Ransomware Recovery: How to meet realistic Recovery Time Objectives (RTOs)

When it comes to ransomware attacks, those who lose valuable data and have no viable backup tend to pay the ransom, while those with backups simply restore their data. However, neither group walks away unscathed because they both suffer downtime.

Downtime is the period when systems are unavailable for use, and it can cost small and midsize businesses thousands of dollars or worse—it could put them out of business. An Imperva survey of RSA 2017 attendees found that downtime costs companies more than $5,000 in 56% of cases and more than $20,000 in 27% of cases. Depending on the size of your company, this could be the cost of doing business, or it could be a catastrophe.

Establishing  Recovery Time Objectives (RTOs)
Companies should take the time to identify the maximum amount of downtime that is acceptable under various disaster scenarios. It’s a good idea to get started on this right away because this information will help determine what type of backup systems you need to have in place.

For example, business leaders may decide, after analyzing the data, that email should be restored within 10 minutes, domain services within 30 minutes, customer facing websites within 30 minutes and the Enterprise Resource Planning (ERP) system within 45 minutes. These values constitute applications’ Recovery Time Objectives (RTOs). Business leaders may also decide that email can be down for a maximum of one hour, domain services for two hours, customer facing websites for four hours and the ERP system eight hours before losses due to the downtime are intolerable. Each of these values constitutes a Maximum Tolerable Period of Disruption (MTPOD).

In most circumstances, systems would need to be restored in accordance with the RTOs and, in extraordinary circumstances, systems would be restored within the MTPOD.

Based on the RTO and MTPOD, IT and other groups put redundancy, business continuity, and backup and recovery strategies in place to meet these objectives. This may involve a hybrid recovery strategy with cloud and on-site backups. Companies might also decide to use cloud replication with virtualization to resume services at another site if the primary site fails. Backup and recovery systems are crucial in bringing systems online after disasters like ransomware strike.

Actual vs. estimates
I have found that initial estimates for recovery objectives are often in need of revision following the first incident. Trend Micro estimates that the average ransomware recovery takes 33 hours. This is far higher than most organizational estimates prior to a ransomware infection. That’s likely because organizations don’t always factor in the initial steps of incident response when determining their RTOs. In the example above, recovery controls alone might be able to meet the domain services MTPOD of two hours, but it takes first responders 30 minutes to validate the incident and identify the extent of the incident scope, which results in the organization exceeding the MTPOD by 30 minutes.

In other cases, organizations have been surprised by the scope of ransomware infections. Trend Micro found that 47% of ransomware spreads to 20 or more people. Furthermore, ransomware is efficient at targeting sources of information in organizations. Without this critical information, large groups of employees are unable to do their jobs.

It’s also important to remember that recovery plans need to be kept up to date. Organizations relying on outdated plans may have unclear expectations as to when steps in the plan will be complete and as a result, they will be unable to meet recovery objectives.

Action items
Establish RTO and MTPOD for systems based on their availability need. Next, put controls in place to meet these recovery metrics. If you have not experienced ransomware before, consult with those who have to determine if controls are adequate. Backup and recovery controls are the most crucial elements and must be designed appropriately. That means ensuring that recovery is available to the required locations at appropriate speeds to meet objectives.

Recovery metrics should be reevaluated annually to ensure that changes in business availability needs are reflected in the established metrics. Controls should go through a similar process of evaluation against recovery metrics to ensure that controls can adequately meet recovery metrics for potential threats.

For more news and information on the battle against ransomware, visit the FightRansomware.com homepage today.

Spora ransomware could become a major player

Spora is a relatively new ransomware, but there are signs which indicate that it could become a major player in the underground ransomware market, according to various reports.

There are currently hundreds of ransomware variants being used by cybercriminals, but only a handful are backed by major criminal syndicates that have the funding to write robust malicious code and the infrastructure to support global extortion efforts. These groups are behind some of the biggest names in ransomware like Locky, CryptoLocker and TeslaCrypt. Spora is not there yet, but it’s certainly on its way.

A strong build
The first thing that sets Spora apart from a large number of homegrown ransomware variants is its encryption capabilities. Spora utilizes offline encryption to avoid detection and is capable of performing the encryption using a unique key set without communicating with a command and control server. This is not a brand new technique. It’s been used successfully in the past by both Cerber and Locky. Spora differs in that it encrypts each file with a distinct key, then file keys are encrypted with an AES key unique to the victim.

Second, Spora has a very well designed website with a professional look and feel. It has an easy to use interface consisting of a clean dashboard with colorful icons, tool tips and a live support chat that delivers quick responses to inquiries, according to security researchers.

