Ransomware

longknife · Feb 14, 2015

First I've heard of it was today while scanning my RSS feeds. Appears to be another form of virus, especially infecting Android apps.

Came across some info on detecting and removing it:

How to rescue your PC from ransomware @ http://www.pcworld.com/article/2084002/how-to-rescue-your-pc-from-ransomware.html

Ransomware - What is ransomware? @ http://www.microsoft.com/security/portal/mmpc/shared/ransomware.aspx

I originally got this from: Got Android? Be Careful Out There! @ http://dad29.blogspot.com/2015/02/got-android-be-careful-out-there.html

waltky · Feb 20, 2016

Hollywood Presbyterian Medical Center in Calif. hit by ransomware attack...

LA Hospital Ransomware Attack Worries Cybersecurity Experts
February 19, 2016 Cybersecurity experts worry that the $17,000 a Los Angeles hospital paid hackers to regain control of its computers could signal a troubling escalation of the growing "ransomware'' threat.

Though patient care was not "compromised in any way,'' Hollywood Presbyterian Medical Center paid the bounty "in the best interest of restoring normal operations,'' President Allen Stefanek said in a written statement. A typical attack starts when a person opens an emailed link or attachment. Malicious code locks the computer or, worse, an entire network. Victims pay hackers for a "key'' to unlock their machines and may be desperate to do so if they have not diligently backed up their data and networks. Many ransomware victims pay quietly, or abandon infected machines. It was unusual that Hollywood Presbyterian, which has more than 400 beds and is owned by CHA Medical Center of South Korea, both revealed the attack publicly and disclosed its cost.

Computer security experts said hospitals are particularly vulnerable because some medical equipment runs on old operating systems that cannot easily be safeguarded. If an employee opens an infected file from a computer that also connects with a patient monitoring station or insulin pump, those devices also could be locked. Hospitals have not been as diligent in combating cyber threats such as ransomware as other sectors, according to several experts, despite the life-and-death nature of their operations, their tight control over patient information and mandates that they move toward electronic record keeping. Hospitals are "about 10 to 15 years behind the banking industry'' in combatting cyber threats, said Lysa Myers, a researcher with the computer security firm ESET. The math behind whether to pay a ransom demand can be simple. Paying thousands of dollars to resolve a serious attack that has penetrated a multimillion dollar business such as a large hospital would be "a no brainer,'' said James Carder, chief information security officer of LogRhythm, a security intelligence and analytics firm.

The Hollywood Presbyterian Medical Center is pictured in Los Angeles, California, Feb. 16, 2016. The FBI is investigating a cyberattack that locked down the hospital's electronic database for days, pending payment of ransom to the hackers.

Several companies have told Carder that the FBI suggested they pay ransom, he said. Jason Haddix, the director of technical operations at the information security firm Bugcrowd, said companies also have told him the same. "If you're at a point where you can't do anything,'' said Haddix, "sometimes the only option is to pay.'' An FBI spokeswoman did not immediately respond when asked whether the FBI has in some cases suggested that a company pay. The agency said it is investigating the Hollywood Presbyterian case. "Ransomware has been around for several years, but there's been a definite uptick lately in its use by cyber criminals,'' the FBI wrote in a 2015 post on its website. The agency said that it is "targeting these offenders and their scams.'' Hollywood Presbyterian paid 40 bitcoins, a digital currency of floating value that on Thursday was worth about $420 each. The problem was first noticed Feb. 5, hospital president Stefanek said, and its system was fully functioning 10 days later. One reason hackers are attracted to ransomware is that it can be created with relative ease do-it-yourself ransomware kits are available and the return on investment can be strong.

To launch a ransomware campaign that lasts one month might cost $5,900, and generate about $90,000 in revenue, according to projections by the cyber security firm Trustwave. A report from Intel Corp.'s McAfee Labs released in November said the number of ransomware attacks is expected to grow in 2016 because of increased sophistication in the software used to do it. The company estimates that on average, 3 percent of users with infected machines pay a ransom. While a hacker may get several hundred dollars to unlock many individual computers, getting $17,000 is a decent payday. Based on the public confirmation of that figure, hackers are "going to begin to test the price,'' said Jack Danahy, chief technology officer at cyber security firm Barkly. The best defense against a ransomware attack is not to click on unknown links and attachments. Intrusion detection systems and firewalls can help if a person does click but once the ransomware is entrenched, if the system does not have good system backup practices, the choices boil down to paying or never regaining control.

http://www.voanews.com/content/la-h...ck-worries-cybersecurity-experts/3198112.html
Click to expand...

