Cyber world is full of amazement, fear and malicious vectors. Growing online access has also invited many threats to online security that have induced organizations to think over online security as well internal IT infrastructure. If you see around you will find many types of threats, vulnerabilities to take advantage of loopholes of software, application, IT system and damage reputation of company and equally customer’s privacy. In this article, we would like to talk about emerging threat named Ransomware that has shown huge growth in last few years and compelled security industry to find number of tools to prevent it.
What Is Ransomware?
Ransomware is a kind of malware that does not allow the user to access the system. The only way to get access to your system again and get the data back is by paying the ransom with the way hacker asks. However, it does not mean that you would surely gain access to the system by paying the ransom. The ransom price may variable and depends upon the attacker’s demand. Similar to ransomware, there is another threat named scareware that falsely alerts users about computer infection and entice them to make purchase of malicious software.
How Does Ransomware Work?
A rogue software code holds the system captive for ransom money by infiltrating the system with computer worm or Trojan horse. This malware makes the most of open security susceptibility. When a user clicks on a virus-infected e-mail attachment or visits a website that has been hacked, it may lead to ransomware attacks. Once the system is compromised, ransomware generally locks the system and computer screen or encodes the files known as Cryptolocker. There is a type of ransomware known as CTB Locker that takes help of TOR (The Onion Router) in order to hide C&C communications. Ransomware even gets access to your system through payload that is downloaded by various other malware.
Once you click the infected popup advertisements, the perpetrators of cyber crimes try to get money from you. Malware gets embarrassing when obscene ads promoting adult content suddenly show up out of nowhere on your screen. Ransomware attacks sometimes trouble the users by time pressure with the display message “You will lose your data every 30 minutes till you don’t make the payment”. There are instances where it pushes you to buy a program to get the data decrypted.
Some of the known ransomware are mentioned below:
- Trojan:Win32/Crilock.A
- Trojan-Ransom.Win32.Blocker.cgmz
- TROJ_RANSOM
- TROJ_CRILOCK
- Trojan-Ransom.Win32.Foreign.acc
- Ransom.FH
- Trojan:Win32/Ransom.GT
Protection From Ransomware
It may seem difficult to deal with ransomware; but there are steps that you can take against it, to protect your system. In order to save your data, you need to follow the steps discussed below. By keeping them in mind, you can effectively prevent the harm caused by ransomware and spare yourself from wasting money over it.
-
A reliable antivirus software and firewall are a must
Have a reputable antivirus program installed in your system. Make sure it is updated regularly. Besides, it is recommended to have a strong firewall that would keep unwanted files & access away from your system. Perform a full scan to be assured that there are no viruses left in your computer files. In case an infected file is detected, immediately remove it or uninstall the program.
-
Do not procrastinate when it comes to backing up the files
You cannot afford to lose your important data because of your carelessness. Back up your files regularly to an external hard drive or to a reliable online backup service to reduce the risk of malware. You can keep the critical files safe in Google Drive too.
-
Keep your popup blocker enabled
Cyber crimes most often spread through popups. The criminals often reprogram the buttons within a popup so you should never click on a popup no matter how tempting the advertisement seems. Click on the “x” in the right hand corner of the popup to close the pop up without fail.
-
Do not open any Email without checking the sender
Email sender should always be verified before opening it. If the Email is assumed to have come from an organization you know, verify its authenticity first. If the Email is from a contact in your address book, recheck that by getting confirmation from the relevant person. There have been cases where spammed messages come from friends and family. Be extra cautious when it comes to Emails.
-
Check whether the content of the Email is authenticated
Do not get enticed by attractive offers mentioned in the Email. This can be a spam mail to deliver malware on your system. As attackers throw fake offers to make users victim of their malicious intentions. It is better to check grammar of content and if you find any mistake then avoid such phishing emails.
-
Never run .EXE files from Emails
Reject files that are with the extension .EXE. In case you need to send or receive such files, you can compress the files and exchange them in password protected zip format. Attackers generally use .EXE file that contains malware or threats. When users download and execute it, the malware also spreads on users’ PC system.
-
Avoid clicking the links that are mentioned in the Email
It is advisable to look at the link received in mail rather than blindly clicking on the link directly. Moreover, it is safer to have a browser that checks the link for malware before loading it. Many fake links redirect users to a fake webpage where they are asked for login information or deposit money.
-
Inform the authorities
Inform the powerful authorities that can handle the issue better instead of paying ransom amount to hackers. If you pay the ransom, there may be a chance that they will bother you even more and not let you restore the access to the system. Protecting your personal information and being watchful are the key points to remember when it comes to ransomware protection.
-
Make use of Cryptolocker Prevention Kit
Cryptolocker Prevention Kit disables files that run through App Data and Local App Data Folders. It also prevents the execution of .EXE files. Make sure you have the latest version of Cryptolocker prevention tool.
-
RDP should be disabled
Cryptolocker access targeted systems via Remote Desktop Protocol (RDP). RDP allows other users to access your system from a remote location. If your system does not use this facility, you should disable to stay protected from unintended File coder and other RDP exploits.
-
Restore System to early stage
As soon as you find that you have been infected with ransomware, disable the Internet connection and shut down the computer for a while to prevent the immediate transmission of your personal data to the cyber culprits. Otherwise, you can even use the option of System Restore if you have it enabled on your system. This would help you in taking the system back to a state where it worked the best. Latest version of Ransomware has been found to delete “Shadow” files from System Restore so you have to move files quickly before automated deletion process starts.
Conclusion
Because of growing digitalized life, it is imperative to stay protected from the cyber culprits who aim on adding hurdles to the “Digital Era”. Having regular backups, using updated security systems with strong passwords, applying software patches and being prepared to fight against malware are the best solutions to handle the issues of ransomware and keep our precious data safe.
