Ransomware: What it is, why you should care, and what you can do to prevent them
By: Xing, Teddy
Tags: Information Security, Cybersecurity, Ransomware, Information Technology

You probably have heard a lot about them recently. Back in May, a ransomware attack shut down one of the top U.S. gas pipelines. The Colonial Pipeline Company was ransomed for 75 bitcoins which is approximately 4.4 million dollars. But the impact and damage of this ransomware went beyond just monetary. Since Colonial pipeline is a major artery responsible for delivering fuel in the east coast, the thought of possible fuel shortage led to chaos and a mass panic in many areas in the east coast which can be seen with massive lines out of gas stations.

Gas shortages following Colonial Pipeline ransomware attack

Following the attack, Colonial Pipeline also disclosed that the attack also compromised the personal information of nearly 6,000 individuals. If that weren’t bad enough, Kaseya, an MSP (Managed Service Provider) got hit with an even bigger ransomware attack that flooded hundreds of companies that relied on its managed software with ransomware as well.

So, what is ransomware?

Ransomware is a subset of malware which the data on a victim’s computer is locked typically with encryption and payment is demanded from the victim before the attacker decrypts the ransomware data and the access is returned. Unlike other cyber-attacks, the motive behind ransomware attack is usually monetary driven. The victim will typically be notified that an exploit has occurred, the data on the system is locked, and given instruction on how to recover from the attack. As seen with most ransomware attacks, payment is often demand in forms of virtual currencies (bitcoin is a popular choice) so that the identity of the cybercriminals stated hidden as well as making payments harder to trace. A popular form for ransomware to spread is often through malicious attachments and links found in emails or other infected malicious software apps. Once infected, ransomware does not require any additional user interaction to do damage.

So why should you care?

Now you must be thinking, these are big enterprises, no way its going to happen to me, right? Wrong, everyone is vulnerable to ransomware especially now where ransomware is more accessible to attackers than ever. In fact, ransomware is so lucrative that it is being offered as a service. Ransomware as a service (RaaS) is all about providing ransomware in the form of a software as a service (SaaS) model. The RaaS vendor operates all the back-end infrastructure for running the ransomware with some even providing chatrooms for potential buyer with live agents to answer questions. It is so easy that the time it takes to launch a ransomware attack is equivalent or less than that the time it takes to add an item to the shopping cart on an ecommerce website.

What you can do to prevent ransomware attacks?

To protect yourself against ransomware attacks and other forms of cyber extortion attacks, you should do the following:

· Avoid clicking on links in emails or opening email attachments from suspicious senders especially ones that have unusual addresses and from senders you don’t recognize. If it seems suspicious, more often than not, it is.

· Always keep your devices and software up to date especially your OS and antivirus software to ensure them have the latest security patches and updates.

· Back up your devices regularly.

· Utilize your antivirus software to scan downloaded files (compressed and archived files) for malicious content. Most modern antivirus software includes this feature out of the box or can be turn on in settings.

· Turn on multifactor authentication (MFA) or two-factor authentication (2FA) on your accounts. Please use multifactor authentication or two-factor authentication on all your accounts! This cannot be stressed enough. Most social media sites offer this feature which is as easy as going into your user settings and switching it on. Below are couple examples of MFA and 2FA from LinkedIn and Facebook:

LinkedIn Two-step verification