blog




  • Essay / Analysis of the main types of ransomware attacks

    There is no doubt that as computer technology advances, so do the technologies that no one ever hopes to fall victim to. The topics of cybercrime as well as cybersecurity are extremely broad areas and both represent multi-billion dollar industries. To clarify this point, it is possible to look at one of the issues at the forefront of the debate and extrapolate from there. Although ransomware has been around for a while now, it has made headlines over the past couple of years. In the most basic sense, ransomware is malware that attempts to lock down computer functions or individual files until a ransom has been paid to the designated payment address. In the worst case, all normal computer functions will cease to exist and all of the user's files will be encrypted before they even know they have been infected. Without proper precautions, the user will not be able to do anything to recover the files, and even if the ransom is paid, there is never a guarantee that the encryption will be removed from the files. Say no to plagiarism. Get a Custom Essay on “Why Violent Video Games Should Not Be Banned”?Get the Original EssayThere are many types of ransomware used by malicious people today. Although some are worse than others, all forms of ransomware share the key element of demanding a ransom to return control to the infected user (Mateui). The most common form of ransomware is encryption ransomware. This type of malware uses an encryption algorithm on the user's files, rendering them useless until they are unencrypted. The biggest problem here is that, assuming the ransomware was designed "properly", the encrypted files will not be able to be decrypted without the key used by the person who encrypted the files. Trying to brute force this key would be impossible in our current understanding of physics. In turn, the only way to recover the user's files on an infected machine would be to pay the ransom and hope that the infector keeps its promise to decrypt the user's files. Two other forms of ransomware include lockers and scareware. Both of these are much less threatening than the previous ones and can be safely removed from the computer by someone with the proper knowledge. Essential lockers lock all computer functions and simply display ransom payment instructions on the user's screen. Scareware is fake software that claims to have detected problems on the PC and demands money to fix the problems. Scareware comes in many different versions, but is mostly harmless and can be easily removed. Doxware is another form that basically steals personal information or sensitive files from the user and threatens to publish them online unless the user pays the ransom. There is no way around this form of ransomware. Once the information is stolen, there is no way of knowing whether or not that information was deleted, and even if the ransom is paid, there is no way to guarantee that the information will not still be released in line (Mateui). The largest and most serious ransomware attacks have only occurred in recent years. WannaCry was by far the largest ransomware attack in history. The attack began on May 12, 2017 and infected a total of more than 400,000 different machines. Thisparticular attack was so powerful because, unlike many other malware, it exploited a vulnerability in the server message blocking protocol on Windows machines, as opposed to widely used phishing schemes (Crowe). The majority of these ransomware attacks are distributed through phishing programs via malicious emails, but this particular attack was able to infect machines without the user explicitly doing anything to launch the program. The exploit used in the attack came from a hacking tool disclosed by the NSA just a month before the attacks began. Almost all of the machines infected with WannaCry were running an outdated version of Windows 7. Microsoft released updates a month before the NSA leak, rendering the majority of the leak's exploits ineffective. This effectively means that users had about 2 full months to update their machines and the updates would have protected them from WannaCry attacks. By the end of WannaCry's life, only 0.07% of victims had paid the ransom, which equated to approximately $120,000 in ransom collected. Given the number of machines infected in the process, very little revenue was received by the attackers. Decryption tools became available for WannaCry encryption just 5 days after the attacks began, providing users with a way to recover their files without paying a ransom. Ultimately, WannaCry ransomware was only significant in the number of infected machines. The encryption used was hacked in less than a week and the attack “was designed so that payments and decryption key transfers would be processed manually.” This suggests that the attackers may not have expected the ransomware to have such close range (Crowe). “The key factor that unites the different types of ransomware is the ransom demand (Mateui). In an attempt to recover your files, the attacker demands a ransom to be paid within a certain time frame. In order for the attacker to avoid being tracked by law enforcement, the majority of ransomware requires payment in Bitcoin or another form of cryptocurrency. Since cryptocurrencies are currently unregulated, there is no way to trace the attacker's cryptocurrency wallet. The ransomware typically provides instructions to the infected user on how and where to purchase cryptocurrency, as well as the attacker's wallet address to deposit the cryptocurrency into. Criminal activity like this contributes heavily to the hesitancy and slow adoption of cryptocurrencies by the masses. With so much crime behind cryptocurrencies, many people are generally afraid of the possible banning of some or all cryptocurrencies by their governments. Over the past few years, the number and types of ransomware have increased rapidly. Added to this are more and more preventative measures to help users avoid getting infected in the first place. With most of the most advanced and well-written ransomware, after infection there is virtually nothing the user can do to recover their data other than pay the ransom and hope for the best. Antivirus and cybersecurity companies are skyrocketing in response to emerging and growing threats and that is certainly the case here. There are several ways for a user to avoid getting infected and also preserve their important data if they are unlucky enough to get infected. The best step anyone can take to protect their data not only from ransomware, but from almost any threat in general, is to regularly back up their data and).