The great computer stick-up. Why ransomware is now the biggest online threat of all
Be warned. Cyber crooks are changing their modus operandi and widening their nets for snagging the unwary. Now that banks, retailers and online services generally have started taking extra precautions to protect their customers’ data, online thieves have been focusing less on breaking into computer networks to pilfer credit card details and the like.
Advertisement
The most pernicious malware today immobilises an infected computer, encrypts its files and then demands a ransom to release them. If not paid within 12 hours or so, the computer’s content gets obliterated. To make sure the hapless victim gets the message, a bright red clock begins the count down.
In America, the demand often appears to come from the Department of Justice (DoJ), the Federal Bureau of Investigation (FBI) or some other official body, claiming the computer has been used for an illicit activity, and a “fine” has to be paid to avoid prosecution.
Such bogus threats are all part of the recent spread of “ransomware”, which started in Russia a decade ago and is now endemic throughout Europe, the United States and Australia. No fewer than four million incidents of ransomware were reported in the second quarter of 2015 alone. Millions more are thought to have gone unreported.
Making money through ransomware
For cybercrooks, ransomware is now one of the easiest ways of making money. Hacking into online retailers and financial institutions to steal credit card and bank details may offer larger financial returns eventually, but selling the stolen data on the black market can be burdensome. By contrast, ransomware allows cybercrooks to get paid directly by their victims—with little effort, no special hacking skills, and negligible chance of being caught.
Several technological trends have collided of late to make this so. The first has been the confluence of powerful encryption algorithms (eg OpenPGP) allied to software for communicating anonymously over the internet (eg Tor) plus the global spread of untraceable digital currencies (eg Bitcoin). Combined, these three open-source technologies have made it so much easier for hackers to mount scams with relative impunity.
Ransomware is especially effective because many of its victims do not have time on their side. Hospitals are particularly vulnerable, since they cannot afford to wait to access medical histories of patients requiring urgent treatment.
Likewise, without the continual availability of data from suppliers, distributors and customers, modern manufacturing grinds quickly to a halt. Airlines closing flights prior to departure need to tally the “no-shows” with their “over-sold” seats. Disrupt any such mission-critical activity and costs—in human as well as financial terms—quickly get out of hand.
Other Trending Stories
Dealing with cyber crooks
This resource-rich/time-poor aspect of modern life has provided easy pickings for cybercrooks. To date, the largest publicly admitted ransom was the $17,000 paid in 2015 by Hollywood Presbyterian Medical Centre in Los Angeles. Usually, ransom demands are around $300 per incident. By not being too greedy, scammers ensure they will be paid promptly with no questions asked.
Often having brought the problem upon themselves, victims feel embarrassed and intimidated into paying up immediately to get their systems back online—and avoid the opprobrium and censure of colleagues. In many cases, even the FBI advises victims to settle and move on.
Early forms of ransomware zipped up (i.e. compressed) the files on an infected computer and overwrote the originals, leaving only a password-protected zip file behind. If the files had not been backed-up beforehand, the victim had to pay the ransom to receive the password for restoring the data.
Later ransomware immobilised the infected computer completely by overwriting its “master boot record” (a snippet of software on the hard-drive for loading the operating system) with malicious code that rebooted the computer and displayed a ransom message. CryptoLocker, one of the more common species, is said to have earned its instigator $3m before it was taken down by the DoJ in 2014.
Such exploits used to be limited to Windows computers. Not so today. Practically any device can now be held to ransom—including Macintosh and Linux computers, iPhone and Android mobile phones, even fitness trackers and smart watches. Meanwhile, derivatives such as CryptoWall, KeRanger (for Macs), Citroni and Locky have appeared on the scene, each more devious than the previous. The latest versions cannot even be detected by anti-virus software. Trend Micro, a cybersecurity firm based in Texas, reckons some four dozen families of ransomware are currently in circulation.
A second development that has contributed to ransomware’s notoriety is the way it has moved to the cloud—mirroring the trend in the legitimate software industry. Instead of selling their malicious software to cybercrooks one package at a time, black-hat programmers have turned to building tool-kits that can be rented by the day on the “dark web” and used by spammers to mount illicit e-mail campaigns and ransom attacks.
