How to Respond - Encryption is used to foil decryption tools

How to Respond

Encryption is used to foil decryption tools

Between 2005 and 2016, ransomware infections were more common than data breaches, making them the most pervasive cyber threat of the last 11 years. Ransomware attacks may encrypt folders and files or even the entire hard drive, or they may just lock the devices so that users cannot access them. In recent years, attacks have become increasing sophisticated; crypters can make reverse-engineering extremely difficult, and offline encryption methods can eliminate the need for command and control communications by taking advantage of legitimate features.

A report from Kaspersky Lab revealed that its solutions found ransomware on more than 50,000 computers connected to corporate networks in 2015, which was twice the number detected the year before. In 2016, almost $210 million was paid to ransomware cybercriminals during the first quarter alone, and the FBI estimated that without paying losses for the year would have exceeded $1 billion.

Ransomware is not actually a new method of attack. The first known instance was PC Cyborg, a Trojan distributed by Dr. Joseph Popp in 1989. The malware would encrypt all files and hide all folders on the computer’s hard drive. A script demanded $189 in ransom, and the computer would not function until payment was received and the actions reversed. It did not take long for recovery tools to reverse the effects, but newer attacks have featured stronger encryption to foil decryption tools, making it almost impossible for victims to unlock their own computers.

Approximately 17 years after the introduction of PC Cyborg, a new strain called Archievus was released. Archievus was the first ransomware attack to use RSA encryption as well as the first known ransomware to use asymmetric encryption. It encrypted every file in the “My Documents” directory, and it was very difficult to remove unless victims purchased the password necessary to decrypt the documents.

Attacks Focusing More on Organizations

People had typically been the primary targets of “scareware” schemes that warned users their computers had been infected with malware that could be removed only by purchasing an antivirus software. The antivirus software was actually fake, and the only true threat was the warning message that repeatedly appeared, leading many people to pay the ransom just so the message would go away.

By 2011, anonymous payment methods made it easier for hackers to collect ransoms. Most payment demands require victims to remit payment in bitcoins, but various anonymous cash cards are also popular payment methods. However, hackers can make other ransom demands. For example, “hacktivists” might demand that a company reduce its carbon footprint or that an individual spread the malware to a set number of contacts to unlock his own computer.

As hackers have refined their skills, they began to focus on larger organizations with the budgets to pay substantial ransoms for the files and systems needed to conduct daily operations. In the past few years, there have been several wellpublicized ransomware attacks on major organizations.

In 2016, Hollywood Presbyterian Medical Center suffered a ransomware attack that shut down its computer network for more than a week, resulting in mass chaos. The hospital was forced to transfer some patients to other facilities to ensure that they received the necessary care. Only after the ransom—40 bitcoins or the equivalent of $17,000—was paid so HPMC could regain the use of its malware- encrypted files.

In 2015, the Swedesboro-Woolwich School District in New Jersey was the victim of a ransomware attack. The encrypted files were primarily staff-generated Excel spreadsheets and Word documents. The attack forced the district to delay its assessment tests, but the decision was made to not pay the ransom; the district had adequate backups to restore the servers.

Whether the ransomware attack is a targeted attack or a mass distribution, the attack will follow five distinct phases. Understanding the phases can help increase the chance of a successful defense: infection, Eexecution, backup removal, encryption and cleanup.

Infection. The attack cannot succeed unless the malware can be placed on a computer. Many ransomware attacks result from a phishing campaign, often through emails with infected attachments or compromised links. However, exploit kits that exploit vulnerabilities in software applications such as Internet Explorer and Adobe Flash are the preferred method for some malware attacks, including CryptoLocker.

Execution. An executable file will be placed on the target’s computer, usually beneath the user’s profile in the “TEMP” or “APPDATA” folder.

Backup removal. Within seconds of the execution, the ransomware finds and removes backup folders and files that exist on the system. On systems running Windows, the vssadmin tool is often used to delete volume shadow copies; this will create event log entries that can make detection easier.

Encryption. After removing backups, a secure key exchange may be performed with the C2 server. However, some ransomware types, including the SamSam malware, do not need to communicate with the C2 server; the encryption can be performed locally.

