Category: Ransomware

Legislation has yet to catch up with technology. Perhaps – finally legislators will begin to understand that they have some power to actually protect consumers where new technologies are concerned. There is hope coming out of California where tech law is concerned.

State legislation to outlaw ransomware is drawing broad support from tech leaders and lawmakers, spurred by an uptick in that type of cybercrime and a series of recent attacks on hospitals in Southern California.

The bill, authored by state Sen. Bob Hertzberg (D-Van Nuys), would update the state’s penal code, making it a felony to knowingly use ransomware, a type of malware or intrusive software that is injected into a computer or network and allows a hacker to hold data hostage until money is paid.

Ransomware has become a lucrative industry over the last three years, affecting schools, police departments and healthcare businesses. Trojans that work like viruses, such as CryptoLocker — which began appearing in 2013 — can be unleashed by users with few technical skills and reel in profits.

Proponents say the proposed ransomware law is the right step to counter attacks difficult to prosecute under existing statutes that are not tailored to combat computer crime. But some question just who will get caught in the dragnet, as such incidents are tough to trace and culprits are often overseas.

Victims nationwide lost more than $209 million in ransomware payments in the first three months of 2016 alone, compared with $25 million in all of 2015, according to the FBI.

But no arrests were made. Nor were arrests made in more than half a dozen of ransomware incidents investigated by the Cyber Investigation Response Team of the Los Angeles County district attorney’s office, which is a co-sponsor of the bill.

Ransomware Defined

Ransomware attacks are instigated when a person clicks on a compromised website or opens an infected email. The programs encrypt files, such as photographs, videos or documents, and they cannot be accessed without an encryption key.

Security researchers first saw similar attacks in 1989, when the so-called AIDS Trojan virus locked people out of their files if they clicked through a quiz about their sexual and drug habits. Ransomware has evolved over the last decade with the creation of “police screen lockers,” pop-up screens that appear to be created by law enforcement agencies that fraudulently order people to pay fines after accusing them of downloading pirated movies or child pornography.

At the federal level, prosecutors can use the Computer Fraud and Abuse Act to target ransomware. But state prosecutors typically must pursue such cases under laws against extortion, or those that target threats to injure a person or property that have not been acted upon.

The internet can be a very scary place.

Over the past week, computers throughout Europe and other places have been hit by a massive email spam campaign carrying malicious JavaScript attachments that install the Locky ransomware program.

Antivirus firm ESET has reported a spike in detections of JS/Danger.ScriptAttachment, a malware downloader written in JavaScript that started on May 22 and peaked on May 25.

Many countries in Europe have been affected. The company’s telemetry data also showed significant detection rates for this threat in Canada and the U.S.

JS/Danger.ScriptAttachment can download various malware programs, but recently it has been used to primarily distribute Locky, a widespread, malicious program that uses strong encryption to hold users’ files hostage.

While Locky doesn’t have any known flaws that would allow users to decrypt their files for free, security researchers from Bitdefender have developed a free tool that can prevent Locky infections in the first place. The tool makes the computer appear as if it’s already infected by Locky by adding certain harmless flags, which tricks the malware into skipping it.

The use of JavaScript-based attachments to distribute Locky began earlier this year, prompting Microsoft to post an alertabout it in April.

The attachments are usually .zip archive files that contain .js or .jse files inside. These files with will execute directly on Windows without the need for additional applications.

However, it is very uncommon for people to send legitimate applications written in JavaScript via email, so users should avoid opening this kind of file.

Will Locky make it to the United States in a big way? I hope not. However be sure to be aware of it and use all of the security tips we have recommended in the past.

If you are a regular reader of this fine technology blog you must know that ransomware is dangerous, malicious and becoming more widespread with each passing day.  You do not need to panic because there are steps you can take to minimize the risk that your computer will be infected.

Update Often

Make sure that your software, operating system and plug-ins like Java and Flash are kept up-to-date by turning on their automatic update feature.

Some hackers are exploiting vulnerabilities in those programs to install ransomware automatically when consumers visit hacked websites.

Back-Up Your Data

If your files are locked by ransomware, the only way to recover them without paying the ransom is from backup copies. If you are not yet doing regular backups, you should start.

Even if you are doing regular backups – beware. Some ransomware can find and encrypt files on anything that looks like an attached drive, including external hard drives you may have connected, drives you may have on your local network or cloud services like Dropbox and OneDrive

To protect yourself use cloud backup services like Carbonite or Mozy in addition to an external hard drive that you disconnect after each backup. You should back up your data in multiple places or on to multiple drives.

Run Anti-Virus Software

First please keep it up-to-date and have it set to scan for viruses automatically. Anti-virus software can usually detect and block known ransomware.

However be aware that anti-virus programs typically struggle to identify and protect your computer from new versions of ransomware, so they are not a perfect solution. Some anti-malware programs can act as a kind of backup, allowing you to undue changes ransomware and other malware have done to your computer.

Think Before You Click

This bay me one of the most important tips here. Be skeptical of links or documents sent to you in email and be wary of clicking on them. A good rule here is that if you did not specifically request the links or documents contact the sender directly (in person or by phone) and verify the legitimacy of the email before clicking on anything.

A new wave of crypto ransomware is hitting Windows users courtesy of some poorly secured websites. Those websites are infected with Angler, the off-the-shelf, hack-by-numbers exploit kit that saves professional criminals the hassle of developing their own attack.

The latest round is especially nasty because before encryption, the drive-by attacks first use malware known as Pony to harvest any login credentials stored on the infected computer.

The Details of Pony

The campaign is carried out by installing a cocktail of malware on the compromised PC. The first payload consists of the notorious data thief Pony, which systematically harvests all usable usernames and passwordsfrom the infected system and sends them to a series of Control & Command servers controlled by the attackers.

The purpose of this action is to abuse legitimate access credentials to web servers and CMS systems used by websites and to inject the malicious script in these websites so that the campaign achieves the largest possible distribution.

In the second phase, the drive-by campaigns unfolds via the victim being moved from the legitimate website, which has been compromised, to a heap of dedicated domains which drop the infamous Angler exploit kit.

The Angler exploit kit will then scan for vulnerabilities in popular third-party software and in insecure Microsoft Windows processes, if the system hasn’t been updated.

Once the security holes are identified, Angler will exploit them and force-feed CryptoWall 4.0 into the victim’s system.

To consider just how insidious attacks like these are, consider this: earlier this week it was  reported that the Reader’s Digest website was actively infected by Angler. A reader promptly replied that someone in his organization had visited the site in early November, four weeks before the article was published and was infected by CryptoWall after reading an article. The target’s only mistake, it seems, was failing to update one of several apps.

Crypto ransomware came to the world’s attention in the second half of 2013 with malware calling itself CryptoLocker. Since then, there have been a dozen or so copycat titles and a steady stream of refinements to further befuddle targets. People should be sure to keep operating systems, browsers, and browser plugins updated with the latest security patches and strongly consider uninstalling Flash and Java.