It’s odds on that if you have any interest in staying safe online then you will have come across the term Ransomware, it is often featured in the headlines these days and is currently a popular tool in the hacker’s toolbox.
Typically ransomware infects a user’s machine and informs a user that their system has been infected. The user is told that the system is being held to ransom and if they don’t pay the ransom demand then their files with be encrypted, effectively rendering their data unreadable and useless.
More recently the ransom code techniques have taken on a more sophisticated twist and have begun infecting user’s machines in an event to seek out more important targets such as servers, domain controllers and backup devices. Once getting access to such areas of an organisations infrastructure the demands from ransomware become quickly very serious and damaging – possibly even immobilising an entire operation in a single act.
Approximately 1.2 million users are infected with ransomware each and every day so it’s more likely to be a case of “when” rather than “if” you’re likely to be infected. There are also ransomware strains that go against the general rules, generally these strains are purely destructive and the ransom element is practically irrelevant.
Ranscam is one such example of a badly executed ransomware app. But because it’s a bad type of malware, it’s also the worst Windows infection you can currently get. The malware app deletes everything on your computer. It doesn’t encrypt anything either. You can’t pay to get the decryption key and restore access to your files. Even if you try to pay, you’ll simply get an error message. But what’s clear is that your files are going to be deleted no matter what.
There is no single tool that can detect and remove all the different strains of ransomware, so the most effective solution is to have a strong backup plan in place so in the event you are infected then you can minimise downtime and damaged by going back to just before you were infected and restoring all files from that point. There are some specific backup solutions that make this kind of preparation easier but it should be possible with any form of backup software as long as there is a decent, working backup plan in place.
With new guerrilla strains of ransomware like Ranscam, it cannot be stressed enough that it makes perfect sense for organisations to have a solid, (offline) backup strategy in place rather than just paying the ransom when infected. This approach to such a serious problem will ensure that systems get restored to a clean state and will reduce the ability for the aggressors to earn revenue from these attacks which they can reinvest into their criminal business model.
Ransomware comes in three main forms.
– Scareware. This is a demand for payment based upon the threat of a future action. For now, the victim’s files and system aren’t affected.
– Lockers. In this case, the affected user’s screen/system is blocked off, with the attacker indicating it will stay that way until the ransom is paid.
– Crypto-ransomware. With the victim’s files encrypted, the cyber crook offers to “sell” a decryption key for, of course, a fee. Crypto-ransomware can impact local files and those hosted on network shares. Encrypted files which cannot be retrieved result in a “data destruction” incident – which would be devastating.
To effectively respond to an attack, it’s key to recognise these forms. Once identified, your organisation will inevitably debate the following, tough question: Do we pay or not? Unfortunately, there are no clear-cut right or wrong answers here. To make the decision even more complex, ransomware actors often keep demands relatively affordable and easy to pay. They’re intent on collecting money quickly and moving on to the next target.
At Insta.Digital Security, we can provide the following guidance: Making the payment is always an option, but it does not guarantee the successful return of encrypted files or device/computer usage. It’s also quite possible that the adversary will come back again with more threats and demands. Before agreeing to the terms, leadership must assess the availability of command and control servers on which the decryption key is hosted (will you get what you pay for?); the absence or presence of mistakes in the decryption routine (it might be possible to decrypt without the “official” key); and how “trustworthy” the cyber criminals appear with respect to actually making good on the terms (have your peers had success in retrieving their data and device/computer access?).
Ransomware thrives upon email, internet activity and social engineering.
Ransomware is more than just a piece of malware. Attacks often start with a phishing email and through a “drive-by” infection on a suspect web page. The first signs of malicious code are often infected programs that entice victims to download and execute them or delivered through email attachments (especially Microsoft Office-created ones). It applies constantly evolving, and often targeted, social engineering tactics to trick users into running, downloading or clicking on malicious content. With this, ransomware immediately starts enumerating all of the compromised system’s drives to search for target file types, and then proceeds to swiftly encrypt those files.
With the right monitoring and reporting tools, you can detect and defend your network from such attacks – before they have a chance to interrupt operations and squeeze you for money. A continuous user-education program will go far here too; inform employees about the dangers of ransomware, provide phishing education, and encourage them to report suspicious emails or incidents through an easy to use security incident program. Today’s workforce is increasingly cyber-savvy, and can be trained to identify potential social engineering schemes, check suspicious hyper-links, and understand the risks of opening unexpected or unfamiliar attachments in email.
While ransomware appears to dominate the current cybersecurity conversation, it really isn’t new. Its core components are based upon the same “penetrate and do bad things” principles that have driven hackers for decades. So defenses designed to cover the full threat lifecycle (aka Kill Chain) are particularly useful to defend against ransomware … detecting lures (phishing emails and drive-by web sites), identifying detection evasion tactics, recognizing exploits, and blocking malware. User Behavior Analytics (UBA) are also powerful at the later stages of the attack with the ability to identify excessive file activity and alerting IT or proactively shutting down the activity. More granular assignment of user access rights can limit the access of the ransomware to a smaller attack surface within the network, minimizing its impact. A reliable backup program can dramatically reduce the overall impact and recovery time. There are even economical backup options for road warriors and remote workers.
