Ransomware

Ransomware is a type of malicious software (malware) used for cybercrime which attempts to prevent user access to something they value, usually digital information on their computer. It will then demand that a ransom be paid so that the user can regain access. In most cases, ransomware will encrypt all of the information on a computer's writable drives, and change the bootloader so that when the computer is started, the malware is launched. It will state the demands, and explain how the ransom can be paid. Once paid, the ransomware publisher promises to send the user a decryption key, which can be entered to decrypt the drive(s). However, in some cases, the publisher takes the money without providing the promised key.

Evolution

Before improving in 2013, ransomware started out an a method of attack against corporations. The ransom would be very high, since the company targeted would have significant assets. To resume necessary business processes, the corporation may be willing to pay the exorbitant fee. However, modern ransomware now usually charges much less, but is carried by a worm, virus, or trojan so that it can infect many computers worldwide. Although most individual users have no way of paying $100,000, they may be willing to pay $500 to recover their photographs, documents, or other files which are locked on their computer.

Variants

There are several types of ransomeware. Some lock the device, but do not actually encrypt the data, while others (called Leakware) will not deny access at all. Rather, leakware threatens to publish information from the victim's computer if they do not pay. This is nothing more than a form of blackmail.

Examples

Theses are some of the better known examples of ransomware.

• AIDS Trojan (first known, and was flawed)
• Dharma (delivered using unsolicited emails)
• TeslaCrypt (attacked video games)
• WannaCry (attacked entire Windows systems)

Mitigation

When an individual needs to deal with a ransomware infection, backups become vital. Since most ransomeware uses encryption, data on targeted devices is often impossible to recover unless the ransomware publisher provides the decryption key. Even with backups, users must be careful during the recovery process.

Preparation

Computer users should be sure to regularly back up their personal files on external drives. USB Flash drives, external hard drives, and other such devices can be used for this purpose. In between backups, the drive(s) should always be kept disconnected from that computer, and preferably all others as well.
Ideally, the individual will also create complete system backups periodically. This can be done using software such as DriveImage XML. These disk images should be stored on a separate storage device as well, and only connected to the computer at risk when backups are being created. If possible, it is also wise for the individual to keep older images, in case the more recent images were infected, or are for some reason corrupted.