Deckel · Feb 20, 2016

creating regular restore points on your PC is one way to get rid of the stuff usually.

waltky · Mar 11, 2016

Ransomware attacks expected to rise...

Tech Group: 2016 Will Be the Year Ransomware Holds America Hostage
March 9, 2016 -- 2016 is the year ransomware will wreak havoc on Americas critical infrastructure community, warned a new report released Wednesday by the Institute for Critical Infrastructure Technology (ICIT). To Pay or Not to Pay will be the question fueling heated debate in boardrooms across the Nation and abroad, predicts ICIT, a non-profit, non-partisan group that acts as a conduit between the private sector, federal agencies, and the legislative community.

Ransomware is a cyberattack that holds a victims computer system for ransom by encrypting data files or completely locking it down. Cybercriminals then demand a ransom for the decryption key, threatening to destroy the data if the victim does not comply. Ransomware is rampant, ICIT reports, with some attacks posing as bogus law enforcement announcements. Businesses, healthcare organizations, educational, religious, and financial institutions have all been victims of ransomware, which is often accompanied by denial of service attacks that cost victims an average of $500 per minute, notes the report, which was co-authored by ICIT senior fellows James Scott and Parham Eftekhari. Even police and fire departments have been targeted. Victims have to make a very difficult decision. Either pay the ransom without knowledge of who receives that money and what further harm is done with it or lose all of their data behind a layer of encryption In numerous cases, organizations tend to pay because, for them, every minute of downtime directly equates to lost revenue.

Last weekend, ransomware called KeRanger demanded that owners of Macintosh computers pay one bitcoin (about $405) to unlock their computers. KeRanger, the first fully functional ransomware to infect Macs, was spread via Transmission, a popular open source information sharing network used to download software, music and videos. It first appeared on March 4, but was successfully shut down two days later after infecting about 6,500 computers, Forbes reported. Ransomware threat actors adopt the highwayman mentality by threatening the lifeblood of their victims information and boldly offering an ultimatum, the ICIT report stated, adding that a small team can easily infect and ransom millions of systems. The attackers only need a few users per million of targets to pay ransom for the campaign to be successful.

Ransomware mimicking a message from law enforcement.

The ICIT report warns that mobile devices, personal computers, industrial control systems, refrigerators, portable hard drives, etc. are not secured in the slightest against a ransomware threat. With [the] prevalence of mobile devices and the looming shadow of the internet of things, the potential threat landscape available to ransomware threat actors is too tantalizing a target to ignore, it pointed out. The FBI, which has set up an Internet Crime Complaint Center, also warns that the use of ransomware is on the rise and lists a number of ways Americans can protect themselves. But ICIT points out that law enforcement has neither the time nor the resources to track down the culprits, citing a February attack on the Horry County, S.C. school district, which paid hackers nearly $10,000 to decrypt 25 servers after an FBI investigation yielded no alternative action.

The report also quoted Joseph Bonavolonta, head of the FBI's CYBER and Counterintelligence Program, who said last October: "To be honest, we often advise people just to pay the ransom. Organizations should protect their networks as if it was a castle under siege, the tech group urged, because no security vendor or law enforcement authority can help victims recover from these attacks. ICIT has also published Know Your Enemies a primer on advanced persistent threat groups in numerous foreign countries that are targeting Americans, including China, Russia, Iran, North and South Korea, Syria, France and Israel.

Tech Group: â2016 Will Be the Year Ransomware Holds America Hostageâ
Click to expand...

waltky · Mar 15, 2016

Ransom demand paid in Bitcoin...

Exclusive: Chinese hackers behind U.S. ransomware attacks - security firms
Mon Mar 14, 2016 - Hackers using tactics and tools previously associated with Chinese government-supported computer network intrusions have joined the booming cyber crime industry of ransomware, four security firms that investigated attacks on U.S. companies said.

Ransomware, which involves encrypting a target's computer files and then demanding payment to unlock them, has generally been considered the domain of run-of-the-mill cyber criminals. But executives of the security firms have seen a level of sophistication in at least a half dozen cases over the last three months akin to those used in state-sponsored attacks, including techniques to gain entry and move around the networks, as well as the software used to manage intrusions. It is obviously a group of skilled of operators that have some amount of experience conducting intrusions, said Phil Burdette, who heads an incident response team at Dell SecureWorks. Burdette said his team was called in on three cases in as many months where hackers spread ransomware after exploiting known vulnerabilities in application servers. From there, the hackers tricked more than 100 computers in each of the companies into installing the malicious programs.

