Are You Ready for Ransomware?

At the BSides Ottawa conference, one of the major themes was Ransomware. Talking with IT Security experts, it was clear that this is a major problem which is not going away any time soon. But what can be done about it?

At the BSides Ottawa conference on IT Security, a major theme was ransomware — malevolent software which typically encrypts as many files as possible with a secret key and then demands money (generally a Bitcoin payment) for the decryption key. If you or your company has recently been bombarded with spam emails containing attachments, the chances are good that many of them have been attempts to install ransomware on one or more of your computers.

The sophistication of such attacks is quite high: when modern variants demand money they may may have already disabled Windows backup services, and attempted to encrypt any accessible network or USB drives. The decryption key is not stored on the computer, and the only way (bar programming errors) to decrypt the files is to pay the demanded ransom. One piece of ransomware even includes a link to a help desk service which will walk victims through the hopefully unfamiliar processes of buying Bitcoins to pay the ransom and decrypting the files. Another offers free decryption of one file, to prove that decryption is possible.

Even when the authorities manage to track down one of the servers involved in the extortion process, it's not entirely clear what they should do. If they close down a server it will prevent any more payments to the malware authors; at the same time it will cause more problems for any victim who had no backups and no option other than paying the ransom.

Even worse, it seems that users are still click on links and opening attachments from fake emails. One speaker claimed, (and no-one in the audience seemed to disagree), that it took at most ten carefully crafted emails before someone in a company could be persuaded to open an attachment or click on a link which installed malware. If someone is targetting your company, rather than just broadcasting general emails, it's very hard to distinguish an attack.

But it's not all bad news. Ransomware has a number of patterns which are hard to disguise, and which intrusion protection systems may be able to recognize:

  • Many files accessed in a short period of time.
  • Changes in the entropy of a file. (Entropy is a statistical measure or randomness. Encrypted files are more random than unencrypted ones).
  • Changes in "honey pot" files which are placed on the system specifically to detect changes.
  • Changes in file extensions to indicate that a file is encrypted.
  • Use of system commands to stop or control backup services: these are unlikely to occur in normal everyday use.

What to do?

Unfortunately there were no easy solutions. Conference speakers suggested:

  • Keep educating your staff about malware and deceptive emails.
  • Have an intrusion protection system: intrusion detection is not good enough.
  • Have offline backups. (Note that replication is not the same as backup.)
  • Instruct users to immediately disconnect their computer from the network and notify IT if they notice anything suspicious.
  • Pull encrypted drives from the computer and keep them on a shelf: sometimes a method of decrypting the files will be discovered at a later date. (See below for some resources on this).


Resources to Decrypt (some) Encrypted Ransomware Files

9 October 2016

To get notified when new articles appear, subscribe to the Risky Thinking Newsletter. It's low volume: we don't send out an issue unless there is something interesting to say. You can also subscribe to our RSS Feed

Recently published articles can also be found here.

Agree or disagree? I'd like to hear your thoughts. Please initially use the contact form to get in touch.