RANSOMWARE

What Is Ransomware?
Ransomware is a special type of malware that is
actively spreading across the Internet,
threatening to destroy victims documents and
other files. Malware is software a computer
program used to perform malicious actions.
Types of ransomware
 Types of ransomware
There are two main forms of ransomware in
circulation today :
Locker ransomware (computer locker):
Denies access to the computer or device
Crypto ransomware (data locker):
Prevents access to files or data. Crypto
ransomware doesnt necessarily have to use
encryption to stop users from accessing their
data, but the vast majority of it does.
How it works?
 How it works?
1. Traffic distribution system (TDS)
A common method used by these distribution
services is to buy redirected web traffic from a
Traffic Distribution Service (TDS) vendor and
point it to a site hosting an exploit kit. In a lot of
cases, the redirected traffic originates from adult
content-related websites. If the exploit kit is
successful in exploiting a vulnerability in the
visiting victims computer, it can lead to what is
commonly referred to as the drive-by-download
of malware.
 How it works?
2. Malvertisement
Similarly, malicious advertisements known as
malvertisments can get pushed onto legitimate
websites in order to redirect traffic to a site hosting an
exploit kit. In one case, we even observed
unintentional cross contamination as a result of a
click-fraud malware infection, where clicking on the
malvertisment led to aransomware infection. In both
cases, cybercriminals can use real-time bidding to
purchase traffic or ad space of interest that can allow
them to geographically target victims and operate
without borders.
 How it works?
3. Spam email
For many years, email spam using social-engineering themes has
been the method of choice for distributing all types of malware
including ransomware. Cybercriminals use a botnet to send the
spam. These cybercriminals may also offer a spamming service to
other attackers for a fee.
In recent years, the spam emails used to distribute ransomware
have favored the following themes:
Mail delivery notification
Energy bills
Job seeker resume
Tax returns and invoices
Police traffic offense notifications
 How it works?
4. Downloaders & botnets
This method is one of a number of ways to distribute
malware known as downloaders. Once the
downloader infects a computer, its job is to download
secondary malware onto the compromised system.
The cybercriminals behind downloaders offer a
malware-installation service onto already
compromised computers, at a price to other malware
authors. Trojan botnets have also been known to
download ransomware onto computers they have
infected. This is usually done by cybercriminals as a
final way of monetizing infected computers that they
control
 How it works?
5. Social engineering and self-propagation
Some ransomware also contain functionality
to spread. For example, on Android, there are
some samples that not only lock the device
or encrypt files, but employ worm-like
capabilities to spread to all contacts within
the devices address book by sending social-
engineering SMS messages.
 How it works?
6. Affiliate schemes
Cybercriminals who have paid attention to the
growing interest in ransomware have started to
provide services to those who wish to carry out
these attacks, effectively providing ransomware-
as-a-service (RaaS). They offer a way to buy into
the growing ransomware scene without needing
to have the skills to create a ransomware or to
maintain and run the operations.
 Ransom techniques
1. File encryption
Modern crypto ransomware typically uses both symmetric
and asymmetric encryption techniques. In symmetric
encryption, a single key is used to encrypt the data and the
same key is used to decrypt the encrypted data. Knowing
the key allows the user to decrypt data that has been
encrypted with the same key. Ransomware using
symmetric encryption will usually generate a key on the
infected computer and send this to the attacker or request
a key from the attacker before encrypting the users files.
The attacker needs to ensure that the key is not available to
the user after encrypting their files, otherwise the user
might be able to decrypt the files themselves without
paying.
 Ransom techniques
2. Screen locking
Locker ransomware attempts to block infected users from
accessing the operating system and services that are
running on their computer or device. The approach that is
most commonly used is to display a ransom message
to the user in a continuous loop. This gives the impression
that the message is constantly displayed even though
there may be slight intervals where it is possible for the
user to close the current display of the message. These
ransomware threats mostly use features or APIs from the
underlying operating system to perform this task.
 Targets for ransomware
1. Home users
Ransomware is perhaps the most effective
against individuals who are not fluent with
computers or are not familiar with ransomware
and how it works. The most common group that
we see impacted by ransomware is the home
user, who often has the least amount of access
to technical assistance. The lack of support may
leave the user feeling isolated and helpless,
further increasing the pressure to pay.
 Targets for ransomware
2. Businesses
For many businesses, information and the technology to use it is
their life blood, without which the act of conducting day-to-day
business is impossible. Consider a retailer running a computerized
point-of-sale (POS) system. If the POS system was unavailable due
to a ransomware infection, the retailer would not be in a position
to transact sales. Business computers are also more likely to
contain sensitive data and documents of critical importance, such
as customer databases, business plans, proposals, reports, source
code, forms, and tax compliance documents. Modern crypto
ransomware threats can enumerate all accessible drives, such as
local file-share servers, and encrypt files on these as well. This
means more than one system can be impacted by just a single
crypto ransomware infection.
 Targets for ransomware
3. Public agencies
Public agencies such as educational institutes and
even law enforcement entities are not excluded from
the attention of these cybercriminals and in some
cases, they may be specifically targeted. There have
been several reports of law enforcement agencies
that had been hit with crypto ransomware in the past.
In another case, a New Jersey school district, which
runs four elementary schools in the Swedesboro-
Woolwich area, was hit by cybercriminals who
demanded a ransom payment of 500 bitcoins
(US$124,000).
 Systems impacted by ransomware
1. Personal computers
The vast majority of ransomware threats today
are designed to target personal computers
running the Windows operating system. This is
unsurprising, as Windows-based computers
make up around 89 percent the OS market share
for desktop computers, with Mac OS X and Linux
making up the rest. Given that ransomware is a
commercial activity for cybercriminals, it makes
sense for them to maximize potential returns on
their investments.
 Systems impacted by ransomware
2. Mobile devices
The next most targeted types of devices are tablets and
mobile phones. These devices have become ubiquitous
worldwide, with studies showing that users are spending
more time on mobile devices than ever before. Ever since
the advent of the iPhone back in 2007 and Android in
2008, smartphone and tablet device ownership has been
on a steep upward trajectory. Today, there are basically
just two main players in the mobile OS market: Android
and iOS. Android has a massive global footprint, with a
share of over 80 percent of the mobile market,
representing billions of smartphone and tablets
worldwide. In terms of the malware landscape, there is a
world of difference between the Android and iOS world.
 Systems impacted by ransomware
3. Servers
Servers represent a different type of proposition for
cybercriminals aiming to extract ransom payments. Servers are
much more likely to contain data that is critical to the operations
or even survival of an organization. They act as central
repositories for documents, source code, financial records and
transactions, user databases, and trade secrets, making them
high-value potential targets. Given the critical role that servers
play, many organizations have disaster recovery and business
continuity plans (BCP) built around maintaining operations and
ensuring the backup of data. Despite this, taking out a critical
server even for a short time could be incredibly disruptive and
damaging. Because of these contingency plans, cybercriminals
have been forced to adopt a different approach to extracting
ransoms when attacking organizations and their servers.
HOW TO RESOLVE RANSOMEWERE
1. Back Up Your Files
Perhaps the best way to recover from a ransomware
infection and not pay a ransom is to recover your files
from backups.
2. Further Protective Measures
Moreover, you can protect yourself from ransomware
infections the same way you would against other
types of malware: dont get infected. Start by making
sure that you have up-to-date anti-virus software from a
trusted vendor. Such tools, sometimes called anti-
malware software, are designed to detect and stop
malware. However, anti-virus cannot block or remove all
malicious programs.