DOCSLIB.ORG

The New Generation of Ransomware - an in Depth Study of Ransomware-As-A-Service

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
The New Generation of Ransomware - an in Depth Study of Ransomware-As-A-Service The new generation of ransomware - An in depth study of Ransomware-as-a-Service No¨elKeijzer June 25, 2020 1 Abstract Ransomware is a problem that is becoming more prevalent as companies start to rely more on IT infrastructure. Ransomware causes major damages to compa- nies and has recently emerged in a new form, Ransomware-as-a-Service (RaaS). RaaS is a service provided by ransomware authors which allows cyber-criminals to rent ransomware for a fee. RaaS allows cyber-criminals without the skills to write their own ransomware to deploy a "rented" version. A RaaS strain, REvil, is compared to a regular ransomware strain, WannaCry. Differences and common properties are discovered among these strains and are evaluated using existing works on other RaaS and regular ransomware strains. From these characteristics it follows that RaaS is at least as advanced if not more advanced than the most sophisticated regular ransomware. Several possible mitigation techniques are proposed to reduce the impact of RaaS, classify it during or after infection and recover files from an encrypted system. Finally, it is shown how these differences and common properties can aid in a criminal investigation. REvil is also compared to an older RaaS strain, GandCrab. Differences and common properties are found for these two strains and evaluated using analyses of other RaaS strains. From these differences and common properties several trends in RaaS development are identified. RaaS is moving towards using more advanced encryption techniques and making the ransomware more configurable. Finally RaaS has moved towards a model that is able to encrypt systems inde- pendent from Command & Control servers. 2 Preface Writing this report has been a fun and interesting journey. Starting off not knowing anything about reverse engineering, it was also quite the learning ex- perience. I would like to thank my future colleagues at Northwave for all their support and guidance during this process. I would like to thank Erik and Anna for being my supervisors. Furthermore, I would like to thank Martijn for his advice and the daily supervision during my thesis. Without his help this thesis would never have turned out the way it did. I would like to thank all the friends I made during my studies for the fun times, you know who you are! Finally, I would like to thank my family for supporting me all the way through my studies. 3 Contents 1 Introduction 8 1.1 Contribution . .8 1.2 Report structure . .9 2 Research questions 10 3 Background 11 3.1 Ransomware . 11 3.2 Ransomware-as-a-Service . 12 3.3 Cryptography . 12 3.4 Privilege Escalation and Anti-virus evasion . 12 3.5 Social engineering . 13 3.6 Exploit kits . 14 3.7 Remote access services . 15 3.8 Packers . 15 3.9 Anti-RE techniques . 15 3.10 Intrusion detection systems . 16 4 Methodology 17 4.1 RQ 1: What is the current state of Ransomware-as-a-Service, what measures can be taken to reduce the impact of Ransomware- as-a-Service and what is the direction of development in Ransomware- as-a-Service? . 17 4.2 RQ 1.1: What are the differences and common properties of Ransomware-as-a-Service ransomware compared to regular ran- somware? . 17 4.3 RQ 1.2: How can the characteristics of Ransomware-as-a-Service be used to reduce the impact of Ransomware-as-a-Service? . 19 4.4 RQ 1.2.1: Can these characteristics be used to detect Ransomware- as-a-Service ransomware in the early stages of its execution? . 19 4.5 RQ 1.2.2: Can these characteristics be used to classify a Ransomware- as-a-Service ransomware during/after infection? . 20 4.6 RQ 1.2.3: Can these characteristics be used to recover files from an encrypted system? . 20 4.7 RQ 1.2.4: Can these characteristics be used to aid in criminal investigations? . 21 4.8 RQ 1.3: What are the differences and common properties of REvil compared to GandCrab? . 21 4.9 RQ 1.4: Can these differences be used to find trends in current Ransomware-as-a-Service development? . 21 5 REvil analysis 23 5.1 Packing method . 23 5.2 Anti-reverse engineering techniques . 25 4 5.2.1 Dynamic imports . 25 5.2.2 Encrypted strings . 27 5.3 Imports . 29 5.4 Mutexes . 29 5.5 Registry keys . 29 5.6 API Functions . 