One very interesting feature of Spora is that it offers victims a menu of options for retrieving some or all of their files as well as protection services. They allow users to decrypt two files free as an act of good faith and to demonstrate their ability to decrypt the data. Other options include decrypting several files for $30, removing the ransomware for $20, protecting against further infections of Spora for $50, and a full restore for $120. However, it should be noted that these prices may change. Spora uses identifying information provided by victims when they connect to the payment website to dynamically generate prices. The cybercriminal behind Spore likely charge more for businesses or for those in different regions. Even with its dynamic prices, Spora is priced much lower than other ransomware, a strategy that was likely designed to build up their reputation.

Spora’s weaknesses
Despite these strengths, Spora has some significant weaknesses. The ransomware does not yet have a way to bypass the UAC, a feature in Microsoft Windows that prevents programs from running with escalated privileges. A UAC warning message appears when Spora executes and victims must allow the program to run. Spora also launches a command prompt to delete volume shadow copies and the command prompt is displayed on the screen for the victim to see.

At the moment, Spora is limited to Russian-speaking countries. The attackers behind this ransomware appear to be organized and professional so it is likely that the next version of Spora will address its current deficiencies and target a much larger audience. Prepare yourself by backing up your data and by validating that your backups can be restored.

Continue reading

The top 10 ransomware attack vectors

Ransomware is infecting the computers of unsuspecting victims at an astronomical rate. The various methods that cybercriminals use to take over a machine and encrypt its digital files are called the attack vectors, and there are quite a few.

In this article, we’ll explore the top 10 ransomware attack vectors. The first five exploit human weaknesses through social engineering attacks. In other words, they use carefully crafted messages to entice victims into clicking a link, downloading software, opening a file or entering credentials. The second five spread ransomware computer to computer. Humans may be somewhat involved in the process by navigating to a site or using a machine, but they are primarily automated processes. Let’s take a closer look at each attack vector:

1. Phishing
Phishing is a social engineering technique where phony emails are sent to individuals or a large group of recipients. The fake messages—which may appear to come from a company or person the victim knows—are designed to trick people into clicking a malicious link or opening a dangerous attachment, such as the resume ransomware that appeared to be a job candidate’s CV.

2. SMSishing
SMSishing is a technique where text messages are sent to recipients to get them to navigate to a site or enter personal information. Some examples include secondary authentication messages or messages purporting to be from your bank or phone service provider. Ransomware that targets Android and IOS-based mobile devices often use this method to infect users. For example, after infecting your device, Koler ransomware sends a SMSishing message to those in your contacts list in an effort to infect them as well.

3. Vishing
Vishing is a technique where ransomware distributors leave automated voicemails that instruct users to call a number. The phone numbers they call from are often spoofed so that messages appear to come from a legitimate source. When victims call in, they are told that a person is there to help them through a problem they didn’t know they had. Victims follow instructions to install the ransomware on their own machine. Cybercriminals can be very professional and often use a call center or have sound effects in the background to make it seem like they are legitimate. Some forms of vishing are very targeted to an individual or company and in such cases, criminals usually know quite a bit of information about the victim.

4. Social media
Social media posts can be used to entice victims to click a link. Social media can also host images or active content that has ransomware downloaders embedded into it. When friends and followers view the content, vulnerabilities in their browser are exploited and the ransomware downloader is placed on their machine. Some exploits require users to open a downloaded image from the social media site.

5. Instant message
Instant message clients are frequently hacked by cybercriminals and used to send links to people in a user’s contact list. This was one technique used by the distributors of Locky ransomware.

6. Drive-by
The ‘drive-by’ technique places malicious code into images or active content. This content, when processed by a web browser, downloads ransomware onto the victim’s machine.

7. System vulnerabilities
Certain types of ransomware scan blocks of IP addresses for specific system vulnerabilities and then exploit those vulnerabilities to break in and install ransomware onto the machine.

8. Malvertising
Malvertising is a form of drive-by attack that uses ads to deliver the malware. Ads are often purchased on search engines or social media sites to reach a large audience. Adult-only sites are also frequently used to host malvertising scams.

9. Network propagation
Ransomware can spread from computer to computer over a network when ransomware scans for file shares or computers on which it has access privileges. The ransomware then copies itself from computer to computer in order to infect more machines. Ransomware may infect a user’s machine and then propagate to the company file server and infect it as well. From here, it can infect any machines connected to the file server.

10. Propagation through shared services
Online services can also be used to propagate ransomware. Infections on a home machine can be transferred to an office or to other connected machines if the ransomware places itself inside a shared folder.

