Hello, welcome to the Tuesday, August 9th, 2016 edition of the Santernet Storm Center's Stormcast.

My name is Johannes Ulrich, and the I'm recording from Jacksonville, Florida.

As part of a diary that Rob wrote today, he published a script that does try to identify files that have been affected by Ransomware.

Essentially what the script does is it looks at the entropy of a file, encrypted files typically

do distinguish themselves by having a higher entropy than files that are not encrypted. So this particular script will essentially just

sort files by entropy and with that hopefully tell you which files have been encrypted with

ransomware. One use case is that if you have a system that is affected by ransomware, you can then use the script

to essentially isolate the files that are still okay and the files that need to be restored

from backups or where you have to try to decrypt them.

Of course, this script does not identify the actual ransomware

itself. That would be more something that you do with anti-malware or hopefully you can restore

the system from a complete backup and then identify any files that have changed.

And the research group known as the Deep Instinct Research Team came out with a new way to inject

malicious code into signed Windows binaries without invalidating the signature.

The trick is pretty neat in that they're injecting the malicious code into the

space in the binary file where the certificate is held and that part of the binary is not validated

by the signature. So as a result it is possible to inject additional code into the binary and then they also came up with an interesting trick to load that code into the binary once it's being launched.

So with this particular bypass technique, digital signatures can be circumvented and a user may execute a binary that

claims to be nicely and valid signed.

At this point there isn't really much you can do in order to detect or avoid this attack.

I guess ultimately you could check the size of the certificate area, make sure it's not

normally large.

...