Tag: threats

So, now you understand what ransomware is, and how to be prepared so you don’t have to pay the ransom if you get attacked by it.

But, prevention is better than fixing the problem after it has occurred. Unfortunately, as with many things in security, there is no guaranteed way to protect yourself (apart from never turning on your computer or mobile device; and that’s not a helpful solution).

On the other hand, there are some things you can do to make it less likely that you will be affected.

But first, let me list some of the common ways that computers become infected with ransomware:

   * E-mail
         – Opening attachments that have malicious components
         – Clicking on links, that take us to a site that infects us

   * Visiting a web site and taking an action that causes an infection
         – Clicking on something
               (including a box that says “close” or “cancel”)
         – Moving your mouse over something

           One type of web site notice that is known to be likely to infect you if you respond to it is one that says you have engaged in illegal activity and law enforcement is being notified, suggesting you take action now to avoid further activity and to “click here to get details”

   * Phone calls, e.g., a call from someone saying they are from an accounting or billing department and they are sending an invoice and to open it when it arrives or some other phone call that advises you to take some action. If you open the attachment when you receive it, you get infected.

   * Visiting sites that can infect us just by visiting them, with no need to take any action (discussed in the daily tips). This is the most insidious method, as we can become infected despite taking precautions. Use of an ad-blocker and turning off automated functionality may protect you in some cases from some of these, but even then, there is no guarantee you can’t be infected. And turning off functionality may affect other web sites you rely on and render them inoperative.

 

So, what can you do to reduce your chance of becoming a victim?

I provided daily tips during National Cyber Security Awareness Month. Many of those tips included measures that, if taken, can help to protect you.

Perhaps you read those and thought, “that makes sense,” or “I’ve heard that before but….”

It might be a good idea to go back and take another look at those. (You might also wish to purchase the long versions when they become available soon.) But, they will only help you if you apply them.

 

So, some of the measures you can take are:

   * Learn how the bad guys attack us so you can recognize attempts to victimize you

   * Be cautious of e-mail attachments. Don’t open any that are suspicious. Think before opening ANY attachment and consider whether it might be one that could be dangerous.

   * Be cautious about links in e-mail. Links are a useful way to refer someone to good information. But they are also used by bad guys to send you to a page that will infect your computer. Before you click on ANY link, consider whether it might be one that could be dangerous.

   * Don’t respond to pop-ups, web pages, e-mails, or phone calls that try to scare you to take action or some bad result will occur. Although there may be instances where a response would be advised (an alert from the community warning you about evacuation for a coming hurricane, if you have previously signed up to receive such notifications), any unsolicited scare announcements should be regarded as suspicious.

   * Set your e-mail settings to protect you, as discussed in one of the daily tips.

   * Don’t use administrative accounts for normal daily usage. Restrict your account to an account that doesn’t have full control. (Discussed in one of the daily tips.)

   * Use security software but don’t rely on it to keep you safe. It can block a lot of threats but none of it will detect all the threats, including ransomware threats. If security software is your only protection, you are at high risk.

   * If you see a pop-up or web page that says your computer is infected or you’ve engaged in some illegal activity, don’t click the link or take the action it tells you to. If you were to do that, you may infect your computer.

   * Keep your software updated (discussed in daily tips).

   * Keep reading this blog and enroll in my courses when they become available. The basic course will be quite reasonably priced and will give you a lot of detailed information that will significantly help you to keep safe. Alternately, find some other source of reliable information whereby you can keep informed to protect yourself and return to it regularly.

To wrap up these posts on ransomware, at least for now, your best approach is threefold:

1) Take appropriate measures to keep yourself safe (discussed above, although these are only some of the steps needed to keep safe)
(Prevention)

2) Have a backup that you know is reliable (don’t keep it on your computer) and either encrypt any data that is sensitive or remove it from your computer–discussed in last week’s post
(Recovery, after becoming infected)

3) Become informed and continue to keep yourself informed from a reliable source/sources
(Prevention)

Last week I talked about the problem of ransomware and how you can forever lose access to your data, unless you pay the ransom to the criminal who is extorting you.

What if you didn’t have to pay and you don’t lose access to your files? How would you like to thwart the criminal’s attempts to take advantage of you?

It is possible. But it takes preparation and periodic “maintenance.” And it has to be done properly. That is the catch. Most people fail at one of those.

What is the answer?

Back up your data.

If you have all your data available in another place, the threat of losing that data because of ransomware is no longer much of a threat. Of course, there is the inconvenience of getting your computer into a stable condition and also of replacing all that data. But, if you can do that, the criminal no longer has much leverage, as long as you are willing to take the steps to restore everything to the way it should be.

