Ransomware Ravaging the World
Iqbal Singh Technology Expert & Senior Corporate Executive in a European MNC Imagine you booting your laptop in the morning to start your workday and you have the below message staring at you from your laptop screen. This is an example of a screen-locking ransomware that holds your computer hostage by blocking your access to the operating system and there is almost nothing you can do to access your files and data on your laptop. Now imagine the victim of ransomware instead of being a single user in an organization, maybe an oil pipeline company with a pipeline network of nearly 9000kms or a meat company with plants across the globe or a 800 store retail company. Yes, all of these are real examples of organizations who have been recent high profile victims of ransomware. Ransomware is ravaging the world | Andrey Popov / Getty Images WannaCry ransomware note. Image: Cisco Talos On 07 May 2021 an employee of Colonial Pipeline – the company with the largest pipeline in the USA found a ransom note from hackers on a control-room computer. This provoked a shutdown of their operations for five days, which resulted in a temporary fuel shortage along the East Coast, leading to spike in gas prices and huge queues of consumers at gas stations. The CEO of the company confirmed that they paid a ransom of $4.4 million. 30 May 2021 JBS, the largest beef supplier in the world, suffered a cyberattack, disabling its beef and pork slaughterhouses. The attack impacted facilities in the United States, Canada, and Australia. The company paid a ransom of $11m to the hackers. The Swedish Coop grocery store chain closed all its 800 stores on 03 Jul 2021 after a ransomware attack on American IT provider Kaseya left it unable to operate its cash registers. Hundreds of American businesses were also hit by an unusually sophisticated attack that hijacked the widely used Kaseya software. What is Ransomware? Ransomware is a form of malicious software – malware – that encrypts files and documents on anything from a single PC all the way up to an entire network, including servers. The attacker then demands a ransom from the victim to restore access to the data upon payment. Victims can often be left with limited choices; they can either regain access to their encrypted network by paying a ransom to the criminals behind the ransomware or restore from backups or hope that there is a decryption key freely available. Or start again from scratch. Hackers have been mostly unforgiving and ruthless in choosing their ransomware targets. They have not spared even health-care providers, municipalities and schools, big commercial organizations, of course, are expected tempting targets. The Washington Post found that ransomware attacks in the United States more than doubled from 2019 to 2020. One of the unfortunate success stories of the coronavirus times has been ransomware. Studies consistently show that the scale and cost of ransomware continues to grow. Methods of Infection Understanding how ransomware infects and spreads is the key to avoiding falling victim to an attack. Post-infection, ransomware can spread to other machines or encrypt network filers in the organization’s network. In some cases, it can spread across organizational boundaries to infect supply chains, customers and other organizations. All of the following can be vectors of infection for ransomware attacks: Phishing. Compromised websites. Malvertising. Exploit kits. Downloads. Messaging applications. Brute force via RDP (remote desk protocol) History of Ransomware Even though ransomware is making headlines in recent years the scheme is not new. The idea of taking user files or computers hostage by encrypting files, hindering system access or other methods and then demanding a ransom to return them is a few decades old. In the late 1980s, criminals were already holding encrypted files hostage in exchange for cash sent via the postal service. One of the first ransomware attacks ever documented was the AIDS trojan (PC Cyborg Virus) that was released via floppy disk in 1989. Victims needed to send $189 to a P.O. box in Panama to restore access to their systems, even though it was a simple virus. The AIDS demand for payment – by post. Image: Sophos Ransomware attacks were still not that common well into the 2000s – probably due to difficulties with payment collection. It was the emergence of cryptocurrencies such as Bitcoin in 2010, that completely altered the landscape. It provided an easy and untraceable method for receiving payment from victims, virtual currencies created the opportunity for ransomware to become a lucrative business. Cyber criminals were quick to latch on to the monetization opportunity that Bitcoin created. This resulted in a substantial proliferation of ransomware beginning in 2012. Intro of CryptoLockers Ransomware was now moving from a petty crime into the realm of financial windfalls. Accordingly, the cyber criminals’ degree of technical sophistication also increased. The levels of encryption started improving from a 56 bit to 660-bit RSA public key encryption to 2048-bits RSA encryption keys by 2014. One significant development was the emergence of cryptolocking ransomware in 2013. CryptoLocker is a strain of ransomware so potent and dangerous that it took a dedicated global government task force to bring it down — but not before the cybercriminals behind it raked in millions of dollars from their hapless victims. It encrypts files on Windows computers, then demands a ransom payment in exchange for the decryption key. It first emerged in September 2013 in a sustained attack that lasted until May of the following year. CryptoLocker fooled targets into downloading malicious attachments sent via emails. Once opened, these Trojan horse attachments would execute the malware hidden in[1]side. Just to give you an idea of the impact CryptoLocker raked in a revenue of $30m within the first 100 days of its appearance. Earlier the encryptions used symmetric keys (same key to crypt as well as decrypt), however, CryptoLocker uses an asymmetric encryption method that makes it difficult to crack. This two-key system uses one public key for…