Changes

==Evolution==

==Evolution==

Before a shift in 2013, ransomware was a method of attack against corporations.<ref>https://www.knowbe4.com/ransomware</ref>  The ransom would be very high, since the company targeted would have significant assets.  To resume necessary business processes, the corporation may be willing to pay the exorbitant fee.<ref>http://www.darkreading.com/endpoint/a-brief-history-of-ransomware/d/d-id/1325212</ref><ref>http://www.latimes.com/business/hiltzik/la-fi-mh-2016-is-the-year-of-ransomware-20160308-column.html</ref> However, modern ransomware now usually charges much less, but is carried by a worm, virus, or trojan so that it can infect many computers worldwide.<ref>https://www.trendmicro.com/vinfo/us/security/definition/ransomware</ref>  Although most individual users have no way of paying $100,000, they may be willing to pay $500 to recover their photographs, documents, or other files which are locked on their computer.<ref>https://us.norton.com/yoursecurityresource/detail.jsp?aid=rise_in_ransomware</ref>

Before a shift in 2013, ransomware was a method of attack against corporations.<ref>https://www.knowbe4.com/ransomware</ref>  The ransom would be very high, since the company targeted would have significant assets.  To resume necessary business processes, the corporation may be willing to pay the exorbitant fee.<ref>http://www.darkreading.com/endpoint/a-brief-history-of-ransomware/d/d-id/1325212</ref><ref>http://www.latimes.com/business/hiltzik/la-fi-mh-2016-is-the-year-of-ransomware-20160308-column.html</ref> However, modern ransomware now usually charges much less, but is carried by a worm, virus, or trojan so that it can infect many computers worldwide.<ref>https://www.trendmicro.com/vinfo/us/security/definition/ransomware</ref>  Although most individual users have no way of paying $100,000, they may be willing to pay $500 to recover their photographs, documents, or other files which are locked on their computer.<ref>https://us.norton.com/yoursecurityresource/detail.jsp?aid=rise_in_ransomware</ref><br />

 

#Notification - the user is now notified that their information is being held hostage, and they must pay a ransom to get the decryption key<ref name="alienvault.com">http://learn.alienvault.com/c/ransomware-detection?utm_internal=ransomwarelookbook</ref>

==Variants==

==Variants==

There are several types of ransomeware.  Some lock the device, but do not actually encrypt the data, while others (called Leakware) will not deny access at all.  Rather, leakware threatens to publish information from the victim's computer if they do not pay.  This is nothing more than a form of blackmail.  Probably the most common form simply encrypts content, then demands payment for release.

There are several types of ransomware.  Some lock the device, but do not actually encrypt the data, while others (called Leakware) will not deny access at all.  Rather, leakware threatens to publish information from the victim's computer if they do not pay.  This is nothing more than a form of blackmail.  Probably the most common form of ransomware simply encrypts content, then demands payment for release.

==Examples==

==Examples==

*TeslaCrypt (attacked [[video games]])<ref>https://www.hackread.com/famous-games-hijacked-for-ransom-through-teslacrypt-ransomware</ref>

*TeslaCrypt (attacked [[video games]])<ref>https://www.hackread.com/famous-games-hijacked-for-ransom-through-teslacrypt-ransomware</ref>

*TorrentLocker

*TorrentLocker

*WannaCry<ref>http://bgr.com/2017/05/15/wanna-cry-ransomware-virus-windows-wannacry-explainer</ref> / WanaCrypt0r<ref>https://blog.malwarebytes.com/cybercrime/2017/05/wanacrypt0r-ransomware-hits-it-big-just-before-the-weekend</ref>

*WannaCry<ref>http://bgr.com/2017/05/15/wanna-cry-ransomware-virus-windows-wannacry-explainer</ref> / WanaCrypt0r<ref>https://blog.malwarebytes.com/cybercrime/2017/05/wanacrypt0r-ransomware-hits-it-big-just-before-the-weekend</ref>

*[[Petya (malware)|Petya]]<ref>https://www.kaspersky.com/blog/petya-ransomware/11715/</ref>

*[[Petya (malware)|Petya]]<ref>https://www.kaspersky.com/blog/petya-ransomware/11715/</ref>

==Avoidance==

==Avoidance==

To avoid ransomware infections, all of the basic safety habits should be practiced.  Unknown links should never be clicked, untrusted software should never be installed, e-mail messages from unrecognized senders should never be opened, and so on. Most ransomware is delivered by E-mail, usually as a package delivery notice, or some other legitimate-sounding message.<ref>http://www.computerweekly.com/feature/How-to-avoid-being-caught-out-by-ransomware</ref> This is true for smartphones, as well as computers—phones are common targets,<ref>http://www.pcworld.com/article/2901672/how-to-prevent-ransomware-what-one-company-learned-the-hard-way.html</ref> and in some cases are harder to recover. However, some ransomware is delivered by worm, so even if everything is done right, an infection can still take place.<br />

To avoid ransomware infections, all of the basic safety habits should be practiced.  Unknown links should never be clicked, untrusted software should never be installed, e-mail messages from unrecognized senders should never be opened, and so on. Most ransomware is delivered by E-mail, usually as a package delivery notice, or some other legitimate-sounding message.<ref>http://www.computerweekly.com/feature/How-to-avoid-being-caught-out-by-ransomware</ref><ref name="phishme">https://phishme.com/ransomware-delivered-97-phishing-emails-end-q3-2016-supporting-booming-cybercrime-industry/</ref> This is true for smartphones, as well as computers—phones are common targets,<ref>http://www.pcworld.com/article/2901672/how-to-prevent-ransomware-what-one-company-learned-the-hard-way.html</ref> and in some cases are harder to recover. However, some ransomware is delivered by worm, so even if everything is done right, an infection can still take place.<br />