31 5.7 Privilege escalation methods . 32 5.8 Configuration options . 33 5.9 Encryption method . 35 5.10 Encryption key management . 37 5.11 Command & Control communication fields . 39 5.12 Network traffic . 41 5.13 Anti-virus evasion methods . 43 5.14 Persistence mechanisms . 43 5.15 Spreading mechanisms . 43 5.16 Process white/blacklist . 44 5.17 Folder white/blacklist used for encryption . 44 5.18 Execution flowchart . 45 5.19 MITRE ATT&CK matrix . 46 6 WannaCry analysis 47 6.1 Packing method . 47 6.2 Anti-reverse engineering techniques . 47 6.3 Imports . 47 6.4 Mutexes . 48 6.5 Registry keys . 48 6.6 API Functions . 48 6.7 Privilege escalation methods . 49 6.8 Configuration options . 49 6.9 Encryption method . 50 6.10 Encryption key management . 50 6.11 Command & Control communication fields . 50 6.12 Network traffic . 50 6.13 Anti-virus evasion methods . 51 6.14 Persistence mechanisms . 51 6.15 Spreading mechanisms . 51 6.16 Process white/blacklist . 51 6.17 Folder white/blacklist used for encryption . 51 6.18 Execution flowchart . 53 6.19 MITRE ATT&CK matrix . 53 7 GandCrab analysis 55 7.1 Packing method . 55 7.2 Anti-reverse engineering techniques . 56 7.3 Imports . 57 7.4 Mutexes . 57 5 7.5 Registry keys . 57 7.6 API Functions . 58 7.7 Privilege escalation methods . 59 7.8 Configuration options . 59 7.9 Encryption method . 59 7.10 Encryption key management . 59 7.11 Command & Control communication fields . 60 7.12 Network traffic . 61 7.13 Anti-virus evasion methods . 61 7.14 Persistence mechanisms . 61 7.15 Spreading mechanisms . 61 7.16 Process white/blacklist . 61 7.17 Folder white/blacklist used for encryption . 62 7.18 Execution flowchart . 63 7.19 MITRE ATT&CK matrix . 65 8 Other analyses 66 8.1 Packing method . 66 8.2 Anti-reverse engineering techniques . 66 8.3 Imports . 67 8.4 Mutexes . 68 8.5 Registry keys . 68 8.6 API Functions . 69 8.7 Privilege escalation methods . 69 8.8 Configuration options . 70 8.9 Encryption method . 70 8.10 Encryption key management . 71 8.11 Command & Control communication fields . 72 8.12 Network traffic . 73 8.13 Anti-virus evasion methods . 74 8.14 Persistence mechanisms . 74 8.15 Spreading mechanisms . 74 8.16 Process white/blacklist . 74 8.17 Folder white/blacklist . 75 8.17.1 Spora ransoware . 75 8.17.2 Phobos ransomware . 76 8.17.3 Maze Ransomware . 76 8.17.4 Lockbit ransomware . 77 8.17.5 Nemty ransomware . 78 8.17.6 Buran ransomware . 78 9 Discussion 80 9.1 Packing method . 80 9.2 Anti-reverse engineering techniques . 81 9.3 Imports . 82 9.4 Mutexes . 84 6 9.5 Registry keys . 85 9.6 API Functions . ..
Load more

Recommended publications
  • Ransom Where?
    Ransom where? Holding data hostage with ransomware May 2019 Author With the evolution of digitization and increased interconnectivity, the cyberthreat landscape has transformed from merely a security and privacy concern to a danger much more insidious by nature — ransomware. Ransomware is a type of malware that is designed to encrypt, Imani Barnes Analyst 646.572.3930 destroy or shut down networks in exchange [email protected] for a paid ransom. Through the deployment of ransomware, cybercriminals are no longer just seeking to steal credit card information and other sensitive personally identifiable information (PII). Instead, they have upped their games to manipulate organizations into paying large sums of money in exchange for the safe release of their data and control of their systems. While there are some business sectors in which the presence of this cyberexposure is overt, cybercriminals are broadening their scopes of potential victims to include targets of opportunity1 across a multitude of industries. This paper will provide insight into how ransomware evolved as a cyberextortion instrument, identify notorious strains and explain how companies can protect themselves. 1 WIRED. “Meet LockerGoga, the Ransomware Crippling Industrial Firms” March 25, 2019; https://www.wired.com/story/lockergoga-ransomware-crippling-industrial-firms/. 2 Ransom where? | May 2019 A brief history of ransomware The first signs of ransomware appeared in 1989 in the healthcare industry. An attacker used infected floppy disks to encrypt computer files, claiming that the user was in “breach of a licensing agreement,”2 and demanded $189 for a decryption key. While the attempt to extort was unsuccessful, this attack became commonly known as PC Cyborg and set the archetype in motion for future attacks.