Cleanup. The final phase is to present the demand instructions and remove the evidence of the malware code. The presentation of the payment demand can help identify the strain of ransomware. For example, Locky changes the wallpaper to include instructions, while CryptoWall V3 stores the instructions in a HELP_DECRYPT file.

Preparing and Responding to a Ransomware Attack

When it comes to handling a ransomware attack, protection and prevention are the best and most effective defenses. There are five critical steps in defending against a ransomware attack: prepare, early detection, contain the damage, eradicate the ransomware and follow a recovery plan.

Organizations need to be proactive about patching to eliminate vulnerabilities, and be proactive about backing up their system and store backup files offsite or at least in a location other than the server. Having a well-defined incident response plan that includes an explicit plan for fast action to a ransomware attack is critical. In addition to adopting the practice of assigning least privileges, especially for file shares, limiting exposure can also limit the damage that a ransomware infection can cause.

Final preparation should include deployment of endpoint protection tools that can detect early attacks and respond to them quickly and automatically, and to educate all end users. People are the weakest link in most organizations, so companies need to make sure that they know what to look for and how to avoid phishing schemes and malvertising. All users should be warned against plugging in any portable storage devices of unknown origin.

Early detection of ransomware is key for successfully containing and eradicating the damage. IT need to place signatures into network devices, such as Locky and CrytoWall. Additionally, automated tools for screening email should be in place to detect executable or malicious attachments.

Security automation and orchestration tools can help contain the damage significantly. The time between detection and containment is critical to minimize lateral damage and spreading of infection. It is also recommended to disable the connection or try to shut down the system quickly to minimize damage. These steps can be also automated to respond quickly and consistently.

How to eradicate ransomware. Replacing the machines is the best option. With all types of malware, including ransomware, it is almost impossible to know whether there are hidden files remaining on the system that could launch another infection. Cleaning file shares, mailboxes and malicious messages should be done, and companies need to be very proactive about continuing to monitor signatures to detect signs that the attack is emerging once more.

Once the backups are verified and clean, restoring affected files can be accomplished in relatively little time without the need to pay the ransom. The infection vector could be a phishing email, an internet-based attack kit or another exploitation. Knowing how the attacker penetrated your defenses can help prevent future attacks. Finally, be sure to report the incident. Victims are encouraged to report ransomware attacks to the FBI’s Internet Crime Complaint Center.

An increasing number of organizations are suffering ransomware attacks, and experts predict that the numbers are only going to climb. Attackers have the potential to make large sums of money, which means that they are sure to ramp up even more.

Regardless of its size, virtually every organization is vulnerable to an attack, and the consequences of a successful ransomware attack can go far beyond the payment of the ransom. Lost business, customer inconvenience, lost productivity and negative publicity can result as well.

This article originally appeared in the August 2017 issue of Security Today.


  • Maximizing Your Security Budget This Year

    The Importance of Proactive Security Measures: 4 Stories of Regret

    We all want to believe that crime won’t happen to us. So, some business owners hope for the best and put proactive security measures on the back burner, because other things like growth, attracting new customers, and meeting deadlines all seem more pressing. Read Now

  • 91 Percent of Security Leaders Believe AI Set to Outpace Security Teams

    Bugcrowd recently released its “Inside the Mind of a CISO” report, which surveyed hundreds of security leaders around the globe to uncover their perception on AI threats, their top priorities and evolving roles, and common myths directed towards the CISO. Among the findings, 1 in 3 respondents (33%) believed that at least half of companies are willing to sacrifice their customers’ long-term privacy or security to save money. Read Now

  • Milestone Announces Merger With Arcules

    Global video technology company Milestone Systems is pleased to announce that effective July 1, 2024, it will merge with the cloud-based video surveillance solutions provider, Arcules. Read Now

  • Organizations Struggle with Outdated Security Approaches, While Online Threats Increase

    Cloudflare Inc, recently published its State of Application Security 2024 Report. Findings from this year's report reveal that security teams are struggling to keep pace with the risks posed by organizations’ dependency on modern applications—the technology that underpins all of today’s most used sites. The report underscores that the volume of threats stemming from issues in the software supply chain, increasing number of distributed denial of service (DDoS) attacks and malicious bots, often exceed the resources of dedicated application security teams. Read Now

Featured Cybersecurity


New Products

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file. 3

  • ResponderLink


    Shooter Detection Systems (SDS), an company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3