09/06/2014
RANSOMEWARE - HOW TO PROTECT YOUR COMPUTER
In the last few years a whole new category IT threat has emerged called ransomeware.
What is ransomeware and how it is different from Viruses and Malware?
Ransomeware is a kind of malware attack where rogue software installs itself on your computer and encrypts your files so that you can no longer use them. Usually you are offered your files back if you pay an amount of ransome – often between $500 and $5,000.
The first of these was called Cryptolocker and there have been a number of variations of these over the last 1-2 years. Unfortunately it’s likely that more variations of these attacks will become more frequent.
From what we have seen so far these are different to viruses in that they don’t attempt to spread to other computers or networks. Instead they focus their efforts on taking hold of any systems that they do infect.
If they don’t (so far!) spread like viruses, then how do people catch these?
Right now the most common way is through links or attachments to emails – ones we have seen recently say “delivery notification” or “ebay payment failed”. Also usually safe websites can be compromised and just by using a compromised website, clicking on links on it or installing software from it you may unexpectedly be inviting this malware onto your computer.
Once a computer is infected with ransomeware it will begin quietly encrypting all of your data. Only when it’s finished does it usually show the “message of demand”. If your computer has been infected initially you would expect to see lots of disk activity, for the computer to run slower than normal, and you might not be able to open some files.
What should you do if you suspect a ransomeware?
If you see these symptoms you should:
Immediately power off your computer.
Disconnect it from all networks wired and wireless.
Have somebody who is experienced in treating these kind of problems investigate it for you.
These steps might sound a bit drastic! But we recommend that you do this because with this kind of attack time really is of the essence and the sooner this attack is stopped the less of your files that will have been damaged. Worryingly these attacks also target any backups that your computer can see. So if you have backups on a USB memory stick or a removable hard drive, Network attached storage unit (NAS) or on a fileserver or even a cloud service like dropbox, these files too can be damaged.
Be very cautious about looking for removal tools on the Internet and using them yourself as some of these “removal tools” contain other viruses or malware. This is why it’s important to have somebody help you who has experience with this.
How do you recover from this?
By removing the ransomeware software with appropriate software tools while the computer. The tools used and exact method varies with the version of the ransomeware, but fortunately so far we have found that removing the ransomeware is fairly straightforward and has so far always been successful.
Restoring files from backup is the best way to recover your data. If backups are not available, we have recently seen some tools that claim to be able to decrypt your word, excel, outlook and powerpoint files. You should approach these tools with caution too! It’s likely that some of these will work, while others may introduce problems of their own.
How do you protect yourself against this kind of attack?
Good backups are key. Backups should be automatic, back up all your data, keep multiple copies and very importantly in this case – some of your backups need to be not accessible from your computer. Eg on several hard disks that you rotate from time to time so that they are not always connected to your computer where the backups might also be damaged.
Apply security patches appropriately. Many of these attacks rely on problems that have been discovered (and fixed) in mainstream software including Windows, web browsers and browser addins and Office. Patches are regularly released that fix known problems, then over time more problems are discovered, and then more patches are released.
Have a good antivirus/antimalware package installed and keep it updated.
Be cautious about opening any attachments and clicking on links in emails and on websites and installing software or apps.
I do all of these things – why did I still get attacked?
Sadly while doing all of these things reduce the chances of a successful attack on your computer – because new threats are being discovered and released all of the time there is the possibility that a new threat – that your protective software does not yet know how to defend against - might still be able to get through to your computer. This is referred to as a “Day 0” attack.
I’m not running a Windows device – does this mean I don’t have to be concerned?
You still need to be careful. A variation of this ransomeware has recently been affecting Android smartphones and tablets. Other devices, including ones made by Apple, will almost certainly be affected too. Do not believe that your computer/phone/tablet is safe just because it’s not running Windows.
