“With me, everything turns into mathematics.”
– Rene Descartes
Ransomware is not new. Beginning as misleading ads, and warnings that your computer is infected, Symantec traces ransomware deployments (including crypto lockers) back to 2005.[1] Early crypto locking extortion scams were not that successful. However, current business owners face increasing risk of cyber extortion, and crypto locking ransomware has been on the rise over the past two years. It has become so prevalent that the FBI issued a warning highlighting the increasing threat to businesses.[2] Given the increasing velocity of deployment, the ease of infiltration, and the dire consequences of infection, we believe ransonware is a significant risk to businesses.
There are two primary factors contributing to the rise of ransomware:
- More real-time business data has been digitized, especially in health care and loan processing, which has increased the available pool of targets.
- Anonymous payment systems make monetizing ransomware easy, efficient, and risk-free for cyber criminals.
Observed samples of ransomware in 2014 totaled almost 9 million, yet in Q2 2015 alone, samples hit 4 million. This run rate is doubling year over year. Ransomware, unlike many vulnerabilities and malware, does not require administrative privileges, as its purpose is to encrypt the files useful to the end-user. Furthermore, the same types of scams and hooks that make ransomware successful on Windows are being deployed against other platform targets.
What systems are at risk?
Cyber criminals have built ransomware kits that target a wide range of systems, including Windows, Linux, Android, and recently (March 2016) Mac OS. While the majority of ransomware successes are still on Windows, users should be alert to the increasing risk of ransomware on Android, which is on the rise. Android ransomware could become particularly troubling in dedicated devices used in health care, manufacturing, and retail.
How does ransomware behave?
On Windows, ransomware works to impair your computer in one of three common ways:
- Encrypt your files (Locky and Cerber).
- Prevent you from accessing in certain apps (FakeBsod – locks browser).[3]
- Restrict access to the operating system itself (Revton – locks PC).
On Android, ransomware falls generally into one of two types:
- 1. Screen locking.
- 2. File encrypting.
Unfortunately for Android users, both forms of ransomware are increasingly seen in the wild. The chronology of Android ransomware follows a similar pattern to the Windows chronology; it begins with a fake antivirus, then fake police demands, followed by full cryptographic file locking. Versions of Simplocker malware on Android encrypt the SIM card; versions of Lockerpin acquire administrative privileges and prevent access to the device.[4]
On Linux, the most common target is web servers. The ransomware Linux.Encoder.1 has been reported in the wild since November 2015. This variant does require root privileges, and it walks the web server file directory structure as well as nginx, /root and others.[5] The reported ransom for this variant is one bitcoin.
Fortunately for Mac OS users, the first reported ransomware that encrypts Mac OS files has not been widely deployed or successful. With only 6500 downloads identified, Mac OS ransomware is a drop in the proverbial bucket.
What organizations are likely targets?
As mentioned above, real-time access needs for critical data create the easiest targets for ransomware. While no individual or business is free from worry, public service (police stations) and health care (hospitals) have been successfully targeted in the last 12 months. We can infer that other businesses, such as title companies, car dealerships, and other loan processors are likely targets as well. The criticality of data in these organizations is intuitive, and most cyber criminals keep the ransom amount “reasonable” (around $10,000). This amount is low enough that it appears to be economically rational for businesses that need to restore access quickly. Additionally, setting up a bitcoin wallet is relatively straightforward, with a number of YouTube how-to videos readily accessible. For an individual system, or business with less real-time critical data, the price is usually a single bitcoin.
What defensive steps can you take?
Prevention is, of course, the goal. However, between the ranges of infection vectors (SMS on Android, browser exploitation, spam malware, and exploit kits), and the volume of ransomware samples observed in the wild, the risk of initial infection of ransomware is difficult to eliminate. Therefore a combination of preventative tactics as well as planning for incident remediation is the best risk-mitigating course of action.
Preventative Actions
- Educate your users on the risk. Users who process a large number of inbound attachments and emails, such as accounts receivable processors, account managers, and marketing personnel, are particularly vulnerable.
- Maintain patches on desktop users’ systems, as well as critical data servers. Desktop users are often updated in a haphazard manner, or not at all, which makes them vulnerable to exploitation.
- Reduce or eliminate automatic mapping of drives. Recommended by thwack community member Stephen Black, eliminating automatic drive mapping means the ransomware won’t be able to walk your network from one initial infected system.
- Monitor for infections to prevent contagion. If you use LEM, there is a monitoring rule you can download and use. https://thwack.solarwinds.com/docs/DOC-186700
Incident remediation
If you find yourself in the unfortunate situation where a system has become locked with ransomware, you have limited options. While some researchers have been successful reverse engineering ransomware, the ability to do so takes time and depends on vulnerabilities in the ransomware code itself. If you were lucky enough to be hit by one of these old variants, you can use the techniques the researchers have published.[6] But, realistically, for most situations there are only two real options:
- Restore from backup.
- Pay the ransom.
If your business fits in the class of organizations currently being targeted, or shares characteristics with organizations being targeted, it would be prudent to actually test your ability to restore from your backup media, whether that is a cloud backup, local backup, or offsite backup. Businesses with Android users are encouraged to explore mobile device backup, or at least educate your users on their options.[7] Unfortunately, the only time the restore from backup process is usually tested or validated is during an audit, or test of a business continuity or disaster recovery plan, which may be too late.
Do you have a favorite way to use LEM to look for malware?
When did you last test your business continuity plan?
Know anyone who has successfully recovered files after a ransomware attack?
Share your stories so we can all benefit.
[1] Symantec, Internet Security Threat Report, 2016 pg. 58
[2]https://www.fbi.gov/news/podcasts/thisweek/ransomware-on-the-rise.mp3/view
[3]https://www.microsoft.com/security/portal/mmpc/shared/ransomware.aspx
[4]http://www.welivesecurity.com/2015/09/10/aggressive-android-ransomware-spreading-in-the-usa/
[5]http://vms.drweb.com/virus/?i=7704004&lng=en
[6]https://labs.bitdefender.com/2015/11/linux-ransomware-debut-fails-on-predictable-encryption-key/
[7]http://www.gottabemobile.com/2016/01/11/how-to-backup-android/