Protection Act (PDPA), and the California Consumer Privacy Act (CCPA). All three of these regulations become enforceable in 2020, with major ramifications for companies worldwide.

Brazil’s law, which will go into effect on August 15, 2020, is modeled closely after GDPR. Like GDPR, the law applies to all companies that handle the personal data of any of Brazil’s 210 million residents — regardless of where these companies themselves are headquartered. Also like GDPR, of course, the LGPD’s security clauses are open to interpretation. The law compels data handlers to “adopt security, technical, and administrative measures able to protect personal data from unauthorized access,” taking into account “the current state of technology.”

The PDPA in Thailand — effective starting on May 27, 2020 — is similarly vague in mandating unspecified security measures. It parts company, however, in that violators face the possibility of criminal prosecution and even imprisonment for up to one year, in addition to civil damages. Organizations classified as Critical Information Infrastructure (CII), including banks, telecoms, utilities, and hospitals, are regulated under Thailand’s separate Cybersecurity Act and its slightly more detailed obligations.

Figure 2: New GDPR-inspired laws like Brazil’s will turn this map increasingly blue. Image source: DLA Piper.

In California, meanwhile, the CCPA will enforce noncompliance penalties of up to $750 per consumer per incident beginning on the first day of 2020, which could result in multibillion-dollar fines in the case of large-scale breaches. Such precise provisions indicate that GDPR-style legislation is more than a symbolic step toward data protection. And yet, as of August 2019, only 2% of companies reported that they were fully compliant with CCPA, perhaps because, according to a state-commissioned study, California firms will be forced to shell out $55 billion on just their initial compliance efforts.

Checkmate for checkbox compliance

Between the hundreds of data protection fines levied under GDPR and analogous laws, the common thread is that penalized companies are deemed to have suffered a preventable breach. For instance, in the aftermath of the 2017 Equifax compromise that exposed the personal information of more than 140 million consumers, the company was found to have been in violation of the FTC Safeguards Rule, which compelled it to adopt security measures “appropriate to [the] size and complexity” of its digital infrastructure. The US government concluded that the incident was “entirely preventable” had Equifax performed a “routine” security update on the impacted database — an oversight that precipitated at least $1.4 billion in total damages.

However, a closer inspection reveals challenges far deeper than just a simple oversight. Equifax did indeed scan its network for vulnerabilities, but the automated scanner it used was not properly configured to search all of its assets. The truth is that these kinds of misconfigurations and blind spots are a symptom of the conventional approach to cyber security itself, an approach reliant on humans to adjust and monitor a vast array of siloed security tools. In the context of cloud environments designed to be dynamic and IoT devices that are often unbeknownst to the security team, there is nothing routine about defending the “size and complexity” of the modern enterprise.

The upshot of all these new laws, requirements, and fines is that the days of mere checkbox compliance are over. Breached companies can no longer throw up their hands and point to the list of perimeter security tools they had in place, particularly because attackers largely exploit user errors and misconfigurations that — while inevitable — also appear preventable in a vacuum. Rather, to achieve compliance in 2020, human teams need artificial intelligence to make sense of their dynamic digital estates. By learning how each unique user and device normally functions while ‘on the job’, such Cyber AI detects threats that are already inside the perimeter — before they cost the company in court.

To learn more about how Cyber AI tackles the complexity of the modern enterprise, check out our white paper: Machine Learning in the Age of Cyber AI.

• Share on Facebook
• Tweet
• Share on LinkedIn
• Send email