    [Show full text]
  • Medtronic Care Management Services, LLC CC FM TLS/SRTP FIPS 140
    Medtronic Care Management Services, LLC CC FM TLS/SRTP FIPS 140‐2 Cryptographic Module Non‐Proprietary Security Policy Version: 1.6 Date: March 16, 2016 Copyright Medtronic Care Management Services 2016 Version 1.6 Page 1 of 14 Medtronic Care Management Services Public Material – May be reproduced only in its original entirety (without revision). Table of Contents 1 Introduction .................................................................................................................... 4 1.1 Cryptographic Boundary ..............................................................................................................5 1.2 Mode of Operation .......................................................................................................................5 2 Cryptographic Functionality ............................................................................................. 6 2.1 Critical Security Parameters .........................................................................................................7 2.2 Public Keys ....................................................................................................................................8 3 Roles, Authentication and Services .................................................................................. 8 3.1 Assumption of Roles .....................................................................................................................8 3.2 Services and CSP Access Rights ....................................................................................................8
    [Show full text]
  • Attacking from Inside
    WIPER MALWARE: ATTACKING FROM INSIDE Why some attackers are choosing to get in, delete files, and get out, rather than try to reap financial benefit from their malware. AUTHORED BY VITOR VENTURA WITH CONTRIBUTIONS FROM MARTIN LEE EXECUTIVE SUMMARY from system impact. Some wipers will destroy systems, but not necessarily the data. On the In a digital era when everything and everyone other hand, there are wipers that will destroy is connected, malicious actors have the perfect data, but will not affect the systems. One cannot space to perform their activities. During the past determine which kind has the biggest impact, few years, organizations have suffered several because those impacts are specific to each kinds of attacks that arrived in many shapes organization and the specific context in which and forms. But none have been more impactful the attack occurs. However, an attacker with the than wiper attacks. Attackers who deploy wiper capability to perform one could perform the other. malware have a singular purpose of destroying or disrupting systems and/or data. The defense against these attacks often falls back to the basics. By having certain Unlike malware that holds data for ransom protections in place — a tested cyber security (ransomware), when a malicious actor decides incident response plan, a risk-based patch to use a wiper in their activities, there is no management program, a tested and cyber direct financial motivation. For businesses, this security-aware business continuity plan, often is the worst kind of attack, since there is and network and user segmentation on top no expectation of data recovery.
    [Show full text]
  • FSRM : Protéger Son Serveur De Fichiers Des Ransomwares Jeudi 20 Avril 2017 16:33
    FSRM : Protéger son serveur de fichiers des ransomwares jeudi 20 avril 2017 16:33 • I. Présentation • II. Installation du gestionnaire de ressources du serveur de fichiers • III. Configurer le SMTP pour recevoir les notifications • IV. Création d’un groupe d’extensions de fichiers • V. Créer un modèle de filtre de fichiers • VI. Créer un filtre de fichiers • VII. Test de la configuration • VIII. Pour aller plus loin I. Présentation Les données qu’elles soient personnelles ou professionnelles ont une valeur certaine, et ça il y a des personnes malintentionnées qu’ils l’ont bien compris et qui veulent en tirer profit avec des malwares, ou plus particulièrement avec les ransomwares qui sont la grande tendance depuis quelque temps. Pour rappel, un ransomware, en français rançongiciel, est un logiciel qui va chiffrer vos données et vous demander de l’argent pour pouvoir récupérer les données, sous peine de les perdre. Pour se protéger face à cette menace, que l’on peut représenter par Cryptolocker ou plus récemment Locky, il y a différentes couches de sécurité à mettre en place. Tout d’abord, ça passe par une protection au niveau des e-mails avec un filtre anti-spam, du filtrage web pour éviter que les utilisateurs aillent sur des sites où ils n’ont rien à faire, ou encore protéger votre serveur de fichiers, c’est d’ailleurs ce dernier point qui nous intéresse. Dans le cadre de ce tutoriel, il sera question de protéger un serveur de fichiers sous Windows Server 2012 R2 ou sur Windows Server 2008 R2, pour cela on s’appuie sur le File Server Resource Manager (FSRM) , en français « Gestionnaire de ressources du serveur de fichiers ».