Subsequently, you will position your organisation as highly guarded against ransomware threats. These criminals aren’t known for their patience, after all, as the classic “time is money” mantra usually dictates their MO. If you make it difficult enough for them to make a quick “sale,” they will move on. With the proper malware defense tools, procedures and awareness efforts in place, they will do just that.
So, it seems the best defence is backup. When did you last verify your backup sets? Is your backup plan strong enough to enable your business to survive an attack from Ransomware?
Our Top Ten Behaviours to help you secure yourself from Ransomeware
1. Back up your data
The single biggest thing that will defeat ransomware is having a regularly updated backup. If you are attacked with ransomware you may lose that document you started earlier this morning, but if you can restore your system to an earlier snapshot or clean up your machine and restore your other lost documents from backup, you can rest easy. Remember that many malwares will also encrypt files on drives that are mapped. This includes any external drives such as a USB thumb drive, as well as any network or cloud file stores that you have assigned a drive letter. So, what you need is a regular backup regimen, to an external drive or backup service, one that is not assigned a drive letter or is disconnected when it is not doing backup.
2. Show hidden file-extensions
One way that Malware frequently arrives is in a file that is named with the extension “.PDF.EXE”, counting on Window’s default behavior of hiding known file-extensions. If you re-enable the ability to see the full file-extension, it can be easier to spot suspicious files.
3. Filter EXEs in email
If your gateway mail scanner has the ability to filter files by extension, you may wish to deny mails sent with “.EXE” files, or to deny mails sent with files that have two file extensions, the last one being executable (“*.*.EXE” files, in filter-speak). If you do legitimately need to exchange executable files within your environment and are denying emails with “.EXE” files, you can do so with ZIP files (password-protected, of course) or via cloud services.
4. Disable files running from AppData/LocalAppData folders
You can create rules within Windows or with Intrusion Prevention Software, to disallow a particular, notable behavior used by many malware payloads, which is to run its executable from the App Data or Local App Data folders. If (for some reason) you have legitimate software that you know is set to run not from the usual Program Files area but the App Data area, you will need to exclude it from this rule.
5. Patch or Update your software
Malware authors frequently rely on people running outdated software with known vulnerabilities, which they can exploit to silently get onto your system. It can significantly decrease the potential for ransomware-pain if you make a practice of updating your software often. Some vendors release security updates on a regular basis (Microsoft and Adobe both use the second Tuesday of the month), but there are often “out-of-band” or unscheduled updates in case of emergency. Enable automatic updates if you can, or go directly to the software vendor’s website, as malware authors like to disguise their creations as software update notifications too.
6. Use a reputable security suite
It is always a good idea to have both anti-malware software and a software firewall to help you identify threats or suspicious behavior. Malware authors frequently send out new variants, to try to avoid detection, so this is why it is important to have both layers of protection. And at this point, most malware relies on remote instructions to carry out their misdeeds. If you run across a ransomware variant that is so new that it gets past anti-malware software, it may still be caught by a firewall when it attempts to connect with its Command and Control (C&C) server to receive instructions for encrypting your files.
If you find yourself in a position where you have already run a ransomware file without having performed any of the previous precautions, your options are quite a bit more limited. But all may not be lost. There are a few things you can do that might help mitigate the damage.
7. Disconnect from WiFi or unplug from the network immediately
If you run a file that you suspect may be ransomware, but you have not yet seen the characteristic ransomware screen, if you act very quickly you might be able to stop communication with the C&C server before it finish encrypting your files. If you disconnect yourself from the network immediately, you might mitigate the damage. It takes some time to encrypt all your files, so you may be able to stop it before it succeeds in garbling them all. This technique is definitely not foolproof, and you might not be sufficiently lucky or be able to move more quickly than the malware, but disconnecting from the network may be better than doing nothing.
8. Use System Restore to get back to a known-clean state
If you have System Restore enabled on your Windows machine, you might be able to take your system back to a known-clean state. But, again, you have to out-smart the malware. Newer versions of many malwares can have the ability to delete “Shadow” files from System Restore, which means those files will not be there when you try to to replace your malware-damaged versions.
9. Set the BIOS clock back
Much of the last half of 2016 malware has a payment timer that is generally set to 72 hours, after which time the price for your decryption key goes up significantly. (The price may vary as Bitcoin has a fairly volatile value. At the time of writing the initial price was .5 Bitcoin, which then goes up to 4 Bitcoin) You can “beat the clock” somewhat, by setting the BIOS clock back to a time before the 72 hour window is up. I give this advice reluctantly, as all it can do is keep you from having to pay the higher price, and we strongly advise that you do not pay the ransom. Paying the criminals may get your data back, but there have been plenty of cases where the decryption key never arrived or where it failed to properly decrypt the files. Plus, it encourages criminal behavior! Ransoming anything is not a legitimate business practice, and the malware authors are under no obligation to do as promised – they can take your money and provide nothing in return, because there is no backlash if the criminals fail to deliver.
10. Seek expert advice to ensure you are fully protected…..