Usage of anti-malware software can help significantly in preventing an infection.  Basic anti-virus and other anti-malware programs can be useful, since they detect known signatures of ransomware (and other malware) and block them. Heuristic (behavior-based) protection can also be helpful, as it can sometimes detect malware which is not otherwise known.  Larger computer systems such as those used by corporations also can benefit from the newer defense method of Deception technology.  Additionally, networks can be configured to block traffic from suspicious domains and countries.  This can stop attacks form these locations quite easily.<ref>https://www.helpnetsecurity.com/2017/05/15/prevent-ransomware-guide/</ref>

Usage of anti-malware software can help significantly in preventing an infection.  Basic anti-virus and other anti-malware programs can be useful, since they detect known signatures of ransomware (and other malware) and block them. Heuristic (behavior-based) protection can also be helpful, as it can sometimes detect malware which is not otherwise known.  Larger computer systems such as those used by corporations also can benefit from the newer defense method of Deception technology.  Additionally, networks can be configured to block traffic from suspicious domains and countries.  This can stop attacks form these locations quite easily.<ref>https://www.helpnetsecurity.com/2017/05/15/prevent-ransomware-guide/</ref>

==Mitigation==

==Mitigation==

When an individual needs to deal with a ransomware infection, backups become vital.  Since most ransomeware uses encryption, data on targeted devices is often impossible to recover unless the ransomware publisher provides the decryption key.  Even with backups, users must be careful during the recovery process.

When an individual needs to deal with a ransomware infection, backups become vital.  Since most ransomware uses encryption, data on targeted devices is often impossible to recover unless the ransomware publisher provides the decryption key.  Even with backups, users must be careful during the recovery process.

===Preparation===

===Preparation===

====Using file backups only====

====Using file backups only====

Without a full backup, a new operating system is needed. Therefore, users will probably need to do something along these lines:

Without a full backup, a new operating system is needed. Even if the system seems usable, it is infected and should not be trusted. Therefore, users will probably need to do something along these lines:

#Insert an operating install disk, and boot to it, with all external storage devices disconnected.  ''(If this is blocked by the ransomware, then the BIOS will need to be "flashed," or replaced by replacing the motherboard)''

#Insert an operating install disk, and boot to it, with all external storage devices disconnected.  ''(If this is blocked by the ransomware, then the BIOS will need to be "flashed," or replaced by replacing the motherboard)''

#Format the drive (using NTFS format)

#Format the drive (using NTFS format)

#Go through the install process, which will take some time to complete

#Go through the install process, which will take some time to complete

#Once done, start the newly installed system, and configure it as desired.  Then, copy on the file backups, as desired.  When possible, some users prefer to put off entering their OS license key as long as possible, in case the ransomware comes back.

#Once done, start the newly installed system, and configure it as desired.  Then, copy on the file backups, as desired.  When possible, some users prefer to put off entering their OS license key as long as possible, in case the ransomware infects the new system.

====Without backups====

====Without backups====

If a user has no backups, recovering the data can be very difficult, if not impossible.  Some ransomeware contains flaws, permitting data recovery without paying the ransom.  Doing some web searches may be wise, to see if a solution has been found.  Also, some security companies will sometimes buy release keys and publish them for free, to cost the publisher money.  Looking for such a key could also be advantageous.<br />

If a user has no backups, recovering the data can be very difficult, if not impossible.  Some ransomware contains flaws, permitting data recovery without paying the ransom.  Doing some web searches (using an uninfected device) may be wise, to see if a solution has been found.  Also, some security companies will sometimes buy release keys and publish them for free, to cost the malware publisher money.  Looking for such a key could also be advantageous.<br />

Users may also want to try using a boot disk and see if data is truly encrypted, or just "locked."  In some cases, ransomware does not encrypt the data, so the files can be copied onto an external storage device using the boot disk.<br />

Users may also want to try using a boot disk and see if data is truly encrypted, or just "locked."  In some cases, ransomware does not encrypt the data, so the files can be copied onto an external storage device using the boot disk.<br />

Sometimes, although ethically questionable, the pragmatic solution is to simply pay the ransom.  Unfortunately, once the ransom is paid, the publisher has little incentive to provide the key.  Sometimes, they may do exactly what they promise.   

Sometimes, although ethically questionable, the pragmatic solution is to simply pay the ransom.  Unfortunately, once the ransom is paid, the publisher has little incentive to provide the key.  Sometimes, they may do exactly what they promise.   

Other times, they may not provide the key, may demand more money, or provide a key which temporally released the data, but then locks it again.  If the data is released, there is no guarantee that the computer is not still spreading the ransomware to other computers, either. If the ransom is paid and an unlock key is provided, it is often advised that tusers immediately back up their data using a boot disk, before using their computer further.  Also, reinstalling the operating system may be wise, to ensure that the ransomware is gone.

Other times, they may not provide the key, may demand more money, or provide a key which temporally released the data, but then locks it again.  If the data is released, there is no guarantee that the computer is not still spreading the ransomware to other computers, either. If the ransom is paid and an unlock key is provided, it is often advised that users immediately back up their data using a boot disk, before using their computer further.  Also, reinstalling the operating system may be wise, to ensure that the ransomware is gone.

===Other information===

===Other information===