With this solution, you win in two ways. You can avoid having to pay the ransom. You also know that your computer is in a healthy state (if your backup was done before it became infected).

On the other hand, if you pay the ransom, and the criminal does restore your data to a usable state, there is still a problem. Do you trust the criminal who just took advantage of you to play honestly and fairly with you? Or did they perhaps leave some malicious software on your computer? Are they monitoring your activity? Will they repeat their crime again? There is a very good chance that your computer is no longer in a “safe” condition once it has been compromised, even though the criminal “fixed it” for you.

Let’s put it another way? If someone stole money from you, would you hire them to be your bookkeeper or your accountant?
 

So, you are better off having a backup and restoring your computer and data than if you rely on the criminal to fix things after you pay a ransom.

There are, however, some problems with this approach.

  *  Most people don’t back up their computers, even if they know it is a good idea to do so.
  *  Any new data added after the last backup would be “lost.” (The answer to this problem is to always back up any new data.)
  *  People who back up their computers and data often don’t do a good job and are unable to use their backups if they need them.
  *  The best way to restore after a compromise is to restore everything. Most people aren’t prepared to do this.

However, if you do have good backups and have all your important data backed up, you have everything you need and don’t have to worry about losing your data. You can refuse to pay the ransom and not worry.
 

Now, I’m sure many of you will see this as a major problem. You aren’t sure how to back up your computer or data. You have questions about what to back up and how to do it. And there are a lot more questions and concerns you may have.

To answer those questions and concerns, I will be creating a course on backing up your data. How soon I do that will depend in part upon the level of interest (how many people put their name on the notification list). If you are interested, you can sign up HERE. (Signing up does NOT obligate you to participate when the time comes, but does assure you will be sent notification.)
 

There is a second concern related to ransomware that is not nearly as common but does apply in some instances. As mentioned last week, in certain cases, the criminal will threaten to release your sensitive data to the public if you don’t pay.

There are two solutions to this problem. First, don’t keep anything sensitive on your computer. (This can be tricky, because there are sometimes traces of activity, even if you take precautions to eliminate it.)

Secondly, use encryption for any sensitive data. Best practices recommend encrypting anything you don’t want someone else to gain access to.

However, you need to use a good encryption solution and you need to do everything properly. There isn’t time to talk about that here. A lot of encryption is done poorly. However, even SOME encryption would probably be better than none. If your data are encrypted with a good solution, the criminal won’t be able to access your sensitive data. If the solution isn’t so good, it is still possible that they won’t find it worthwhile to try to break the encryption so they can blackmail you. They may go on to the next victim that hasn’t taken any precautions. (Just like a lock on the door of your house: A criminal can still break in, but if you take good security precautions on your home safety, there is a good chance they will find another victim, unless there is some reason they are really motivated to break into YOUR house.)

To review:

If you become a victim of ransomware and you can recover your computer and your data from backups, you don’t have to worry about losing access to your data. Although it may be an inconvenience, you can refuse to pay and still access your data.

If you are using a good encryption solution for sensitive data and not making mistakes in proper use of it, you are in good position to ignore any attempts to blackmail you with threats for release of that data.
 

To apply these solutions will require that you take measures BEFORE you become a victim. Your particular situation will determine how much effort that advance preparation will involve. You have a some choices:

  *  You can learn how to take those measures and apply them yourself.

  *  You can hire someone else to implement those measures for you. However, if you do this, I still recommend you learn at least the basics, for two reasons:
        –  You can make sure the person doing it is “covering all the important bases” and not missing something critical
        –   You will be aware of YOUR part in making sure the solution works as desired (if you make mistakes with backups, or especially with encryption, you may find that the backup or encryption fails to protect you)

  *  If you are in need of a solution for a particular situation, you can engage me as a consultant to work with you to discuss and/or address your particular circumstances.

Regardless of which choice makes the most sense to you, I want you to be aware of one thing:

QUIZ:

What is RansomWare?

a) Hacker’s threat to post your sensitive information online unless you provide payment

b) Malicious software that encrypts your files and demands a payment to recover them

c) Electronic communication (e-mail, text) from kidnappers stating their demands for return of victim, occurring most frequently with tourists to Central and South American countries

d) A popular new game app for the iPhone

 

Ransomware has been around for quite some time, but it has been increasing in prevalence, especially over the last couple years. I have seen a great deal of talk about ransomware in security circles this year. I have also seen instances of companies making promises of protection from ransomware that they can’t possibly keep.

In looking for statistics, I have found a wide range of figures for losses and/or ransom amounts paid, depending upon the source of information. However, multiple sources suggest that the payments were in the range of hundreds of millions of dollars last year with a significant increase for 2016.

