You may have heard about the recent ransomware outbreaks throughout the world. You’ve probably thought something along the lines of “Do I need to do anything about this?” First things first, let us understand what ransomware is.
About ransomware
Ransomware is malicious software (malware) designed to encrypt your files or lock you out of the operating system on your PC, essentially holding your system and data for ransom.
Recent examples include WannaCry in May, and Petya masquerading as ransomware in June.
Once the software has infected your system, you will normally receive a ransom note like the one below, providing details for you to pay a sum of money on the promise that your data will be restored.
The ransom note will require payment to decrypt your files, and in the case of Petya and WannaCry this was in the form of bitcoins, an untraceable cryptocurrency. It is important to note that even if you do pay the ransom there is no guarantee that your data will be restored. The advice from authorities and security advisors is to never pay the ransom fee.
“One– in–five users that pay a ransom don’t get their files back”
– Kaspersky Labs – Consumer Security Risks Survey 2016
Becoming infected
Each piece of ransomware software is different and will use new and different ways of infecting and spreading the virus.
Some of the most common ways are a computer or device becoming infected are:
- Spam emails containing links to malicious websites or attachments with malware embedded that when opened or clicked installs the malware on the device.
- Deliberately malicious websites that when visited installs the malware on the device
- Drive-by downloads – happens when a legitimate website is maliciously infected and again when visited installs the malware on the device. For example, in 2013 the NBC website was hacked so each person who accessed their site to innocently catch up on their favourite TV show ended up having the malware embedded in the website download, install and run malicious software without any of the usual pop-ups or warnings you’d expect. This can only happen if there is a bug in your operating system or browser. These are called exploits
More recently, ransomware strains like WannaCry have been made to spread across a network after an initial infection occurs. This is a much more aggressive and concerning aspect of the virus as it only takes one user on a network to potentially infect everyone!
Counter measures and protecting your systems
It is important to consider how can you protect your computer and devices and prevent it from infecting your devices, or if infected, reduce the effects of such attacks.
Some best practice approaches include:
- Maintain an up-to-date environment with the latest, both software and operating system updates and patches. Software companies typically release fixes for exploits very quickly when they are found to stop these sorts of problems and installing these as soon as possible is an effective way to protect yourself
The WannaCry outbreak used an exploit that Microsoft had already released updates to patch. Organisations and individuals who were affected by this were ones that were yet to install the patch released in March
- Maintain up-to-date antispam and antimalware software to prevent malicious emails from being received by unsuspecting users
- Do not open suspicious emails, do not download or open attachments or follow links provided in emails that look suspicious. If unsure, delete the email. Most legitimate senders will resend the email if they haven’t received a response or contact you via another method, e.g. phone call.
- Take regular backups of your files to an external source that is not connected to your network or device.
Additionally, in a business environment, you can take the following precautions:
- Put in place software restriction policies, these can be used to stop users from running applications, knowingly or unknowingly, from specific locations on the PC where typically malware will attempt to execute
- Enforce that end users cannot download “.exe” files and all files are antivirus scanned upon download
- And probably most important, educate users on how to recognise potentially compromising emails and suspicious web activity
We hope that this blog post has been a helpful insight into what ransomware is and how you can effectively protect yourself from this unnecessary evil!