Incident: Ransomware "Onion" Encrypts Files Demanding Payment via Tor.

Published Date: 2014-07-25

Postmortem Analysis
Timeline 1. The software failure incident involving the Onion ransomware happened in November 2013 as per the article [28256]. 2. The article was published on 2014-07-25. 3. Therefore, the software failure incident occurred in November 2013.
System 1. Windows PCs [28256]
Responsible Organization 1. Cybercriminals behind the ransomware strain "Onion" were responsible for causing the software failure incident [28256].
Impacted Organization 1. Users infected with the Onion ransomware, as their files were encrypted and they were demanded payment for decryption [28256].
Software Causes 1. The software cause of the failure incident was the development and deployment of a new strain of ransomware called "Onion" that encrypts user data and demands payment for decryption [28256].
Non-software Causes 1. Lack of regular backups by users [28256] 2. Payment demanded through bitcoin by the malware creators [28256]
Impacts 1. The software failure incident led to the encryption of user data on infected computers, making the files inaccessible without decryption keys, resulting in potential data loss [28256]. 2. Users faced the risk of losing their files permanently if they did not pay the ransom within the specified time frame of 72 hours [28256]. 3. The incident caused financial losses for some users who opted to pay the ransom to retrieve their encrypted files [28256]. 4. The malware's use of Tor for communication made it difficult for cybersecurity organizations to trace the source of the malware and take down the command and control servers, limiting their ability to combat the threat effectively [28256].
Preventions 1. Regularly updating antivirus software could have potentially prevented the software failure incident caused by the Onion ransomware [28256]. 2. Keeping regular backups of important files would have been a preventive measure against the encryption and potential loss of data due to the ransomware attack [28256].
Fixes 1. Regularly updated antivirus software can help prevent the malware from infecting a computer and encrypting files [28256]. 2. Keeping regular backups of important files can mitigate the impact of the malware encrypting files, as users can restore their data from backups instead of paying the ransom [28256].
References 1. Security researchers at Kaspersky Lab [28256]

