Crypto Gone Rogue - A Tale of Ransomware, Key Management, and the CryptoAPI

Explore the evolution of ransomware key management and its interaction with the Windows CryptoAPI in this 26-minute conference talk from GrrCon 2018. Delve into the necessary elements of ransomware, the importance of key management, and its progression over time. Examine the relationship between Windows, ransomware, and the native CryptoAPI, using NotPetya as a case study. Learn about crucial CryptoAPI calls, including CryptAcquireContext, CryptEncrypt, CryptImportKey, CryptDestroy, and CryptReleaseContext. Gain insights into ransomware design and draw valuable conclusions about the intersection of cryptography and malicious software.

Syllabus

Intro
Necessary Elements of a Ransomware
Why Key Management?
Evolution of Key Management
The Windows
Ransomware and the
Why Use the Native
NotPetya Ransom Message
List of Imports
CryptoAPI Calls
CryptAcquire Context
CryptEncrypt
CryptimportKey
CryptDestroy
CryptRelease Context
Ransomware Design
Conclusion