Ransomware: What it is and how to avoid this virtual kidnapping tactic.

by IT Nation | Dec 16, 2019 | Cybersecurity, IT Security

So what is Ransomware actually? You may have heard about it on the news, the radio, from a colleague or there may even be a Ransomware infection warning on your screen right now.

What is Ransomware?

Ransom Malware, or “ransomware” is a type of computer virus that blocks you from accessing your computer system or personal files and demands payment in order to regain access. The earliest ransomware was developed in the 1980s, and payment was often sent through the regular mail. Today, ransomware developers demand that payment be sent through cryptocurrency, gift card, or credit card.

How did I Get Ransomware?

There are many  ways that ransomware can gain access to your computer or files. One of the most common methods today is through malicious spam, which is unsolicited email that is used to deliver malware. The email might include booby-trapped attachments, such as PDFs or Word documents. It might also contain links to malicious websites.

These methods leverage social engineering in order to trick people into opening attachments or clicking on links by appearing as legitimate- whether that’s by seeming to be from a trusted company or a friend. Cyber criminals use social engineering in other types of ransomware attacks too, such as posing as the FBI or IRS in order to scare users into paying them a sum of money to unlock their files.

Another popular infection method is malvertising. Malvertising, or malicious advertising, is the use of internet ads to distribute malware with little user interaction required. While browsing the web, even on legitimate sites, users can be redirected to criminal servers without ever clicking on an ad. These servers use cookies to catalog details about victim computers and their locations, and then select the malware best suited to deliver. Often, that malware is ransomware.

Types of Ransomware

There are three main types of ransomware, ranging in severity from mildly off-putting to extremely dangerous. They are as follows:

Scareware

Scareware, as it turns out, is not that scary. It includes rogue security software and tech support scams. You might receive a pop-up message claiming that malware was discovered and the only way to get rid of it is to pay up. If you do nothing, you’ll likely continue to be bombarded with pop-ups, but your files are essentially safe.

A legitimate cyber security software program would not solicit customers in this way. If you don’t already have this company’s software on your computer, then they would not be monitoring you for ransomware infection. If you do have security software, you wouldn’t need to pay to have the infection removed, you’e already paid for the software to do that very job.

Screen Lockers

When lock-screen ransomware gets on your computer, it means you’re frozen out of your PC entirely. Upon starting up your computer, a full-size window will appear, often accompanied by an official-looking FBI or US Department of Justice seal saying illegal activity has been detected on your computer and you must pay a fine. However, the FBI would not freeze you out of your computer or demand payment for illegal activity. If they suspected you of piracy, child pornography, or other cyber crimes, they would go through the appropriate legal channels.

Encrypting Ransomware

This is the truly worst ransomware. This ransomware can thoroughly encrypt your systems and files, while the criminals behind the attack demand payment in order to decrypt them. This type of ransomware is so dangerous is because once cyber criminals get a hold of your files, no security software or system restore can return them to you. Unless you pay the ransom, they’re gone. And even if you do pay up, there’s no guarantee the cyber criminals will give you your files back.

Who do ransomware authors target?

When ransomware was introduced (and then re-introduced), its initial victims were just computer users. Then cyber criminals began to realize ransomware’s full potential when they started targeting businesses. Ransomware was so successful against businesses, halting productivity and resulting in lost data and revenue, that its authors turned most of their attacks toward them. By 2017, 35 percent of small and medium-sized businesses had experienced a ransomware attack.

What to do if I’m infected

The number one rule if you find yourself infected with ransomware is to never pay the ransom. (This is now the recommended advice endorsed by the FBI). All paying attackers does is encourage them to launch attacks against either you or someone else. However, you may be able to retrieve some encrypted files by using free decryptors.

To be clear: not all ransomware programs have had decryptors created for them. In many cases, the ransomware is utilizing advanced and sophisticated encryption algorithms. Even if there is a decryptor, it’s not always clear if it’s for the right malware. You don’t want to make things worse by using the wrong decryption script. Therefore, you’ll need to pay close attention to the ransom message itself, or perhaps ask the advice of an IT specialist before trying anything.

How do I protect myself from ransomware?

Experts agree that the best way to protect yourself from ransomware is to prevent it from happening at all.

While there are few methods to deal with a ransomware attack, the solutions aren’t perfect, and often require much more technical skills than the average computer user is used to. 

Here’s how IT Nation, Inc. recommends avoiding ransomware attacks:

The first step in ransomware prevention is to invest in comprehensive cybersecurity program with real-time protection that’s designed to prevent advanced malware attacks such as ransomware. You should also look out for features that will both shield vulnerable programs from threats (an anti-exploit technology) as well as block ransomware from holding files hostage (an anti-ransomware component). Customers who were using the premium version of Malwarebytes for Windows, for example, were protected from all of the major ransomware attacks of 2017.

Next, as much as it may pain you, you need to create secure backups of your data on a regular basis. Our recommendation is to use cloud storage that includes high-level encryption and multiple-factor authentication. However, you can purchase USBs or an external hard drive where you can save new or updated files, just be sure to physically disconnect the devices from your computer after backing up, otherwise they can become infected with ransomware, too.

Then, be sure your systems and software are updated. The WannaCry ransomware outbreak took advantage of a vulnerability in Microsoft software. While the company had released a patch for the security loophole back in March 2017, many users didn’t install the update, which left them open to attack. We get that itis hard to stay on top of an ever-growing list of updates from an ever-growing list of software and applications used in your daily life. That’s why we recommend changing your settings to enable automatic updating.

Finally, stay informed. One of the most common ways that computers are infected with ransomware is through social engineering. Educate yourself (and your employees if you’re a business owner) on how to detect malspam, suspicious websites, and other scams. And above all else, exercise common sense. If it seems scammy, it probably is.