As such, “malware as a service” is making life easier still for extortionists. Trustwave Holdings, a security firm based in Chicago, says cyber criminals can now buy on-demand access to central servers administered by hackers, who keep them up to date with all the latest tools needed to exploit thousands of unsuspecting computers at a time. Trustwave calculates a typical malware campaign can earn over $84,000 in 30 days for an initial investment of just $5,900—a return of over 1,400per cent.
A third worrying trend is the rapid inroads being made by an entirely new form of ransomware. Instead of attacking personal computers directly, Samsam targets enterprise servers that run websites and dish out applications to users. The implication is that users no longer have to be tricked into visiting an infected website or opening a poisoned e-mail attachment. Without doing anything, they get attacked by their own servers. A single server can infect dozens, even hundreds, of client computers at a time.
Samsam preys mainly on computers running JBoss, a popular form of server software. To do so, hackers first troll the Internet for servers with unpatched versions of JBoss, using a standard testing tool called JexBoss. Once inside their target server, they open a backdoor in the operating system, so Samsam can then sneak in and hold the server’s clients to ransom.
The contagion does not end there. After infecting one server, Samsam is smart enough to reach out to other servers on the network, even ones that have been fully patched with security updates. A recent scan of the Internet by Talos, the cybersecurity arm of Cisco Systems of San Jose, California, found more than 3.2m potentially vulnerable JBoss servers running unpatched software. Of these, 2,100 had backdoors already installed, with Samsam either established or ready to take up residence.
What to do?
What to do? For those who have taken prior precautions, recovering a ransomed computer is fairly straight forward. Most likely the ransomware will have locked the computer—to prevent the system from being restored to a previous (pre-infection) condition, or repaired with the original system disk.
In that case, the usual recommendation is to pull the plug, load a bootable disk or USB drive with an anti-virus scanner on it, and then switch the computer back on. Generally, the anti-virus scanner (Malwarebytes is your correspondent’s favourite) will dig out the ransomware and quarantine it.
Advertisement
The next step is to recover the user’s files. As they will almost certainly be encrypted, with the key to unlock them held on the cybercrook’s server, Windows users may be able to recover some duplicate files that escaped encryption, thanks to the operating system’s “Shadow Volume Copies” service. This offers a snapshot of the data on the hard drive at one particular instant, and is usually used to help restore a computer after a system crash. Right-click the folder containing the encrypted files, select “Properties/Previous Versions” and keep all fingers crossed. If that does not work, then simply delete the encrypted files and load a fresh copy of them from back-ups stored off-site.
What, no stored back-up copies? It is true, some computer users really do live precariously—failing to back up their data regularly, ignoring security patches, not bothering to scan their computers frequently for malware, brushing aside warnings about downloading content from dodgy websites, opening e-mail attachments from unknown sources, trusting nothing untoward will ever happen to them. If the blissfully ignorant do nothing else, may they please back up their data at the least weekly.
Ultimately, the reason ransomware is enjoying such success is the inadequacy of today’s anti-virus programmes. Depending as they do on the software signatures of known malware, they are useless against anything they have never encountered before. As altering a software signature is a trivial exercise, hackers can tweak old ransomware programmes—to give them a fresh lease of life—far faster than anti-virus programmers can add new signatures to their lists.
To be fair, cybersecurity firms recognise this fundamental flaw in their anti-virus software. Most are working on ways of detecting and quarantining malware that analyse the attacking software’s behaviour, instead of simply checking whether its signature is on a list of known suspects. What all malware—and ransomware, in particular—have in common is a set of traits that no legitimate computer programme needs or is ever likely to possess. There has to be something fishy about any Windows software that blocks System Restore, disables System Repair, deletes Windows Shadow Copies, or stops such services as WinDefend and Background Intelligent Transfer.
Advertisement
Such behaviour is a dead giveaway that the computer is under attack. The behaviour-based defences then have good reason to kill any suspicious process, quarantine the files involved, and sever any connection to the outside world to prevent the infection from spreading. One day all computers will have their behaviour monitored this way. Till then, however, keep making those back-up copies. GB
PULLQUOTE
Ultimately, the reason ransomware is enjoying such success is the inadequacy of today’s anti-virus programmes.
KEYNOTE
- Cybercrooks are continuously looking for different ways to operate and as a result are widening their nets to those who are unaware of their actions.
- Now that banks, retailers and online services generally have started taking extra precautions to protect their customers’ data, online thieves have been focusing less on breaking into computer networks to pilfer credit-card details and the like.
Advertisement