Ransomware is on a rampage! Attacks are happening with ever-increasing frequency, and ransomware is evolving and becoming more powerful.
Several major media sites, such as the New York Times, BBC, AOL, and the NFL, were recently infected with malware that directed visitors to sites attempting to install ransomware on their computers.
Ransomware has the potential to attack the Internet of Things. In one instance, a researcher was able to infect a TV with ransomware.
Ransomware is now attacking smart phones.
Last month, one hospital paid $17,000 in ransom when ransomware attacked its computer system. The computer network was down for more than a week, and patients had to be transferred to other hospitals.
According to a Symantec Report on ransomware, “Between 2013 and 2014, there was a 250 percent increase in new crypto ransomware families on the threat landscape.” As the Symantec report also puts it quite powerfully, “Never before in the history of human kind have people across the world been subjected to extortion on a massive scale as they are today.”
The report identifies two main types of ransomare:
(1) Crypto Ransomware — works by encrypting files
(2) Locker Ransomware — locks computers, preventing use
Security companies have been able to crack previous forms of malware, but now a new form of ransomware with uncrackable encryption has emerged called TeslaCrypt.
As EngagedNet eloquently states: “[R]ansomware has become the black plague of the internet, spread by highly sophisticated exploit kits and countless spam campaigns.”
The best way to deal with ransomware is information security awareness training. People are the weakest link because they click on dubious links. They click links to dubious sites, click links in dubious emails, click to open dubious attachments — all of which will infect the computer system with ransomware. The smarter that people click, the less often that ransomware has a chance to stick. We teach our children how to avoid being kidnapped, so we must also teach our workforce how not to be victimized by ransomware.
One final point in light of the fact that uncrackable crypto ransomware has been spreading. If the FBI wins its case against Apple and can force Apple to build a backdoor to its iPhone security features, this will be a precedent that will surely be used to mandate a backdoor to encryption. Companies offering encryption will be forced to make their encryption more insecure by creating openings for access and extra sets of keys lying around. Ironically, the only folks offering encryption without these backdoors will be the ransomware makers. If the FBI wins its case against Apple, ransomware makers might find it more profitable just to sell secure encryption.
* * * *
This post was authored by Professor Daniel J. Solove, who through TeachPrivacy develops computer-based privacy training, data security training, HIPAA training, and many other forms of awareness training on privacy and security topics.
The Ransomware Attack
My new short interactive vignette training program on malware,
featuring an engaging story about ransomware