Software Taxonomy of Faults

Category Option Rationale
Recurring multiple_organization (a) The software failure incident related to ransomware, specifically the Onion malware, is a successor to the notorious Cryptolocker ransomware. Cryptolocker was a ransomware that encrypted user data and demanded payment for decryption. The new strain of ransomware, Onion, operates similarly by encrypting user files and demanding payment for decryption [28256]. (b) The article mentions that the banking malware Zeus, seen in the wild in the first half of 2013, also used Tor to protect its creators. This indicates that the use of Tor for communication and encryption in malware campaigns is not unique to Onion but has been utilized by other types of malware like Zeus [28256].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the development of the ransomware malware called "Onion." This malware, which encrypts user data and demands payment for decryption, features technical improvements on previously seen cases where Tor functions were used in malicious campaigns. The malware uses Tor to hide its malicious nature and make it hard to track the cybercriminals behind it. The use of an unorthodox cryptographic scheme in Onion makes file decryption impossible, even if traffic is intercepted between the Trojan and the server, showcasing a failure in the design phase to prevent decryption even with intercepted traffic [28256]. (b) The software failure incident related to the operation phase is evident in how the malware operates once it infects a computer. After infecting a computer, the software encrypts the user's files and initiates a countdown, warning users that they have 72 hours to pay up, or all files will be lost forever. This operation phase failure is highlighted by the fact that if the attackers decide to release the decryption codes after payment, the communication is done using Tor, making it difficult to trace back to the source. This operational failure complicates the search for cybercriminals and limits the options for fighting the malware, showcasing a failure in the operation phase [28256].
Boundary (Internal/External) within_system (a) within_system: The software failure incident described in the article is primarily due to factors originating from within the system. The ransomware malware, named "Onion," encrypts user data and demands payment for decryption. It communicates with a "command and control" server using the anonymizing network Tor, which is a technical aspect of the malware itself. The encryption of files and the countdown initiated by the malware are all internal functions of the malicious software [28256]. (b) outside_system: The software failure incident does not seem to be primarily caused by factors originating from outside the system. The article focuses on the technical aspects of the ransomware, how it operates, and how it communicates using Tor. There is no explicit mention of external factors contributing significantly to the failure incident [28256].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident related to non-human actions: The software failure incident described in the article is related to a new strain of ransomware called "Onion" [28256]. This ransomware encrypts user data and demands payment for decryption. The malware uses the anonymising network Tor to hide its malicious nature and make it hard to track the perpetrators behind the malware campaign. The encryption and decryption processes are automated within the malware itself, without direct human intervention in the encryption process. The malware initiates a countdown and warns users to pay up within 72 hours, or risk losing their files forever. The use of Tor for communication and encryption complicates the search for cybercriminals, making it a highly dangerous threat [28256]. (b) The software failure incident related to human actions: The software failure incident involving the ransomware "Onion" can be linked to human actions in terms of the creation and deployment of the malware by cybercriminals. The individuals or group behind the malware campaign are responsible for developing and distributing the ransomware, as well as setting up the command and control server that accepts payments and releases decryption codes. The decision to demand payment in bitcoin and the choice to use Tor for communication are deliberate actions taken by the cybercriminals to evade detection and make tracking them more difficult. Additionally, the decision to encrypt user data and demand ransom payments reflects the malicious intent and actions of the individuals behind the ransomware [28256].
Dimension (Hardware/Software) software (a) The software failure incident related to hardware: - The article discusses a new strain of ransomware called "Onion" that encrypts user data and demands payment for decryption. This ransomware, which is a successor to Cryptolocker, communicates with the "command and control" server using the anonymising network Tor to hide its malicious nature and make it hard to track the cybercriminals behind it [28256]. (b) The software failure incident related to software: - The software failure incident in this case is primarily due to the malicious software (ransomware) itself, specifically the new strain called "Onion." This ransomware encrypts user files and demands payment for decryption, with the communication between the malware and the command and control server being facilitated through Tor to evade detection and tracking [28256].
Objective (Malicious/Non-malicious) malicious (a) The objective of the software failure incident was malicious, as it involved the creation and deployment of ransomware called "Onion" with the intent to encrypt user data and demand payment for decryption. The ransomware was designed to hide its malicious nature using the Tor network, making it difficult to track the perpetrators behind the malware campaign. The malware encrypted user files, initiated a countdown for payment, and communicated with a command and control server through Tor to receive payments and release decryption codes [28256].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident related to poor_decisions: - The software failure incident described in the article is related to a new strain of ransomware called "Onion" [28256]. - The creators of this ransomware made deliberate decisions to enhance its malicious capabilities, such as using the anonymising network Tor to hide its nature and make it hard to track the perpetrators behind the malware campaign. - The ransomware encrypts user files and demands payment for decryption, following a similar modus operandi to the notorious Cryptolocker ransomware. - The decision to use Tor for communication and encryption in the ransomware indicates a deliberate choice to make tracking and combating the malware more challenging for cybersecurity organizations. - The use of an unorthodox cryptographic scheme in the ransomware also demonstrates a deliberate effort to make file decryption impossible, even if traffic is intercepted between the malware and the server. (b) The intent of the software failure incident related to accidental_decisions: - The software failure incident does not appear to be related to accidental decisions or unintended mistakes. The actions taken by the creators of the ransomware, such as using Tor for communication and encryption, implementing a countdown for payment, and employing advanced encryption techniques, seem to be intentional and calculated to maximize the impact of the malware [28256].
Capability (Incompetence/Accidental) unknown (a) The software failure incident related to development incompetence is not explicitly mentioned in the provided article. Therefore, it is unknown if the incident was due to contributing factors introduced due to lack of professional competence by humans or the development organization. (b) The software failure incident related to accidental factors is not explicitly mentioned in the provided article. Therefore, it is unknown if the incident was due to contributing factors introduced accidentally.
Duration permanent, temporary (a) The software failure incident described in the article is considered permanent. The ransomware malware, named "Onion," encrypts user files and demands payment for decryption. The encryption process initiated by the malware makes file decryption impossible, even if traffic is intercepted between the Trojan and the server. This permanence in file encryption is a significant aspect of the software failure incident [28256]. (b) The software failure incident can also be considered temporary in the sense that users have a limited time window to pay the ransom and retrieve their files. The malware initiates a countdown, warning users that they have 72 hours to pay up, or all files will be lost forever. This time constraint introduces a temporary aspect to the failure incident, as users have a limited opportunity to potentially recover their encrypted files [28256].
Behaviour value, other (a) crash: The software failure incident described in the article is not related to a crash where the system loses state and does not perform any of its intended functions. Instead, the ransomware software encrypts user files and demands payment for decryption, indicating that the software is functioning in a malicious manner [28256]. (b) omission: The software failure incident is not related to omission where the system fails to perform its intended functions at an instance(s). In this case, the ransomware software is actively encrypting user files and demanding payment, indicating that it is carrying out its intended functions [28256]. (c) timing: The software failure incident is not related to timing where the system performs its intended functions correctly but too late or too early. The ransomware software initiates a countdown after encrypting user files, giving users 72 hours to pay up before files are claimed to be lost forever [28256]. (d) value: The software failure incident is related to the system performing its intended functions incorrectly. The ransomware software encrypts user files and demands payment for decryption, which is not the intended or legitimate use of the system [28256]. (e) byzantine: The software failure incident is not related to a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. The ransomware software operates in a consistent manner by encrypting files and demanding payment for decryption [28256]. (f) other: The behavior of the software failure incident can be categorized as extortionate behavior. The ransomware software encrypts user files and demands payment for decryption, essentially extorting money from users by holding their data hostage [28256].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident described in the article is related to ransomware called "Onion" that encrypts user data and demands payment for decryption. When infected with this malware, users' files are encrypted, and a ransom is demanded in exchange for the decryption key. The ransom is typically demanded in the form of bitcoin, with fees often in the hundreds of pounds [28256]. This indicates that people's data and potentially valuable files are impacted by this software failure, leading to financial consequences for the affected individuals or organizations.
Domain information, finance (a) The failed system in the article is related to the information industry as it discusses ransomware attacks targeting user data and encrypting files, particularly Microsoft Office files, for the purpose of demanding payment for decryption [28256]. (b) There is no specific mention of the transportation industry in the article. (c) There is no specific mention of the natural resources industry in the article. (d) There is no specific mention of the sales industry in the article. (e) There is no specific mention of the construction industry in the article. (f) There is no specific mention of the manufacturing industry in the article. (g) There is no specific mention of the utilities industry in the article. (h) The failed system in the article is not directly related to the finance industry, but it does mention that ransom payments were demanded through bitcoin, which involves the exchange of money for products [28256]. (i) There is no specific mention of the knowledge industry in the article. (j) There is no specific mention of the health industry in the article. (k) There is no specific mention of the entertainment industry in the article. (l) There is no specific mention of the government industry in the article. (m) The failed system in the article is not directly related to any of the industries mentioned in options (a) to (l) but rather focuses on cybercrime involving ransomware attacks and encryption of user data for financial gain [28256].

Sources

Back to List