Be cautious and skeptical of the messages you receive, whether they come from email, instant message, text, voicemail or social media. Ransomware distributors are crafty and one click could be all it takes. Technical controls are also necessary to screen out unwanted content, block ads, and prevent ransomware from spreading. The most important thing is to have adequate backups of your data so that, if you ever are attacked, you can remove the virus and download clean versions of your files from the backup system.

Continue reading

How ransomware extortionists hide their tracks

Cybercriminals extorted about one billion dollars from ransomware victims last year, according to the FBI. And nearly all of those perpetrators went unprosecuted because of the innovative methods they use to protect their identities and hide their funds. They go to great lengths to keep authorities from seizing or freezing their money. By and large, their efforts have paid off. Here’s how they do it:

Hidden identities, disposable email
Extortionists protect their identities whenever interacting with victims. This generally occurs when they distribute ransomware, and when they collect ransom payments from victims in exchange for decryption keys.

Extortionists use disposable email accounts and when sending out phishing emails that target victims. These accounts have fake names associated with them and no useful contact information. In some cases, the accounts are owned by another individual—a person whose account was compromised, taken over and used to send malicious emails.

Layered like an onion
Extortionists often protect themselves during the collection phase by using so-called “onion routing” tools like Tor, which use multiple layers of encryption to ensure anonymous networking and communications. Tor is a network of computers that exchange encrypted data among themselves to obscure the source of the data. This prevents researchers and law enforcement from identifying where the decryption keys are stored.

Cryptocurrency enables anonymity
The cybercriminals responsible for disseminating ransomware typically demand payment in some form of cryptocurrency. Bitcoin is the most popular cryptocurrency with Litecoin and Dogecoin coming in second and third place, respectively. Bitcoin currency is stored in a digital wallet and bought and sold over bitcoin exchanges, through peer-to-peer marketplaces, and via person-to-person trades using an intermediary. Bitcoin transactions are logged publically but transactions only reference the wallet IDs of each partner in the transaction, not the names of the individuals themselves. Wallet IDs have no identifying information associated with them other than their number.

Cybercriminals typically keep a wallet ID for a short period of time and may only use it for a few transactions before switching to a new wallet ID. This ensures that specific wallet IDs are not identified as major bitcoin traders. They also use bitcoin laundering services or anonymizers like bitmixer.

Gift cards and money mules
Some forms of ransomware accept vouchers for payment. These include gift cards and CashU, MoneyPak, MoneXy, Paysafecard and UKash vouchers. These may be used to purchase goods that “money mules” then sell over the internet for cash. Money mules are also used to liquidate cards by selling them to individuals at less than face value. Cybercriminals prefer cryptocurrency because it allows them to keep a greater percentage of the profits.

For more news and information on the battle against ransomware, visit the FightRansomware.com homepage today.

Resume Ransomware: GoldenEye targets hiring managers, recruiters and HR

People charged with filling career positions at their companies need to be on the lookout for ransomware—especially GoldenEye ransomware.

GoldenEye is a new form ransomware written by the same cybercriminal who gave us the Petya and Mischa ransomware attacks. The author has applied some of the same distribution tactics that Petya and Mischa are known for by masking the ransomware as a job application. GoldenEye attacks typically begin with an email that appears to be from someone interested in a position. The inboxes of human resource personnel and hiring managers are often swamped with emails from potential candidates. As a result, very little time may be spent reviewing each email. Instead, recruiters and HR managers open the attachments and quickly screen resumes or cover letters to determine if the applicant is qualified for the position. GoldenEye takes advantage of this behavior. GoldenEye is currently targeting potential victims in German-speaking countries, but that could change at any moment.

GoldenEye emails include two attachments; a PDF cover letter and an Excel spreadsheet with a file name that includes the phony applicant’s last name, a dash and the word “application” in German. The cover letter looks entirely legitimate. The cover letter has an introductory statement, photograph and then states that the Excel file contains references and results from an aptitude test. The PDF attachment does not include any malicious code but the presence of a well-written cover letter aids in convincing the victim to open the second attachment, an Excel file.

The Excel file contains the ransomware as a macro. The file displays a flower logo that appears to be loading something. Microsoft Office blocks the macro unless macros have been enabled by the victim. Victims are enticed to enable the macros so that the loading screen will disappear to display the resume content. However, once enabled by the victim, the macro will save code into an executable file in the victim’s temp directory and then launch the ransomware. The program encrypts files and displays a ransom message. However, after the initial ransom message is displayed, GoldenEye restarts the machine and encrypts the Master File Table (MFT) and replaces it with a custom boot loader that shows the ransom message upon computer startup.