The victims included a transportation company and a technology firm that had 30 percent of its machines captured. Security firms Attack Research, InGuardians and G-C Partners, said they had separately investigated three other similar ransomware attacks since December. Although they cannot be positive, the companies concluded that all were the work of a known advanced threat group from China, Attack Research Chief Executive Val Smith told Reuters. The ransomware attacks have not previously been reported. None of the companies that were victims of the hackers agreed to be identified publicly. The security companies investigating the advanced ransomware intrusions have various theories about what is behind them, but they do not have proof and they have not come to any firm conclusions.

The word 'password' is pictured on a computer screen in this picture illustration taken in Berlin

Most of the theories flow from the possibility that the Chinese government has reduced its support for economic espionage, which it pledged to oppose in an agreement with the United States late last year. Some U.S. companies have reported a decline in Chinese hacking since the agreement. Smith said some government hackers or contractors could be out of work or with reduced work and looking to supplement their income via ransomware. It is also possible, Burdette said, that companies which had been penetrated for trade secrets or other reasons in the past were now being abandoned as China backs away, and that spies or their associates were taking as much as they could on the way out. In one of Dells cases, the means of access by the team spreading ransomware was established in 2013.

The cyber security experts could not completely rule out more prosaic explanations, such as the possibility that ordinary criminals had improved their skills and bought tools previously used only by governments. Dell said that some of the malicious software had been associated by other security firms with a group dubbed Codoso, which has a record of years of attacks of interest to the Chinese government, including those on U.S. defense companies and sites that draw Chinese minorities.

PAYMENT IN BITCOIN
Click to expand...

waltky · Mar 29, 2016

Granny says, "Dat's right - dem *****s is at it again...

FBI Investigating Paralyzing Hack on Another Hospital Chain
March 29, 2016 | WASHINGTON (AP) Modern medicine in the Washington area reverted to 1960s-era paper systems when one of the largest hospital chains was crippled by a virus that shuttered its computers for patients and medical staff.

The FBI said it was investigating the paralyzing attack on MedStar Health Inc., which forced records systems offline, prevented patients from booking appointments, and left staff unable to check email messages or even look up phone numbers. The incident was the latest against U.S. medical providers, coming weeks after a California hospital paid ransom to free its infected systems using the bitcoin currency. A law enforcement official, who declined to be identified because the person was not authorized to discuss an ongoing investigation, said the FBI was assessing whether a similar situation occurred at MedStar. "We can't do anything at all. There's only one system we use, and now it's just paper," said one MedStar employee who, like others, spoke on condition of anonymity because this person was not authorized to speak with reporters.

There were few signs of the attack's effects easing late Monday, with one employee at Georgetown University Hospital saying systems were still down, and saying some managers had to stay late and come in early because of the disruptions. Company spokeswoman Ann Nickels said she couldn't say whether it was a ransomware attack. She said patient care was not affected, and hospitals were using a paper backup system. But when asked whether hackers demanded payment, Nickles said, "I don't have an answer to that," and referred to the company's statement.

MedStar operates 10 hospitals in Maryland and Washington, including the Georgetown hospital. It employs 30,000 staff and has 6,000 affiliated physicians. Dr. Richard Alcorta, the medical director for Maryland's emergency medical services network, said he suspects it was a ransomware attack based on multiple ransomware attempts on individual hospitals in the state. Alcorta said he was unaware of any ransoms paid by Maryland hospitals or health care systems. "People view this, I think, as a form of terrorism and are attempting to extort money by attempting to infect them with this type of virus," he said.

Alcorta said his agency first learned of MedStar's problems about 10:30 a.m., when the company's Good Samaritan Hospital in Baltimore called in a request to divert emergency medical services traffic from that facility. He said that was followed by a similar request from Union Memorial, another MedStar hospital in Baltimore. The diversions were lifted as the hospitals' backup systems started operating, he said. Some staff said they were made aware of the virus earlier, being ordered to shut off their computers entirely by late morning. One Twitter user posted a picture Monday he said showed blacked-out computer screens inside the emergency room of Washington Hospital Center, a trauma center in Northwest Washington.

