Blog

Ransomware isn’t exactly a new threat, and it continues to grow over recent years as a means for cyber criminals to extort individuals or businesses by way of locking down their devices and – you guessed it – essentially demanding a ransom for it to be unlocked. With reports of ransomware being more widespread as far back as 2015, you’d think by now it would have been dealt with more efficiently, however, according to research ransomware generated an estimated $1 billion in 2016 alone.  It also has a low cost structure (so, very profitable) and the victim directly sends the perpetrator money.

What is Ransomware?

Ransomware, in a nutshell, is a form of malware that essentially locks down access to your computer data. This is usually done by way of encrypting as much personal information on your PC as it can find, or by just locking your screen entirely. The malicious software will then demand a payment from you (a ransom) before your data will be unlocked again – simply put, it is holding your computer, files and data hostage until you pay a fee. Most commonly, ransomware infects your PC when you click a link in an infected e-mail.

A survey of companies who were infected by ransomware includes cautionary facts for those who might be thinking that paying the ransom and moving on is the fastest and simplest solution.  Most of the companies who paid, paid in excess of $1,000 (per computer) in order to recover their data. But, not surprisingly, only 55% of the companies who paid actually received the decryption keys and re-gained access to their devices. The cheapest and safest ways out of a ransomware attack are: try hard to avoid the social engineering tricks (do your due diligence to avoid an infection happening) and keep backups of your important files and data. Paying the ransom simply isn’t a wise option.

How Does Ransomware Spread?

The most common method of spreading ransomware is using a tactic known as “social engineering”. Generally speaking this is a way of tricking you into infecting your own device. Most commonly this is achieved via an e-mail, but could also be a malicious ad or popup on the web or a web page itself. It usually consists of an enticement to click or download an attachment, document, picture or video. Microsoft Office files, PDFs and multimedia files can all be the carriers for the ransomware program.

How Do I Know If I’ve Been Infected?

It’s quite difficult to not notice that you’ve been infected by ransomware due to the nature of the infection itself. Usually your entire screen will be taken over by something like the below images:

It’s very common for these types of screens to claim to be part of the government or law enforcement. This is social engineering in an effort to create fear of government reprisal for failure to cooperate.

How to Not Get Infected by Ransomware

For businesses, there are many different variables in play that can make it difficult to be completely secure against ransomware attacks. We highly suggest you utilise Managed IT Services to ensure your systems are kept up to date and you have the very best malware and virus protection on your devices at all times.

For individuals and home computers, the below guidelines can be very helpful:

• Don’t click links or open attachments in an e-mail, unless you know who sent it. Even then, consider contacting the person to see if they really did send it.
• Be suspicious of directives to “click this patch” for Adobe, Flash and some other common tools – there is a high chance this is malware. If you want an Adobe patch, go to the adobe site and get it yourself.
• Be alert for news that there are new methods of infection. For example, malvertising may become a popular method of infection.

Is your computer and Network Security up to scratch? Regardless of whether the device has been locked, a recent vulnerability in Windows 10 has given hijackers an easy route to taking over – simply by using the digital assistant, Cortana, to execute commands. If you’re running Windows 10, you may want your IT Support personnel to tighten up the security on your systems.

Security software giant McAfee provided an in-depth analysis of the new vulnerability, which states that the “Hey, Cortana!” voice command (a default feature enabled in Windows 10) could be triggered even when the device was in a locked state, giving potential attackers a route to being able to see files, information and potentially allow arbitrary code execution.

Due to the vulnerability, it is possible to launch a Windows contextual menu by typing when Cortana starts to listen to a query on a device that is locked.

“All the results presented by Cortana come from indexed files and applications, and that for some applications the content of the file is also indexed. Now we can simply hover over any of the relevant matches. If the match is driven by filename matching, then you will be presented with the full path of the file. If the match is driven by the file content matching, then you may be presented with the content of the file itself,” McAfee explains.

Once hackers have gained access to contents and files, they can potentially continue the hijack and gain code execution rights – all from the Windows lock screen. This type of vulnerability will allow malicious individuals to run scripts (via things like PowerShell or Command Prompt) and commands without the need for parameters and without needing to have the device unlocked. It can even be possible, for example, for the hacker to remove software from the system.

You can test your system for the vulnerability simply by following the instructions as outlined by McAfee – if you can successfully follow these steps then we strongly advise you patch your system.

Luckily, Microsoft has already released a patch (as part of this month’s Patch Tuesday rollout) to address this vulnerability, but for systems that haven’t yet received this update, we strongly advise you get the latest patch or simply switch off Cortana until you have updated.

As part of our Managed IT Services, you can have peace of mind that your operating systems are always up-to-date with the very latest security patches and rollouts.