    [Show full text]
  • Analysis of the Teslacrypt Family and How to Protect Against Future
    Sophia Wang COMP 116 Final Project Analysis of the TeslaCrypt Family and How to Protect Against Future Ransomware/Cyber Attacks Abstract Ransomware accounts for a large majority of the malicious attacks in the cyber security world, with a company hit with a ransomware attack once every 40 seconds. There was a 300% increase in ransomware attacks from 2015 to 2016 — and it’s only going up from there. One family of Trojan-style ransomware technology that introduced itself in early 2015 is TeslaCrypt. TeslaCrypt affected Windows users from the US, Germany, Spain, Italy, France, and the United Kingdom, targeting mostly gamers. This form of ransomware would encrypt the victim’s files using a highly complicated encryption key and demand $250 to $1,000 for ransom. The creators of TeslaCrypt eventually released the master decryption key in May of 2016, so in the end the victims were able to recover their files and systems. This paper will explore the process by which the TeslaCrypt ransomware infected a system, the steps that were taken to ameliorate this issue, and what steps should be taken to avoid an incident like this in the future. Introduction Ransomware is a special form of malware that can infect a system through either encrypting and denying users access to their files, or restricting access and locking users out of their systems. Once the ransomware has the target’s files and/or system on lock, it demands a ransom be paid, usually through some form of cryptocurrency. In February of 2015, a new family of file-encrypting Trojan-style ransomware technology was introduced — TeslaCrypt.
    [Show full text]
  • A Systematic Empirical Analysis of Unwanted Software Abuse, Prevalence, Distribution, and Economics
    UNIVERSIDAD POLITECNICA´ DE MADRID ESCUELA TECNICA´ SUPERIOR DE INGENIEROS INFORMATICOS´ A Systematic Empirical Analysis of Unwanted Software Abuse, Prevalence, Distribution, and Economics PH.D THESIS Platon Pantelis Kotzias Copyright c 2019 by Platon Pantelis Kotzias iv DEPARTAMENTAMENTO DE LENGUAJES Y SISTEMAS INFORMATICOS´ E INGENIERIA DE SOFTWARE ESCUELA TECNICA´ SUPERIOR DE INGENIEROS INFORMATICOS´ A Systematic Empirical Analysis of Unwanted Software Abuse, Prevalence, Distribution, and Economics SUBMITTED IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE DEGREE OF: Doctor of Philosophy in Software, Systems and Computing Author: Platon Pantelis Kotzias Advisor: Dr. Juan Caballero April 2019 Chair/Presidente: Marc Dasier, Professor and Department Head, EURECOM, France Secretary/Secretario: Dario Fiore, Assistant Research Professor, IMDEA Software Institute, Spain Member/Vocal: Narseo Vallina-Rodriguez, Assistant Research Professor, IMDEA Networks Institute, Spain Member/Vocal: Juan Tapiador, Associate Professor, Universidad Carlos III, Spain Member/Vocal: Igor Santos, Associate Research Professor, Universidad de Deusto, Spain Abstract of the Dissertation Potentially unwanted programs (PUP) are a category of undesirable software that, while not outright malicious, can pose significant risks to users’ security and privacy. There exist indications that PUP prominence has quickly increased over the last years, but the prevalence of PUP on both consumer and enterprise hosts remains unknown. Moreover, many important aspects of PUP such as distribution vectors, code signing abuse, and economics also remain unknown. In this thesis, we empirically and sys- tematically analyze in both breadth and depth PUP abuse, prevalence, distribution, and economics. We make the following four contributions. First, we perform a systematic study on the abuse of Windows Authenticode code signing by PUP and malware.