MORE
Click to expand...

waltky · Jun 8, 2016

University pays $20,000 data ransom...

University pays $20,000 to ransomware hackers
Wed, 08 Jun 2016 - A Canadian university pays hackers to restore access to emails and other files encrypted by ransomware.

A Canadian university has paid hackers to restore access to data they had turned into the digital equivalent of gibberish. The University of Calgary transferred 20,000 Canadian dollars-worth of bitcoins ($15,780; £10,840) after it was unable to unwind damage caused by a type of attack known as ransomware. The malware caused emails and other files to become encrypted. One expert warned that the payout would encourage further blackmail attempts. The move comes the same week Intel warned that ransomware infections were spreading at "an alarming rate". More than 120 separate strains exist, many of which are frequently updated, making it difficult for security experts to offer a solution.

The University of Calgary told a local newspaper that more than 100 of its computers had been affected since it was attacked last month. "The university is now in the process of assessing and evaluating the decryption keys," said the university's vice president Linda Dalgetty. "The actual process of decryption is time-consuming and must be performed with care. "It is important to note that decryption keys do not automatically restore all systems or guarantee the recovery of all data." She added that the local police force was investigating the matter.

Exposure threats

The university follows other high-profile bodies to have met cybercriminals' demands in recent weeks. In February, the Hollywood Presbyterian Medical Center paid $17,000 to restore access to its system.

At the end of the same month, Melrose Police Department in Massachusetts paid $450 after it fell victim to a similar attack. "It's very tempting for organisations to pay out the ransom because that might be the only way they can get their data back, but that makes it worse for everyone else because it encourages more people to set up schemes like the one used in the Calgary case," commented Dr Steven Murdoch from University College London. "It would be better if nobody ever paid, although that's unrealistic to expect. "What's making matters worse is a new trend. "The hackers are threatening to publicly publish information they found on your computers if you refuse to pay, which acts as a double incentive to comply." The University of Calgary has said there was no indication that "any personal or other university data was released to the public".

http://www.bbc.co.uk/news/technology-36478650
Click to expand...

See also:

Israel indicts French immigrants in 9.1 million euro scam
Jun 8,`16 -- Israel's state prosecutor indicted four new immigrants from France on Wednesday for allegedly running a major international scam, impersonating company executives and costing five European companies about 9.1 million euros, or over $10 million.

The companies that lost money included German electronics retailer MediaMarkt, Belgian electronics company Eldi, European supermarket chain Cora, multinational perfume chain ICI Paris XL and Dutch hardware store owner Intergamma, according to the indictment. About two dozen other companies were also entangled in the case, including candy maker Mars, high fashion company Chanel, Italian athletic clothing retailer Diadora, beer brewing giant Anheuser-Busch InBev, and car manufacturers Kia Motors and Toyota, though not all the companies fell for the trick, according to the indictment.

The case suggests that the so-called fake CEO scam is still thriving in Israel, where the man widely credited with pioneering the technique, Gilbert Chikli, continues to live openly, evading French attempts to arrest him. Chikli is not suspected in the current case. The French-born defendants were identified as Henri Omessi, Daniel Michael Allon, Jeremy Lalloum and Mordechai Lellouche. They appeared at a court hearing on Wednesday. Rotem Tubul, a lawyer for Omessi, said her client and the other defendants pleaded not guilty. "Because it involves evidence from many countries around the world, there are clear difficulties in handling this case in Israel, and it is doubtful whether it will be possible to overcome them," said Liya Felus, an attorney for Allon.

Israeli police say this building served as the headquarters of an international scam operation that duped global companies out of more than $10 million, in the coastal city of Netanya, Israel, Tuesday, June 7, 2016. The police said they have busted a new crime ring in which French and Italian immigrants posed as company executives to bilk millions of dollars from dozens of multinational giants, including Kia Motors, Hugo Boss and Chanel. The case suggests that the so-called fake CEO scam is still thriving in Israel, where Gilbert Chikli, the man widely credited with inventing it continues to evade French attempts to arrest him

Israeli prosecutors says the immigrants collected information on European companies, including names of company employees and details on vendors with which they did business. Then, according to prosecutors, they created fake email accounts to send forged documents to an employee in charge of finances, presenting themselves as a CEO or representative of a vendor. They would then instruct the employee to send money to a new "clearing firm" used by the vendor. In reality, the clearing firms were shell companies with bank accounts controlled by the defendants.