 

So, what is ransomware? The correct answer to the quiz above is “b.” RansomWare is software that holds your information hostage until you make payment to the perpetrator. The perpetrator says they will make it possible to restore your access to your files if you make the requested payment. There is usually a deadline. If you miss the deadline, you are out of luck and will no longer be able to recover them.

However, if you answered “a,” you may be choosing a secondary tactic used by some ransomware criminals. Although the “threat” is usually that you will forever lose access to your files, there have been cases in which they have added a second threat that they will release your information to the public, probably posting on a web site. If the loss of the files isn’t incentive enough, perhaps public embarassment or the exposure of your sensitive data might be enough to convince you to pay. So, while “a” is not the correct definition of ransomware, it may be part of the “threat” in certain instances.

 

Pay up OR ELSE

Ransomware typically acts in one of two different ways.

The first method is to prohibit access to your files and your computer. Your screen may be locked or blocked so that your normal ability to use your computer is prohibited. If you pay the ransom, they promise that they will unlock your system.

The second method is more serious. Your files are encrypted and you can no longer access them. Or, more accurately, the contents of those files are no longer available. As an example, if your file used to say: “Once upon a time….” it now may say something like: “.8Y%r&b4g.cX7|KWm]+/#+}RL0PQ>I.” The file is now worthless, until it has been unencrypted (decrypted).

With earlier versions of some types of ransomware, it was sometimes possible to decrypt the files without paying because of the criminal’s poor implementation of the “cryptographic algorithm.” In other words, the developer of the software that encrypted the files didn’t do a good job of implementing the technology to encrypt them. That meant their encryption could be broken.

However, ransomware has improved in sophistication and the developers have been fixing the problems with their software. Their software is becoming “better.” That means that it is not going to be possible to break the encryption that is now being used and the files cannot be recovered without the help of the criminal.

So, how do you get your files back? The attacker promises to provide the mechanism to decrypt (unencrypt) those files, but only if you pay them. And, there is a deadline. The ability to decrypt your files and make them usable again depends upon a “key.” They have the key and can use it to decrypt your files so you can access them again. However, when the deadline arrives, they will delete that key. If that key is deleted, you will never get access to your files again. Not even the attacker would be able to help you once the key has been deleted.

Typically, there is a countdown timer counting down to the deadline. There are also instructions on how to make payment. The method for making payment is typically by using “Bitcoins.” That is the new “currency” of the underworld, although it is also being used by legitimate people as well. Payment with bitcoins makes it harder to trace.

Use of bitcoins makes it harder for most people to make payment. How do you pay with bitcoins? Where do you get them?

To solve that problem, the attacker (extortionist) will typically provide instructions. However, some will provide an alternative for those that have trouble understanding how to make the payment. In some cases, the attacker will agree to unlock your files and restore access to them if you allow them to use your computer in their efforts to infect others to collect payment from other people.

 

So, you can either fund future criminal activities by paying the extortionist (attacker) or you can agree to become an accomplice in the crimes by allowing them to use your computer to carry out their criminal deeds. (Next week, I will talk about other choices you have, where you can avoid paying, thwarting the criminal’s attempts, and still not lose all your information.)

 

The most publicized victims are corporations. Businesses of all sizes and types have been victimized. However, individual home computer users are also victimized. The amount of the ransom demanded usually varies, depending upon the ability of the victim to pay and, sometimes, on the value of the data or the importance of the system attacked. However, the attacker’s goal is to get paid, so the amount they ask is typically an amount that they expect the victim will likely be able to pay, even if it is expensive for them.

You may think that paying is the best choice, if it is an amount that you are capable of paying. There are several problems with this approach. As mentioned above, you will be funding the extortionist’s future endeavors and also encouraging them to continue their exploits. However, there are also numerous instances where the victim has paid the ransom and has not gotten their files back. Furthermore, in a number of cases, the attacker repeats the attack. They have gained access to your system and can hold it ransom again whenever they want to. They may also have planted other malicious software on it and may have extracted your data already as well. If you pay once, it seems likely that you will pay again if they repeat their attack again in a couple months.

For a number of reasons, paying is not recommended. The best options are prevention and having an alternative response in place.

There are things you can do to greatly reduce your chances of becoming a victim. There are also things that you can do to minimize the impact if you do get victimized. You should do both. Reducing your chance of becoming a victim is an important first step, but it doesn’t guarantee you’ll escape. But, if you have also taking steps to minimize the negative impact, you can turn a catastrophe into a mere inconvenience. Check back next week to hear more about that.