GoldenEye essentially performs the file encryption activities of Mischa and then restarts to perform the MFG encryption activity of Petya. Both encryption methods have been improved, and decryption methods for Petya and Mischa will not work on GoldenEye.

GoldenEye’s ransom message instructs victims go to a URL on the dark web to obtain their decryption key. Victims will need the decryption code presented in the ransom message to pay the ransom.

Be careful when opening any attachments from an unknown person and ensure you have a backup of critical files so that GoldenEye does not claim a ransom from you.

For more news and information on the battle against ransomware, visit the FightRansomware.com homepage today.

PopcornTime offers victims a choice: Pay the ransom or infect your friends

PopcornTime is a newly-discovered form or ransomware that is still in the development stages but operates off a disturbing principle: Victims who have their files encrypted by PopcornTime can agree to pay the ransom, or they can choose to send the ransomware to friends. If two or more of those friends become infected and pay the ransom, the original victim gets their files decrypted for free.

The process is reminiscent of the movie, “The Ring,” where victims who had watched a film had seven days to make a copy of a killer movie, or they would die.

Researchers on the MalwareHunterTeam discovered PopcornTime, which shouldn’t be confused with another application with the same name that is used for streaming and downloading movie torrents.

PopcornTime is also similar to the chain emails or chain letters of days past, where the recipient is told to forward the communication or bad things will happen. The key difference between PopcornTime and chain emails is that with the latter, there’s usually no teeth behind the threats. Most chain emails and letters are proven to be hoaxes. With PopcornTime, the looming threat to your data is real.

PopcornTime is still in development so the final version could differ from what MalwareHunterTeam discovered.

A third choice that makes better sense
It’s worth mentioning that if your files are properly backed up, PopcornTime can’t make you do anything. You can simply delete all infected files, remove the virus from your computer, and download clean versions of your files from backup. Don’t let the criminals coerce you.

For more news and information on the battle against ransomware, visit the FightRansomware.com homepage today.

Ransomware distributor gets hacked: A look behind the curtain

Two email accounts of a ransomware distributor were recently compromised. The analysis of these accounts gives an interesting “behind the curtain” view of a ransomware distributor. It appears that even malicious hackers use a bit of security advice.

The email account, cryptom27@yandex.com, which was used by the attacker behind the recent San Francisco Municipal Transportation Agency (SFMTA) ransomware incident, had an easily-guessable secret question. That allowed a security researcher to take over the account. The unidentified attacker had a backup email account, cryptom2016@yandex.com, that used the same secret question and was also compromised.

The analysis of these emails was reported by IT security blogger Brian Krebs, and it reveals a lot about ransomware distribution. First, the ransomware distributed by this attacker was not targeting specific organizations but was targeting an industry instead. The attacks focused primarily on U.S. construction and manufacturing firms. However, the attacker did not turn away business from those he had inadvertently exploited while launching the attack. The attacker also used an exploit designed take control of Oracle servers and use them to distribute more ransomware.

The attacker used various threats to coerce victims into paying ransom demands. Victims were told they would never get their data back if they did not pay up. The attacker demanded payment within 48 hours, or the data would be deleted, and in some cases told victims that the ransom demand would increase the longer they spent thinking about it.

The attacker used Mamba (HDDCryptor) ransomware, which encrypts entire hard drives. And after the hard drives are encrypted, the attacker’s victims were presented with a message telling them to send an email to one of the aforementioned email addresses to get payment instructions. The attacker apparently used a third email address, but this one did not use the same secret question, and the researcher could not obtain access to it.

The analysis also shows how profitable ransomware can be. The attacker using these email addresses collected $45,000 from a previous attack on a U.S. manufacturing firm. This money was collected through various attacks over the course of a few months. This information was obtained from the two compromised email accounts. These attacks appear to have been committed by a single individual, but it is possible that multiple individuals were involved.

This case demonstrates the ease with which ransomware attacks can be carried out, as well as their massive earning potential.  It’s important for individuals and companies to protect themselves primarily by ensuring that all important data and systems are backed up and that those backups are stored in a location segmented from production systems.

A wide variety of technical controls can help detect ransomware and prevent its spread. User awareness training can help reduce the effectiveness of ransomware distribution through phishing. However, none of these methods are 100% effective. That is why backups are essential to any defense strategy. Take a lesson from this analysis and protect yourself because this threat is far from over.

For more news and information on the battle against ransomware, visit the FightRansomware.com homepage today.