    [Show full text]
  • No Random, No Ransom: a Key to Stop Cryptographic Ransomware
    No Random, No Ransom: A Key to Stop Cryptographic Ransomware Ziya Alper Genç, Gabriele Lenzini, and Peter Y.A. Ryan Interdisciplinary Centre for Security Reliability and Trust (SnT) University of Luxembourg Abstract. To be effective, ransomware has to implement strong encryp- tion, and strong encryption in turn requires a good source of random numbers. Without access to true randomness, ransomware relies on the pseudo random number generators that modern Operating Systems make available to applications. With this insight, we propose a strategy to miti- gate ransomware attacks that considers pseudo random number generator functions as critical resources, controls accesses on their APIs and stops unauthorized applications that call them. Our strategy, tested against 524 active real-world ransomware samples, stops 94% of them, including WannaCry, Locky, CryptoLocker and CryptoWall. Remarkably, it also nullifies NotPetya, the latest offspring of the family which so far has eluded all defenses. Keywords: ransomware, cryptographic malware, randomness, mitigation. 1 Introduction Ransomware is a malware, a malicious software that blocks access to victim’s data. In contrast to traditional malware, whose break-down is permanent, ransomware’s damage is reversible: access to files can be restored on the payment of a ransom, usually a few hundreds US dollars in virtual coins. Despite being relatively new, this cyber-crime is spreading fast and it is believed to become soon a worldwide pandemic. According to [24], a US Govern- ment’s white paper dated June 2016, on average more than 4,000 ransomware attacks occurred daily in the USA. This is 300-percent increase from the previous year and such important increment is probably due to the cyber-crime’s solid business model: with a small investment there is a considerable pecuniary gain which, thanks to the virtual currency technology, can be collected reliably and in a way that is not traceable by the authorities.
    [Show full text]
  • The Daily Egyptian, March 09, 1982
    Southern Illinois University Carbondale OpenSIUC March 1982 Daily Egyptian 1982 3-9-1982 The aiD ly Egyptian, March 09, 1982 Daily Egyptian Staff Follow this and additional works at: https://opensiuc.lib.siu.edu/de_March1982 Volume 67, Issue 114 Recommended Citation , . "The aiD ly Egyptian, March 09, 1982." (Mar 1982). This Article is brought to you for free and open access by the Daily Egyptian 1982 at OpenSIUC. It has been accepted for inclusion in March 1982 by an authorized administrator of OpenSIUC. For more information, please contact [email protected]. Wrestling, water polo cut from sports By Steve MeeHl! student affairs. Both sports Swinburne said SIU-C will try SpIns E4II ... hltve finished their seasons and dual meets this season after a 9- records. He said makiDJ the to continue to offer the 7 record a year ago. The Swinburne said the cutback "diversity" in athletics it has cutback effective immediately The Inten:oUegiate Athletics takes effect immediately. WTP..atllll, program started at frees wrestlers to seek AcIvisM'y Committee Monday bad in the past. Sh] in 1950. HartzOl said droppiDl the two Hartzog said the dropping of scholarships at other schools. unanimously apPro~ed drop­ Hartzog said wrestling Coach sports would save aboUt 135.000. the two intercollegiate sports "This gives the opportunity to piDl water polo and wrestling which wiD be used to improve Linn LofII will not be left "high our two reaUy good Wrestlers to from the athletics program. was a "hard decision to make" and dry" by elimination of the men's athletin programs.
    [Show full text]
  • Gothic Panda Possibly Used Doublepulsar a Year Before The
    Memo 17/05/2019 - TLP:WHITE Gothic Panda possibly used DoublePulsar a year before the Shadow Brokers leak Reference: Memo [190517-1] Date: 17/05/2019 - Version: 1.0 Keywords: APT, DoublePulsar, China, US, Equation Group Sources: Publicly available sources Key Points Gothic Panda may have used an Equation Group tool at least one year before the Shadow Brokers leak. It is unknown how the threat group obtained the tool. This is a good example of a threat actor re-using cyber weapons that were originally fielded by another group. Summary According research conducted by Symantec, the Chinese threat actor known as Gothic Panda (APT3, UPS, SSL Beast, Clandestine Fox, Pirpi, TG-0110, Buckeye, G0022, APT3) had access to at least one NSA-associated Equation Group tool a year before they were leaked by the Shadow Brokers threat actor. On April 14, 2017, a threat actor called the Shadow Brokers released a bundle of cyber-attack tools purportedly coming from the US NSA, also referred to as the Equation Group. Among the released material there was the DoublePulsar backdoor implant tool, which was used alongside EternalBlue in the May 2017 destructive WannaCry attack. DoublePulsar is a memory-based kernel malware that allows perpetrators to run arbitrary shellcode payloads on the target system. It does not write anything on the hard drive and will thus disappear once the victim machine is rebooted. Its only purpose is to enable dropping other malware or executables in the system. According to Symantec, Gothic Panda used the DoublePulsar exploit as early as in 2016, a full year before the Shadow Brokers release.
