Changes

'''Ransomware''' is a type of malicious software ([[malware]]) used for cybercrime which attempts to prevent user access to something they value, usually digital information on their [[computer]].  It will then demand that a ransom be paid so that the user can regain access.<ref>https://www.microsoft.com/en-us/security/portal/mmpc/shared/ransomware.aspx</ref>  In most cases, ransomware will [[encrypt]] all of the information on a computer's writable drives, and change the bootloader so that when the computer is started, the malware is launched.  It will state the demands, and explain how the ransom can be paid.<ref>http://whatis.techtarget.com/definition/ransomware-cryptovirus-cryptotrojan-or-cryptoworm</ref>  Once paid, the ransomware publisher promises to send the user a decryption key, which can be entered to decrypt the drive(s). However, in some cases, the publisher takes the money without providing the promised key.<ref>https://heimdalsecurity.com/blog/what-is-ransomware-protection</ref>

'''Ransomware''' is a type of malicious [[software]] ([[malware]]) used for cybercrime which attempts to prevent user access to something they value, usually digital information on their [[computer]].  It will then demand that a ransom be paid so that the user can regain access.<ref>https://www.microsoft.com/en-us/security/portal/mmpc/shared/ransomware.aspx</ref>  In most cases, ransomware will [[encrypt]] all of the information on a computer's writable drives, and change the bootloader so that when the computer is started, the malware is launched.  It will state the demands, and explain how the ransom can be paid.  In some cases, it will claim to be from law enforcement, or claim that the operating system license has expired.  In any case, it will demand payment to regain access to the system and/or files.<ref>http://whatis.techtarget.com/definition/ransomware-cryptovirus-cryptotrojan-or-cryptoworm</ref>  Once paid, the ransomware publisher promises to send the user a decryption key, which can be entered to decrypt the drive(s). However, in some cases, the publisher takes the money without providing the promised key.<ref>https://heimdalsecurity.com/blog/what-is-ransomware-protection</ref>

==Evolution==

==Evolution==

==Variants==

==Variants==

There are several types of ransomeware.  Some lock the device, but do not actually encrypt the data, while others (called Leakware) will not deny access at all.  Rather, leakware threatens to publish information from the victim's computer if they do not pay.  This is nothing more than a form of blackmail.

There are several types of ransomeware.  Some lock the device, but do not actually encrypt the data, while others (called Leakware) will not deny access at all.  Rather, leakware threatens to publish information from the victim's computer if they do not pay.  This is nothing more than a form of blackmail.  Probably the most common form simply encrypts content, then demands payment for release.

==Examples==

==Examples==

*Reveton

*Reveton

*TeslaCrypt (attacked [[video games]])<ref>https://www.hackread.com/famous-games-hijacked-for-ransom-through-teslacrypt-ransomware</ref>

*TeslaCrypt (attacked [[video games]])<ref>https://www.hackread.com/famous-games-hijacked-for-ransom-through-teslacrypt-ransomware</ref>

*WannaCry (attacked entire Windows systems)<ref>http://bgr.com/2017/05/15/wanna-cry-ransomware-virus-windows-wannacry-explainer</ref>

*WannaCry<ref>http://bgr.com/2017/05/15/wanna-cry-ransomware-virus-windows-wannacry-explainer</ref> / WanaCrypt0r<ref>https://blog.malwarebytes.com/cybercrime/2017/05/wanacrypt0r-ransomware-hits-it-big-just-before-the-weekend</ref>

==Avoidance==

==Avoidance==

To avoid ransomware infections, all of the basic safety habits should be practiced.  Unknown links should never be clicked, untrusted software should never be installed, e-mail messages from unrecognized senders should never be opened, and so on. However, some ransomware is delivered by worm, so even if everything is done right, an infection can still take place.<br />

To avoid ransomware infections, all of the basic safety habits should be practiced.  Unknown links should never be clicked, untrusted software should never be installed, e-mail messages from unrecognized senders should never be opened, and so on. Most ransomeware is delivered by E-mail, usually as a package delivery notice, or some other legitimate-sounding message.<ref>http://www.computerweekly.com/feature/How-to-avoid-being-caught-out-by-ransomware</ref> This is true for smartphones, as well as computers--phones are common targets,<ref>http://www.pcworld.com/article/2901672/how-to-prevent-ransomware-what-one-company-learned-the-hard-way.html</ref> and in some cases are harder to recover. However, some ransomware is delivered by worm, so even if everything is done right, an infection can still take place.<br />

Usage of anti-malware software can help significantly in preventing an infection.  Basic anti-virus and other anti-malware programs can be useful, since they detect known signatures of ransomware (and other malware) and block them. Heuristic (behavior-based) protection can also be helpful, as it can sometimes detect malware which is not otherwise known.  Larger computer systems such as those used by corporations also can benefit from the newer defense method of Deception technology.

Usage of anti-malware software can help significantly in preventing an infection.  Basic anti-virus and other anti-malware programs can be useful, since they detect known signatures of ransomware (and other malware) and block them. Heuristic (behavior-based) protection can also be helpful, as it can sometimes detect malware which is not otherwise known.  Larger computer systems such as those used by corporations also can benefit from the newer defense method of Deception technology. Additionally, networks can be configured to block traffic from suspicious domains and countries.  This can stop attacks form these locations quite easily.<ref>https://www.helpnetsecurity.com/2017/05/15/prevent-ransomware-guide/</ref>

==Mitigation==

==Mitigation==

===Preparation===

===Preparation===

Computer users should be sure to regularly back up their personal files on external drives.  USB Flash drives, external hard drives, and other such devices can be used for this purpose.  In between backups, the drive(s) should always be kept disconnected from that computer, and preferably all others as well.<br />

Computer users should be sure to regularly back up their personal files on external drives.  USB Flash drives, external hard drives, and other such devices can be used for this purpose.  In between backups, the drive(s) should always be kept disconnected from that computer, and preferably all others as well.<br />

Ideally, the individual will also create complete system backups periodically.  This can be done using software such as DriveImage XML.  These disk images should be stored on a separate storage device as well, and only connected to the computer at risk when backups are being created.  If possible, it is also wise for the individual to keep older images, in case the more recent images were infected, or are for some reason corrupted.

Ideally, the individual will also create complete system backups periodically.  This can be done using software such as DriveImage XML.  These disk images should be stored on a separate storage device as well, and only connected to the computer at risk when backups are being created.  If possible, it is also wise for the individual to keep older images, in case the more recent images were infected, or are for some reason corrupted.<ref>https://blog.malwarebytes.com/101/2016/03/how-to-beat-ransomware-prevent-dont-react</ref>

===Cleanup===

===Cleanup===