Ransomware: Kaspersky’s David Emm explains the threat to small business and home users
Rogueware, which is malware that pretends to be legitimate anti-virus software, is one of the biggest threats we currently face. Inherent in all rogueware is a hidden warning: if you don’t buy our software, you will continue to suffer from viruses and trojans. It’s a short step from the ‘buy our product for your security’ warning, to a ‘buy our product or else’ extortion.
But now the ‘threat as a by-product’ is morphing into pure blackmail: ransomware. It’s been around for a few years, but a recent Kaspersky blog highlights the return of GpCode-like ransomware, which makes no pretence to being legitimate: it encrypts your files and won’t let you have them back unless you pay a ransom.
We have received several reports from people around the world asking for help with infections very similar to the GpCode trojan that we detected in 2008…
As we explained before, this type of malware is very dangerous because the chances of getting your data back are very low. It is almost the same as permanent removal of the data from your hard drive.
With the earlier versions Kaspersky managed, in some cases, to recover the data as well as remove the trojan. This time it’s more difficult. David Emm, senior security researcher at Kaspersky Lab, explained the basis of ransomware, and the difference between the earlier version and this new ransomware; and in particular why this new version is more dangerous.
“The GpCode trojan is one of the main examples of ransomware. It is code used to extort money from people. The way it works is to encrypt files on the computer: documents, presentations, spreadsheets, anything really. It encrypts them and then either pops up a message on the screen, or maybe just writes a text file to the disk, so that when the user notices he cannot access something, then he gets the message. It says something like ‘I’ve encrypted your data, and if you want to get it back, you’ll need to decrypt it; and that means sending me an email message.’ So you send the email message to the address given, and then whoever it is replies, ‘Right, well I can soon fix that and decrypt everything, but it will cost you…’
“The Trojan encrypts your files with 1024-bit RSA and AES 256 cryptography,” he said, both of which are pretty well uncrackable. “In the older versions, the code encrypted the files, and then deleted the originals. We didn’t crack the cryptography, we managed to recover the deleted files. So we could remove the trojan and recover the files. But this new version doesn’t work like that; and we haven’t yet found a way to recover any lost data.”
His advice is unchanged. “Their MO is that they prey on someone who is vulnerable – extortion, online or offline, always works like this – and the vulnerability in this case is that you don’t have a back-up of your data. So if you haven’t got back-up, and you find you cannot access your files, or you get a pop-up message or email telling you that payment of £10, €20, $50 or whatever will get you a decryption method, turn off your computer immediately and contact a reputable anti-virus company.” The more you use your system, the more unlikely it is that any deleted files can be recovered. The old method of recovery doesn’t work with this new ransomware; but the AV and data recovery companies might yet find an alternative solution.
Cure, of course, is never as good as prevention. “It’s the small businesses and home users that are going to suffer,” David explained. “In a medium-sized business or larger, anyone who gets infected can just go to the IT guys, and they’ll rebuild the system and data from the company back-ups. But small businesses and home users often don’t have any backup. And restoring from backup is the only way you can guarantee to get encrypted files back.”
Don’t wait to get caught by ransomware. If you do, it may be too late and your only choice will be to pay the criminals or lose your data. You need to
- behave securely in cyberspace to avoid infection
- and use mainstream anti-virus to minimize infection
- and get adequate backup to recover from infection
- else contact a mainstream anti-virus company in the event of infection.
Do not just rely on the last of these.