Ransomware: Revisited

Ransomware Revisited By SUPERAntiSpyware

A lot has changed in the world of ransomware since we last talked about it on this blog back in 2013. For those who are new to ransomware, this post should provide a primer of what this family of malware is and what it does. For those who are more well-versed, some of our best practices at the end of this post should help provide some extra prevention methods.

TeslaCrypt, Locky, CryptoLocker, CryptoWall, and other ransomware families are making their way around the internet at break-neck pace. If you find yourself in the unfortunate place of having fallen victim to this type of malware, you’ve essentially got two options: pay up or start from scratch. While this is not something that most people want to hear, it’s the unfortunate reality for a machine that’s been ravaged by these types of infections. Even the FBI has come out and stated that your best option at data retrieval is to pay the ransom (if you do not have proper backups)!

What is Ransomware?

Ransomware is a designation given to families of malware that encrypt your personal files, and then demand a ransom payment in order to be given the decryption key. The types of files that ransomware targets range from generic text files and documents, to pictures, to video games, to music, and even beyond. Unfortunately, the type of encryption that’s used is so strong, that newer versions of some ransomware are completely impenetrable.

Most ransomware families are spread by a special type of Trojan called a “dropper”. The purpose of a dropper is to run processes in the background of your machine to download and execute code from a remote server. That code then searches your computer for files of a specific type (or types), then modifies those files by scrambling them with high-end, two part encryption. After a critical mass of files have been encrypted, the ransomware will then typically create a few different unencrypted documents and/or display a dialogue on your machine telling you that you’ve been locked out of your files unless you pay the price. To add fuel to the fire, many different variants will have a timer imposed upon you for when payment is “due” to them. If you don’t pay in time, they either increase the ransom, or delete the encryption key from their server, thereby making it impossible to retrieve your files.

To make matters worse, many different ransomware variants will disable the Volume Shadow Copy Service on your machine. This service is used by Windows to perform automatic backups and create restore points. These backups are what you would typically use to “roll back” your computer to before a major change happened.

How did I get infected?

Ransomware droppers come in all different shapes and sizes, but one thing that’s true about them is once they’ve been started, it’s almost always too late. These droppers typically are files that you download from your email, other websites, or p2p servers (such as torrent sites). Unfortunately, this is changing rapidly, and we’re starting to see “drive-by” exploits occur in the wild through infected ad-streams on popular sites many people visit on a daily basis.

One of the most frustrating parts of ransomware infections are that they’re extremely difficult to clean up. Even if you run antivirus and antimalware scanners, once the damage has been done, there’s nothing that these pieces of software can do to reverse the damage. These tools, including SUPERAntiSpyware®, can remove the underlying cause of the infection (the dropper) in many instances, but the encryption itself can’t be reversed.

Some versions of ransomware will display messages saying that they are from the FBI, NSA, INTERPOL, or other law enforcement agency. They’ll accuse you of possessing illegal documents and/or visiting illegal websites. This type of scare tactic has fallen out of favor, as people have gotten wise to it. Most modern ransomware will simply display a page admitting freely that you’ve been infected and display instructions on how to pay the ransom.

If you have a home or office network, it’s also possible that your machine got infected due to sharing a network with another infected machine. Because of how these infections work, they simply spread out across the drive space they can see, encrypting whatever data that can be found, regardless if it is on the machine that was initially infected.

What about my data?

If your machine has fallen prey to a ransomware attack, there’s not a whole lot that can be done with the files that were encrypted. Creating new files without removing the underlying infection is a fool’s errand, as they will quickly become encrypted as well.

After coming to terms with the fact that your data has been encrypted, you will find yourself in the middle of an ethical quagmire. If you pay the ransom that is demanded, you will most likely get your files back; however, you’re actively giving these attackers what they want, which is your money. There’s also no guarantee that by paying, your files will be restored; however, if people didn’t get their files back by paying the ransom, why would people continue to pay? If you don’t pay the ransom, you will lose access to all of your files, some of which may be irreplaceable. This is probably one of the most difficult decisions you will make after an infection.

While we can’t tell you one way or the other to pay the ransom or not, one thing that makes it extremely easy to rebound from is the availability of recent backups. If your backups are good, it is far more palatable to format your machine and reinstall the operating system than it is to pay the ransom. There are a few older variants of ransomware that can be decrypted by special software; however, these versions aren’t found in the wild much anymore for that very reason.

How can I protect myself?

There are many different steps you can take in order to help ensure that your machine doesn’t fall victim to a ransomware attack. Below you will find some of the best practices we have to offer:

Back up your data frequently on an external hard drive AND in the cloud. One set of backups is very rarely going to provide you with 100% coverage, either due to timing differences between when you back up your data and what you’re working on, drive failures, or infection of files in your backup.

If you network computers in your home or office make sure that each machine has its own set of backups. Most ransomware infections can not only infect drives that are connected directly to the infected machine, but also the drives of machines that are connected to the same network as the infected machine.

Always disconnect physical backup drives from your machine when not in use. If you constantly have your backup drive plugged in, there’s a strong chance that the ransomware can find and encrypt files on your backup drive.

Don’t ever download from a site that tells you that something is outdated on your machine. Websites aren’t able to detect outdated software or drivers unless you give them access to your machine. If you think that you have outdated software, download the latest version directly from the publisher’s website.

Practice caution when downloading files of any kind, even if it’s something that your grandmother sent you. Many variants of ransomware will send out emails to logged-in accounts with copies of itself attached. Always make sure to save files to your machine before running them, and always scan those files with your antivirus and antimalware scanners.

Keep your antivirus and antimalware scanners up to date with both the most recent versions of the programs themselves and the most recent versions of the detection databases. You should also take this practice a step further and make sure to keep your operating system up to date as well, as many attacks rely on exploiting bugs that have already been patched.

Leave macros in Microsoft Office disabled if you do not use them regularly, and do not turn them on if you don’t. One of the most common attack vectors of ransomware is to have unknowing victims turn on macros in order to “fix” a document that appears to be corrupted. In actuality, once the macros are enabled, the dropper begins its work.

Don’t give yourself (or other users) more login power than you need. Having administrator rights to your machine is definitely something most people overlook. Unfortunately, if a ransomware infection sees that you have administrative access, it makes the computer much easier to infect.

(OPTIONAL) Use adblocking software while browsing the web, disable scripting within your web browser, disable Flash, and disable Java. Many of the drive-by attacks are distributed through infected advertisements, Javascript commands, or through the downloading of files automatically when you open the page. By turning off this vector of attack, you might limit some of your web browsing capability, but will be that much more secure against attacks.