Avoiding (and Surviving) Ransomware
While the first modern ransomware began to appear in 2005, it was the emergence of the CryptoLocker ransomware in 2013 that began the sharp increase in ransomware incidents that we are still observing today. Today, ransomware has largely displaced "banking trojans" and other financial and credit card information stealing malware as the most common form of financially-motivated malware in use today.
How to Be Prepared for Ransomware Attacks
- Have adequate backup and restoration capability. While obviously we hope to avoid being hit by ransomware, we want to be prepared in case it does successfully strike us. Ensure that backups are frequent, and (very importantly) that backup file locations are NOT in writeable mode from any computers via normal file access means. If your backup locations can be written to from a workstation via a file share, you may go to restore backups in a ransomware situation only to find that the backups have also been encrypted! Also, ensure that file restore capability is tested and rehearsed on a regular basis, to ensure that the technology works and that staff know how to operate it.
- Install workstation application updates promptly. As ransomware has become more popular, the variety of means by which it makes its way onto computers has increased. Most commonly, ransomware gets on by exploiting vulnerabilities in web browsers and browser plugins (such as Adobe Flash), and also via malicious email file attachments. Most often, the vulnerabilities being exploited are known software bugs for which the companies already have updates available. Timely installation of updates for software applications will avoid a large majority of malware infections, including ransomware. The most vital applications to patch are web browsers, any web browser add-ons and plugins, and any document editing an viewing applications (Adobe Acrobat or Reader and Microsoft Office are the most-frequently exploited applications in this category.)
- Use good anti-malware software, and keep it updated. With ransomware being such a common threat, anti-virus software makers are obviously working hard to identify and detect new strains of ransomware. A good anti-virus program can provide a high degree of protection against common ransomware threats, so it is important to keep your anti-virus software updated and to test it regularly to ensure it is functioning and that it sends alerts to the appropriate parties in the organization when it detects a problem. A strong alternative to anti-virus is next-generation endpoint protection or anti-malware software. This emerging category of protective software detects malware based on how it behaves rather than by matching it against known samples of malware. This enables the software to detect the latest threats before any anti-virus software maker is even aware of them.
- Limit file shares and files to which users have access. It is common in organizations to find that most of their network file shares are fully accessible to all users. This is obviously a convenient and easy-to-manage setup, but it is risky for many reasons. The most obvious is simply that doing this most likely gives some users access to some files to which they really do not need access, and to which they perhaps SHOULD not have access. The ransomware threat gives another motivation for organizations to better segment off access to file shares -- an exploited user's PC and account can only be used to encrypt files to which they have access. Limiting users' accesses limits the damage they can do if they become infected with ransomware. Using web-based file sharing or document management systems may also provide some protection; most ransomware seen to date only encrypts local files and files in shares mapped as drives.
How to Survive a Ransomware Attack
- Identify the source. Most ransomware will pop up a message on the infected workstation, but you may discover you have a problem first by seeing files that have been encrypted. Windows should show you the last user who edited the files, and that should be enough info to track down the source of the problem.
- Disconnect the source. If you have caught a ransomware infection early enough, the infected computer may still be encrypting more documents. You can limit the damage by disconnecting the infected machine from the network. If possible, you should avoid shutting down the infected computer, as it may hold vital information to identifying the type of malware involved and other important information.
- Identify the damage and restore files. If your backups are offline, current, and tested, this should be a smooth and successful fix.
If all the above fails, and you are unable to restore your files, what to do? Are you crazy for considering paying a ransom?
Paying a ransom is definitely something you want to avoid, but it is not crazy and is not the end of the world. Organizations that have ended up having to pay include hospitals, school systems, and even police departments. The FBI has even, in the past, said that if all else fails then paying a ransom may be the thing to do (their more recent advice is to NOT pay ransoms, largely because doing so only encourages the criminals to keep doing this sort of thing, possibly even to you.) The FBI does warn that in some cases people have paid ransoms and still not gotten their data back, it seems that in the vast majority of cases paying the ransom will get you your files decrypted. If you DO end up going this route, though, please let it be a motivator to increase your preparedness so that it is the LAST ransom you ever pay.
References:
"RANSOMWARE: PAST, PRESENT, AND FUTURE"
http://blog.talosintel.com/2016/04/ransomware.html
"Incidents of Ransomware on the Rise" FBI Warning.
https://ww.fbi.gov/news/stories/2016/april/incidents-of-ransomware-on-the-rise/incidents-of-ransomware-on-the-rise
Comments
Post a Comment