The Biggest & Best Portal to the Professional Property, Workplace and Built Environment Community

Sunday, 25 February

Ransomware - the Protection Racket

ThisWeekinFM has been making a racket about Cyber Security because vulnerabilities are exploited at a personnel and personal level - where FM's should have some jurisdiction. We now answer the question, what is ransomware and how do you protect against it.

What would it mean if you lost all of your personal documents, such as your family photos, research or business records? How much would you pay to get them back? There’s a burgeoning form of cybercrime that hinges on the answers to these questions at a personal level - and of course at a business level...as the NHS and thousands of firms around the globe have just found out.

You have probably heard of viruses and malware. These dangerous pieces of software can make their way into your computer and wreak havoc. Malware authors are intent on stealing your data and disrupting the proper functioning of your digital devices.

 

Money or your life

Then there is ransomware. This is crafted by cyber-criminals for extorting data from innocent users and has now become the biggest threat to individuals, small business and corporate users alike.

Unlike malware, ransomware does not steal data. Rather, it holds it captive by encrypting files and then displaying a ransom note on the victim’s screen. It demands payment for the cyber-extortion and threatens obliteration of data otherwise.

While the concept of ransomware has existed for more than 20 years, it wasn’t until 2012 that several key technological advances aligned and allowed it to flourish.

Now ransomware has evolved. It combines file encryption, it uses 'dark' networks to conceal the attacker and uses (or rather, misuses) cryptocurrencies, such as Bitcoin, to prevent law enforcement from tracing the ransom payment back to the attacker’s den.

 

ROI

For a small upfront cost and with low risk of getting caught, ransomware developers can net good returns: industry estimates range from 1,000% to 2,000% return on investment.

 

What’s driving ransomware proliferation?

Paying small ransom amounts is quite simply adding to the problem. If you don’t, you lose your data; if you do pay, then you contribute to a worsening problem.

Yet for ransomware creators, it’s a lucrative business. Industry figures vary greatly but reports suggest that developers can earn more than US$1 million per year, which is enough to attract skilled programmers and engineers.

 

Paying-up

The recent global attack has been diffused but there have been many reports of businesses paying ransoms. Even the authorities aren’t safe, with several police departments in the US having paid ransoms in order to recover files. And we’ve even seen reports that FBI experts have advised victims to 'just pay the ransom' if they need their data.

 

Phases of a ransomware attack

The biggest concern with ransomware is the rate at which it is adapting to combat security protections. We recently examined the evolution of ransomware and found that ransomware developers are learning from their mistakes in previous versions. Each generation includes new features, and improved attack strategies.

We also found that over 80% of recent ransomware strains were using advanced security features that made them difficult to detect and almost impossible to crack. Things don’t look good for end-users; ransomware is increasingly using advanced encryption, networking, evasion and payment technologies. The developers are also making fewer mistakes and writing more cunning software.

It’s not a stretch to imagine a ransomware developer currently working on ways to attack corporate databases or versions that lay low while they identify all of your backup disks.

 

How to protect yourself

Recovering files from ransomware is impossible without the attacker’s approval, so you need to avoid data loss in the first place. The best thing you can do is practice good digital hygiene:

  • Don’t fall prey to social engineering or phishing, which is where an attacker attempts to have the employees in your organisation reveal sensitive information to them. Warn staff that if they receive a suspicious email from their grandma or work colleagues, ask whether it’s unusual before opening. If unsure, contact the sender via a different medium, such as giving them a phone call, to cross-check.
  • Stop staff from installing plugins or extensions unless they know they’re from a reputable source - or have been approved by the company. Ban USB sticks and the like until they've been scanned by IT on a completely independent device.
  • Update software regularly to ensure latest versions are running - not so easy for the NHS which is still using Windows XP because it can't afford to upgrade its proprietary software to run on protected systems.
  • Backup. Important documents need to be treated like valued possessions. Having multiple copies means the adversarial effort on holding you for ransom is pretty much worthless.

Ransomware is a very real threat. Its rapid growth is being driven by the low risk to attackers and good financial returns. We all need to stay ahead of the game.

 

About the Authors

Zubair Baig - Senior Lecturer of Cyber-Security, Edith Cowan University, Western Australia

Nikolai Hampton - Master of Cyber Security Candidate, Edith Cowan University, Western Australia

The authors do not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article and have disclosed no relevant affiliations beyond the academic appointment above.

Partners

Edith Cowan University

Edith Cowan University provides funding as a member of The Conversation AU.

The Conversation UK receives funding from Hefce, Hefcw, SAGE, SFC, RCUK, The Nuffield Foundation, The Ogden Trust, The Royal Society, Wellcome, Esmée Fairbairn Foundation and The Alliance for Useful Evidence, as well as sixty five university members.

Picture: Phases of ransomware attack

Article written by Zubair Baig, Nikolai Hampton

Share



Related Articles

Andromeda Strained - International Cyber Op Dismantles Botnet

On November 29, the Federal Bureau of Investigation, in close cooperation with the Luneburg Central Criminal Investigation Inspectorate in Germany, Europol’s...

 Read Full Article
WannaCry - Don't...Just Learn the Lessons

Earlier this year, ransomware took centre stage in one of the largest outbreaks ever, hitting a huge number of companies across the globe, writes Ravid Circus. There...

 Read Full Article
Watch What Staff Click - Ransomware Warning

Colin Tankard says the dust from the ransomware which hit major organisations around the world on Friday 12 may seem to have settled but vulnerabilities still exist in...

 Read Full Article
Phishing Docs and the Digital Signature?

Protecting digital documents and being able to verify that the sender of a file is, in fact, who they say they are, is fast becoming a major concern for many...

 Read Full Article
Who's Taking on the Cyber Men?

One in five businesses have fallen victim to cyber attacks in the past year, according to the results of a survey released this week ending April 21 by the British...

 Read Full Article
Ransomware - Universities and Students Under Attack

63% of British universities who responded to a Freedom of Information request made by SentinelOne, admit to being the target of a ransomware attack. Over half, 56%,...

 Read Full Article
Cyber Security - Tackle Staff Weak-point

With online crime becoming an increasing threat for businesses, new figures from Action Fraud and Get Safe Online released this week show that from March 2015 –...

 Read Full Article
World's Local Bank Back on World-wide Web

The disruption this week for HSBC and its online customers appears to be over as it declared matters were now ‘stable’ but embarrassment remains for the...

 Read Full Article
On Trend - Can Hackers Turn The Heat Off?

Ken Munro of Pan Test Partners has written a blog - the original of which and more pictures can be accessed if you Click Here  Munro says he has found...

 Read Full Article
London, Manchester Could Have Been Stopped. Different Actions - More Arrests

Attacks in London and Manchester between March and June 2017 The UK is facing an intense threat from terrorism according to all that commented on the publication of...

 Read Full Article