    [Show full text]
  • Cryptanalysis of the Random Number Generator of the Windows Operating System
    Cryptanalysis of the Random Number Generator of the Windows Operating System Leo Dorrendorf School of Engineering and Computer Science The Hebrew University of Jerusalem 91904 Jerusalem, Israel [email protected] Zvi Gutterman Benny Pinkas¤ School of Engineering and Computer Science Department of Computer Science The Hebrew University of Jerusalem University of Haifa 91904 Jerusalem, Israel 31905 Haifa, Israel [email protected] [email protected] November 4, 2007 Abstract The pseudo-random number generator (PRNG) used by the Windows operating system is the most commonly used PRNG. The pseudo-randomness of the output of this generator is crucial for the security of almost any application running in Windows. Nevertheless, its exact algorithm was never published. We examined the binary code of a distribution of Windows 2000, which is still the second most popular operating system after Windows XP. (This investigation was done without any help from Microsoft.) We reconstructed, for the ¯rst time, the algorithm used by the pseudo- random number generator (namely, the function CryptGenRandom). We analyzed the security of the algorithm and found a non-trivial attack: given the internal state of the generator, the previous state can be computed in O(223) work (this is an attack on the forward-security of the generator, an O(1) attack on backward security is trivial). The attack on forward-security demonstrates that the design of the generator is flawed, since it is well known how to prevent such attacks. We also analyzed the way in which the generator is run by the operating system, and found that it ampli¯es the e®ect of the attacks: The generator is run in user mode rather than in kernel mode, and therefore it is easy to access its state even without administrator privileges.
    [Show full text]
  • Information to Users
    INFORMATION TO USERS This manuscript has been reproduced from the microfilm master. UMI films the text directly from the original or copy submitted. Thus, some thesis and dissertation copies are in typewriter face, while others may be from any type of computer printer. The quality of this reproduction is dependent upon the quality of the copy submitted. Broken or indistinct print, colored or poor quality illustrations and photographs, print bleedthrough, substandard margins, and improper alignment can adversely affect reproduction. In the unlikely event that the author did not send UMI a complete manuscript and there are missing pages, these will be noted. Also, if unauthorized copyright material had to be removed, a note will indicate the deletion. Oversize materials (e.g., maps, drawings, charts) are reproduced by sectioning the original, beginning at the upper left-hand corner and continuing from left to right in equal sections with small overlaps. ProQuest Information and Learning 300 North Zeeb Road, Ann Arbor, Ml 48106-1346 USA 800-521-0600 Reproduced with permission of the copyright owner. Further reproduction prohibited without permission. Reproduced with permission of the copyright owner. Further reproduction prohibited without permission. UNIVERSITY OF CINCINNATI 1 J93S. I hereby recommend that the thesis prepared under my supervision bu ___________________ entitled TVip Aphorisms of GeoTg Christoph Lichtenberg _______ with a Brief Life of Their Author. Materials for a _______ Biography of Lichtenberg. ______________________________________ be accepted as fulfilling this part of the requirements for the degree o f (p /fc -£^OQOTj o Approved by: <r , 6 ^ ^ FORM 660—G.S. ANO CO.—lM—7«33 Reproduced with permission of the copyright owner.
    [Show full text]
  • Chrome Flaw Allows Sites to Secretly Record Audio
    Chrome Flaw Allows Sites to Secretly Record Audio/Video Without Indication Chrome Flaw Allows Sites to Secretly Record Audio/Video Without Indication Sounds really scary! Isn’t it? But this scenario is not only possible but is hell easy to accomplish.A UX design flaw in the Google’s Chrome browser could allow malicious websites to record audio or video without alerting the user or giving any visual indication that the user is being spied on. AOL developer Ran Bar-Zik reported the vulnerability to Google on April 10, 2017, but the tech giant declined to consider this vulnerability a valid security issue, which means that there is no official patch on the way. How Browsers Works With Camera & Microphone Before jumping onto vulnerability details, you first need to know that web browser based audio-video communication relies on WebRTC (Web Real-Time Communications) protocol – a collection of communications protocols that is being supported by most modern web browsers to enable real-time communication over peer-to-peer connections without the use of plugins. However, to protect unauthorised streaming of audio and video without user’s permission, the web browser first request users to explicitly allow websites to use WebRTC and access device camera/microphone. Once granted, the website will have access to your camera and microphone forever until you manually revoke WebRTC permissions. In order to prevent ‘authorised’ websites from secretly recording your audio or video stream, web browsers indicate their users when any audio or video is being recorded. « Activating this API will alert the user that the audio or video from one of the devices is being captured, » Bar-Zik wrote on a Medium blog post.
    [Show full text]