Ransomware Everywhere: What’s The Technology Behind It?

If you were worried about ransomware two years ago, you were almost certainly either a security specialist or a victim. According to the FBI, US companies paid $25 million in ransom last year, and it expects the 2016 total to be more than $200 million.

If my experiences during the early years of the phishing epidemic are any indication, the dire predictions will turn out to be wrong, because they weren’t dire enough.

Hackers jumped onto the phishing bandwagon by the thousand when they learned that there was an easy way to make money from their skills instead of plastering websites with graffiti. In the early days, stolen credit card numbers were as good as money in the hacker’s pocket. Today, the actual theft of the credit card numbers is only one step in a complex process of bank fraud.

Until recently, targeting businesses was work for specialist cybercriminals.
Also, attacks on critical infrastructure and the Internet of Things have also been rarely realised theoretical concerns. There are many hackers who would think that bringing down a power station with a cyberattack is cool, but making that happen would require a group effort to build the necessary hacker tool chain.

Over the past 30 years, the world has become increasingly dependent on computer systems and computer communications infrastructure. Shut down the net, and water stops flowing in the taps; the lights go out, and food stops appearing on the shelves in stores. A few days later, the public health emergency resulting from the loss of the sewage system is felt.

We live in a technology trap that, until recently, nobody has had both the means and the incentive to trigger. Ransomware is the game changer.

Current backup strategies were, for the most part, designed in the 1970s to deal with the problem of hardware failures and natural disasters. Enterprise backup systems make recovery from a ransomware attack possible, but they don’t make recovery quick or easy. And until recently, they didn’t need to. What was the chance that you would need to re-image every one of a thousand machines in your network from off-site backup?

Some of the recent ransomware attacks have targeted the backup strategies themselves. One particularly nasty example lurks silently in the background, providing transparent access to the locked files for 30 days or more, just enough time to let those back-ups to become overwritten.

Compounding the problem is the fact that disk storage has run far ahead of archive technology. A 6TB hard drive costs a couple of hundred dollars. The only readily available, cost effective archive medium for such a device is another 6TB hard drive.

As every backup storage vendor will attest, backup must always be the last line of defense. The first line must always be making sure that the machines don’t get infected in the first place.

All three prongs of anti-malware defense are now essential: Scan inbound email to eliminate executable payloads and links to malware sites; block access to the malware sites themselves; and run default-deny anti-virus on every computer.

That just leaves one small problem: How does the modern enterprise even know how many computers it has?

One of the main reasons hospitals have become ground zero for the ransomware attacks is that almost every modern medical device is now a computer. They are computers with highly specialized peripherals, but still computers, and many run the consumer operating systems the hackers already know how to subvert.

It is not uncommon, usual even, to find a multi-million dollar device such as an MRI machine running Windows XP Embedded, an operating system version that was last updated, when it was retired, in 2011 and is scheduled to have all support stopped on it at the end of this year.

Would doctors consider it acceptable to use a medicine five years after the manufacturer’s expiration date? They do that with equipment every day. Until recently, that hasn’t been a problem because even though vulnerabilities existed, there hasn’t been much of an incentive to create exploits targeting hospitals. Ransomware has changed that.

So how do the authorities bring the ransomware epidemic under control before it becomes a pandemic? The lesson we learned from the phishing epidemic was that the surest way to deter profit-motivated Internet crime was to cut off the money supply.

Arresting mules and money movers didn’t put the people behind the phishing scams behind bars, but it did reduce their earnings. The wholesale price of stolen card numbers collapsed as a series of new countermeasures made using them the hard part of the crime.

The infrastructure that makes ransomware possible is bitcoin and its imitators, and the epidemic will continue to grow until they are shut down.

The idea of shutting down bitcoin is controversial in the technology community, of course, but not in law enforcement. Those of us that have followed the Internet payments field since its start know that bitcoin is not the first, but merely the latest in a long list of similar schemes, all of which were ‘completely different’ to everything that had come before.

E-Gold, Gold Age, Liberty Reserve and dozens more all promised to be secure against the threat of government regulation until the day the FBI came calling.
 
Right now, ransomware isn’t quite enough of a problem for the regulators to make a move. If the problem gets worse at the same rate phishing did, they will have little choice.

Information-Management: http://bit.ly/1qn8CSm

« Hacking Team Postmortem
Syrian Government Hacked »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

ZeroFox

ZeroFox

ZeroFox safeguards modern organizations from dynamic security risks across social, mobile, surface, deep and dark web, email and collaboration platforms.

Daon

Daon

Daon offers a universal biometric authentication platform for mobile devices.

Dispersive Networks

Dispersive Networks

Dispersive Virtual Network is a carrier-grade software-defined programmable network that is inspired by battlefield-proven wireless radio techniques.

Center for Cyber & Homeland Security (CCHS)

Center for Cyber & Homeland Security (CCHS)

The Center for Cyber and Homeland Security at Auburn University is a nonpartisan think tank that works to develop innovative strategies to address current and future threats to the United States.

Worldline

Worldline

Worldline IIoT solutions allow industrial companies to start their digital transformation journey with industrial level cyber security standards (IEC 62443 ready).

Texas A&M Cybersecurity Center

Texas A&M Cybersecurity Center

Texas A&M Cybersecurity Center is dedicated to combating adversaries who desire to harm our citizens, our government, and our industry through cyber-attacks.

Nettoken

Nettoken

Nettoken is the first identity management platform designed for everyday internet users, to encourage awareness and control of our ever expanding digital footprint and personal cybersecurity.

Greenberg Traurig (GT)

Greenberg Traurig (GT)

Greenberg Traurig, LLP (GT) is a global law firm with offices in 40 locations in the United States, Latin America, Europe, Asia, and the Middle East.

Grayshift

Grayshift

Grayshift is the leading provider of mobile device digital forensics, specializing in lawful access and extraction.

Predatech

Predatech

A cyber security consultancy offering a range of services, including CREST accredited penetration testing, vulnerability assessments and certifications incl. Cyber Essentials & Cyber Essentials Plus.

1Password

1Password

1Password combines industry-leading security with award-winning design to bring private, secure, and user-friendly password management to everyone.

Vantage Point Security

Vantage Point Security

Vantage Point are specialists in penetration testing and application security with a focus on the industries undergoing rapid digital transformation.

Topsec Cloud Solutions

Topsec Cloud Solutions

The Topsec Managed Email Security Platform eliminates Spam, Viruses, Malware, and Phishing.

Trustmarque

Trustmarque

Trustmarque delivers customer-centric IT solutions that enable better outcomes. We combine the technology, expertise and services to release value at every stage of the IT lifecycle.

Corsearch

Corsearch

Combining AI-powered technology and decades of industry expertise, Corsearch is revolutionizing how companies establish and protect their brands.

SecureAck

SecureAck

From our A-Op SaaS automation platform to Managed Automation-as-a-Service (MAaaS), SecureAck offer powerful security automation the way that best suits your organisation's needs.