Posted on 03/21/2015 9:30:33 AM PDT by xzins
Ask security experts what to do when hit with ransomware – the sophisticated malware that infects a device or network, uses military-grade encryption to restrict access, and demands payment for the decryption key – and you'll typically get the same answer: "never pay the ransom."
But for many, that's simply not an option. For example, last November an employee in the Sheriff's Department in Dickinson County, Tenn., accidentally clicked on a malicious ad and exposed the office network to the infamous CryptoWall ransomware. Detective Jeff McCliss told local News Channel 5 that CryptoWall had encrypted "every sort of document you could develop in an investigation," such as witness statements and evidence photos. Even after consulting with the FBI and U.S. military, McCliss told the news station that the only solution was to pay the $500 to the cybercriminals to get their files back.
This wasn't an isolated case – for example, a police department in suburban Chicago recently paid a $600 ransom after it was struck by a similar attack, according to the Chicago Tribune. Although ransomware has been around in some (less successful) forms since the late 1980s, modern ransomware is designed to be essentially impenetrable. Only the malware author holds the private decryption key, meaning the only way to fight this threat is to prepare for it ahead of time. Enterprises that aren't fully prepared for a ransomware attack really have no incentive not to pay. In fact, many of those who do think they're prepared find that they have no option other than to negotiate with their hostage takers.
Organizations that employ real-time backup and frequently test their tools typically survive a ransomware attack unscathed – they can simply wipe the infected device and restore the backed-up files.
This is hardly the reality for many organizations, especially for mid-sized companies with limited to no IT resources or even larger organizations whose IT staff is spread thin. Even organizations that have prepared for this kind of scenario often find that their file restore functions don't work, says Stu Sjouwerman, CEO of security training firm KnowBe4, which has advised and assisted victims of ransomware. Many organizations that invest in a file backup solution fail to test their restore function. When they need it to work, they find that they cannot restore all the files that they backed up, rendering the backup efforts futile.
"They overlook [testing the restore function] all the time," Sjouerwman says. "It is a best practice, but IT is, as you well know, under a lot of pressure. They are forced to put out fires all day long and in the meantime also put new systems online. So it's hard to find time for that type of thing in a day-to-day IT environment."
From there, the decision to pay basically comes down to whether the data that was encrypted is worth more than the ransom demanded.
In most of these cases, paying the ransom is a "no-brainer" for the organization, Sjouwerman says. That's because ransomware is largely automated, demanding around $500 in exchange for the decryption key for all victims. The ransom for a police department's evidence might be the same for a personal PC user's photos.
"Ransomware is the Walmart of cybercrime. They just have decided to automate the whole process," Sjouwerman says. "And they are massively phishing as many email addresses and companies as they possibly can. For them, they have figured out that the business model is: some people will have backups, some people won't. Of the people that don't, it has to be a no-brainer."
The cybercriminals behind these attacks are concerned with maximizing the likelihood of their victims paying the ransom. Theoretically, they could increase the payout for cases where they've encrypted more valuable data. But the key is to make sure they pay up, and keeping the price within a reasonable range will increase the chances that more victims will pay.
Honor among thieves
Along these lines, many of the people behind ransomware have focused on creating a trustworthy reputation on the Internet, honoring all ransom payments and leaving victims alone once the exchange has been made. In December, Sjouwerman told CSO about a new strain of ransomware called OphionLocker that was designed to recognize the devices it had infected in the past so that it doesn't hit the same victims repeatedly. And in his experience working with ransomware victims, Sjouwerman says every victim that has paid the required ransom amount did receive their decryption key, most of them within an hour of sending the payment.
The objective is to make the decision as easy as possible for ransomware victims – if they pay up, they will receive access to their files and can put the entire ordeal behind them. "If they are not prepared and they are hit, most of them will pay," Sjouwerman says.
So it's not much of a surprise that ransomware has grown so rapidly since CryptoLocker, the now-defunct ransomware strain that brought this model to the internet, was released in September 2013. Symantec estimated in September (PDF) that CryptoLocker-style ransomware grew 700% in 2014. McAfee recently reported (PDF) a 155% growth of ransomware in the fourth quarter of 2014.
The IT security community may advise against paying the ransom as a means of removing the incentive for cybercriminals to engage in this kind of scam. But that is usually the last thing on the minds of IT decision makers who just want to get their files back and get back to work. For an organization that faces losing weeks' or months' worth of data, they can write off the expense as a learning experience.
"This is in jest and more ironic than anything else, but you almost have to be grateful to the Eastern European cyber mafia to send you a social engineering audit that tests both your employees and your IT department for being click-happy, and also if best practices are being implemented or done," Sjouwerman says. "It's a really cheap audit, for $500."
Cannot even remember how many people have come into my shop, “my computer won’t boot!!!!”
The hard drive is toast, and they had pictures and such that can’t be replaced....
Those are two of the 3rd party things I use first.
True. Just be sure the backup device is not left connected to the computer. Ransom-ware attacks all devices connected to the computer.
I have found storing backups off-site to be a best practice. Yes it's more trouble.
Easy enough to defeat it. Paying it never works.
I would never pay a penny to these people.
Ransom ware
I don’t think so, it has encrypted files that can not be decrypted. You probable got something else, but not this.
An ounce of prevention:
http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information#prevent
I prefer the "physically disconnected backup," a hard drive that I connect periodically and refresh when things are peachy. I want the time to detect the malware before accidentally putting it on the backup too. I know that some malware comes with 'long fuses' so that they can go farther before unpacking to do their damage, but this at least gives the IT guy (me) time for the antivirus people to get the word out. At most I'll lose a week's work.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.