New ransomware employs Tor to stay hidden from security

Known as 'Onion', a new malware strain uses the darknet to encrypt user data and then demands payment for decryption. Ransomware, malicious software that encrypts user data and then demands payment for decryption, just got even stronger.


Security researchers at Kaspersky Lab report that a new strain of ransomware, called "Onion", which uses the anonymising network Tor "to hide its malicious nature, and to make it hard to track those behind this ongoing malware campaign".


The malware is a successor to the notorious Cryptolocker ransomware. When infected, Cryptolocker would scan a user's computer for documents, particularly Microsoft Office files, and then encrypt them using a secret key before demanding payment from the user.


Although the fees are high – frequently in the hundreds of pounds – and demanded through bitcoin, many users paid up in an effort to retrieve their files. In November 2013, even a US police force paid a ransom of $1338 to get their data back.


Once a computer is infected with Onion, the software encrypts the user's files, just as Cryptolocker does. It then initiates a countdown, warning users that they have 72 hours to pay up, or all files will be lost forever.


But where Onion, which researchers believe originates from Russia, differs from Cryptolocker is how it communicates with the "command and control" server that accepts the payment and, if the attackers decide to play ball, releases the decryption codes.


The new malware communicates using Tor, the anonymising service that encrypts communications, then bounces them through a series of relay nodes in order to prevent eavesdroppers from determining the festinate of the connection.


Onion, which so far only affects Windows PCs, is not the first malware to use Tor to protect its creators. The banking malware Zeus, seen in the wild in the first half of 2013, takes that crown. But Fedor Sinitsyn, senior malware analyst at Kaspersky Lab, says that "now it seems that Tor has become a proven means of communication and is being utilised by other types of malware.


"The Onion malware features technical improvements on previously seen cases where Tor functions were used in malicious campaigns. Hiding the command and control servers in an anonymous Tor network complicates the search for the cybercriminals, and the use of an unorthodox cryptographic scheme makes file decryption impossible, even if traffic is intercepted between the Trojan and the server.


"All this makes it a highly dangerous threat and one of the most technologically advanced encryptors out there."


Employing Tor also leaves cybersecurity organisations with fewer options for fighting the malware. Cryptolocker was eventually halted temporarily by a concerted effort to take down the servers that control it. But if Onion's commands come from a darkweb server, it's practically impossible to trace them back to the source.


Kaspersky recommends users keep regular backups, in case they are infected with the malware, as well as employ regularly updated antivirus software.


(The gaurdian.com)