‹
›

dev

Global Hub for Vocational Education Training!

ViVET for Business
Teaching at ViVET
Languages
Log In
Register

Your search is running...

topic
  1. Home
  2. Workspace
  3. topic
  4. Topic: All about ransomware
Login to add to workspace

Topic: All about ransomware

What is ransomware?

Rescue malware, or ransomware, is a type of malware that prevents users from accessing their system or personal files and that requires the payment of a ransom to be able to access them again. The first ransomware variants were created at the end of the 80s, and payment had to be made by postal mail. Today the creators of ransomware ask that payment be made using cryptocurrencies or credit cards.

How can you get infected?

Ransomware can infect your computer in several ways. One of the most common methods currently is through malicious spam, or malspam, which are unsolicited messages that are used to send malware by email. The email message may include trap attachments, such as PDF or Word documents. It may also contain links to malicious websites.


The malspam uses social engineering to deceive people in order to open attachments or click on links that seem legitimate, appearing to be from a trusted institution or a friend. Cybercriminals employ social engineering in other types of ransomware attacks, such as presenting themselves as the FBI to scare users and force them to pay a sum of money for unlocking the files.


Another usual infection method, which peaked in 2016, is malicious advertising. Malicious advertising involves the use of online advertising to distribute malware with little or no user interaction. While surfing the web, even through legitimate sites, users can be taken to criminal servers without clicking on an ad. These servers classify the details of the victims' computers and their locations and then select the most appropriate malware to send. Frequently, that malware is ransomware.

What to do if there is infection

The rule number one if you realize that you have been infected with ransomware is never pay the ransom. (This is now the council backed by the FBI). All you would get would be to encourage cybercriminals to launch additional attacks against you or other people. However, it is possible to recover some encrypted files using free decrypters.


But let's be clear: Not all ransomware families have decrypters created for them because, in many cases, ransomware uses advanced and sophisticated encryption algorithms. And even if there is a decryptor, it is not always clear that it is for the correct version of the malware. And you will not want to further encrypt your files using the wrong decryption script. Therefore, you should pay close attention to the rescue message itself, or even seek the advice of a security / IT specialist before trying anything.


Other ways to deal with a ransomware infection are to download a known security product for disinfection and run an analysis to eliminate the threat. You may not recover all your files, but you can be sure that the infection has been fixed. In the case of the ransomware that blocks the screens, you may need to perform a complete system restore. If that doesn't work, you can try to run an analysis from a bootable CD or USB drive.

If you want to try to defeat an infection with encryption ransomware, you must remain especially vigilant. If you notice that the system slows down for no apparent reason, turn it off and disconnect it from the Internet. If, once you reboot it, the malware is still active, you cannot send or receive instructions from the command and control server. That means that without a key or way to get paid, the malware will remain inactive. At that time, download and install a security product and run a full scan.

How to protect yourself from ransomware

Security experts agree that the best way to protect against ransomware is to avoid infection.

Although there are methods to treat a ransomware infection, at best they are imperfect solutions, and often require some technical knowledge that the foot user does not possess. Therefore, this is what we recommend to users to avoid the consequences of ransomware attacks.


The first step in ransomware prevention is to invest in an excellent computer security program, some program with real-time protection designed to thwart attacks with advanced malware, such as ransomware. You should also look for features that protect the most vulnerable programs against threats (an anti-exploit technology) and at the same time prevent ransomware from sequestering your files (an anti-ransomware component). Customers who used the Premium version of Malwarebytes for Windows, for example, were protected from the main ransomware attacks of 2017.


Then, and even if it's annoying, you should create backup copies of the data regularly. Our recommendation is to use cloud storage that includes high-level encryption and multifactor authentication. However, you can also buy USB drives or external hard drives where you can save new or updated files, but do not forget to physically disconnect these devices from the computer after performing the backup since, otherwise, they could also be infected with Ransomware


Then make sure your systems and software are always up to date. The WannaCry ransomware outbreak took advantage of a vulnerability in Microsoft software. Although the company had published a patch to solve the problem in March 2017, many did not install the update and were left defenseless against the attack. We know that it is difficult to always keep up with a growing list of updates for the growing set of software programs and applications that you use in your daily life. Therefore, we recommend that you enable automatic updates.


Finally, always be informed. One of the most common ways in which computers are infected with ransomware is through social engineering. Receive training (and provide it to your employees if you are the business owner) on how to detect malspam, suspicious websites and other scams. And, above all, use common sense. If something seems suspicious, it probably is.