In one scam that took place in November and December, according to Wednesday's indictment, defendants impersonated an executive of German electronics giant Bosch and emailed an executive of Eldi, telling him that Bosch had begun to work with a new clearing firm and asking him to update his records with the firm's new bank account information. Later, Eldi transferred 794,175.70 euros owed to Bosch to the shell company's bank account at PKO Bank Polski, Poland's largest bank. In another scam, according to prosecutors, defendants impersonated an employee of Swedish home appliance company Electrolux, and tricked German electronics retailer MediaMarkt into sending them more than 1 million euros.

MORE
Click to expand...

BillRM · Jun 16, 2016

Even home users can protect themselves from such malware,

Let see I do off network backups every few weeks, then any program that access the internet is run in a sandbox, and beside your normal anti-virus program I run a program that only allowed programs that I had white listed to run.

So let see if I get such malware on my computer one line of defense should not allow it to run but ask for my permission for it to run instead , next if it begin somehow to run it will think that it is enciphering my files but will only be doing so to copies of my files that was called into the sandbox not the files themselves outside of the sandbox.

When I go to shut my computer down the sandbox program will ask me what to do with the encipher files,
.

Angrytaxpayer · Jul 13, 2016

BillRM said: ↑

Even home users can protect themselves from such malware,

Let see I do off network backups every few weeks, then any program that access the internet is run in a sandbox, and beside your normal anti-virus program I run a program that only allowed programs that I had white listed to run.

So let see if I get such malware on my computer one line of defense should not allow it to run but ask for my permission for it to run instead , next if it begin somehow to run it will think that it is enciphering my files but will only be doing so to copies of my files that was called into the sandbox not the files themselves outside of the sandbox.

When I go to shut my computer down the sandbox program will ask me what to do with the encipher files,
.
Click to expand...

Got any links to set up sandbox?

waltky · Feb 1, 2017

I've locked myself outta my room - an' I can't get back in...

Austrian hotel says hackers held key system for ransom
Wed, Feb 01, 2017 - The ransom demand arrived one recent morning by e-mail, after about a dozen guests were locked out of their rooms at the lakeside Alpine hotel in Austria.

The electronic key system at the picturesque Romantik Seehotel Jaegerwirt had been infiltrated, and the hotel was locked out of its own computer system, leaving guests stranded in the lobby, causing confusion and panic. Good morning? the e-mail began, hotel managing director Christoph Brandstaetter said. It went on to demand a ransom of two bitcoins, or about US$1,800, and warned that the cost would double if the hotel did not comply with the demand by the end of the day, Jan. 22.

The e-mail included details of a bitcoin wallet the account in which to deposit the money and ended with the words: Have a nice day! Brandstaetter said. With the 111-year-old hotel brimming with eager skiers, hikers and vacationers, some having paid about US$530 for a suite with a panoramic view and sauna, Brandstaetter said he decided to cave in. Guests had already complained that their electronic room keys were not working, and receptionists efforts to create new ones had proved futile.

The reservation system for the hotel in the village of Turracherhohe, about 90 minutes by car from Salzburg, Austria, was paralyzed. We were at maximum capacity with 180 guests and decided that it was better to give in, Brandstaetter said. The hackers were very pushy. Ransomware is becoming a pandemic, said Tony Neate, a former British police officer who investigated cybercrime for 15 years.

http://www.taipeitimes.com/News/world/archives/2017/02/01/2003664151
Click to expand...

waltky · Oct 29, 2017

NSA hacking tool used to create ransomeware...

Bad Rabbit malware allegedly used NSA hacking tool
Oct. 27, 2017 -- The Bad Rabbit malware, which U.S. analysts say originated in Russia, allegedly used a leaked National Security Agency hacking tool.

Cisco researchers found that the malware used an NSA tool called EternalRomance that takes capitalizes on a vulnerability in Windows computers by bypassing security over Server Message Block file-sharing connections. The vulnerability enables hackers to remotely execute instructions on Windows clients and servers. EternalRomance was leaked this year by a group called The ShadowBrokers, who released the tools they said were from the NSA.

Bad Rabbit was reportedly spread to computers using a fake Adobe Flash update.

It is not, however, the same NSA tool made famous by earlier ransomware outbreaks NotPetya and WannaCry. The ShadowBrokers released several packages of the EternalRomance tools, all of which they said had been stolen from the NSA. The news comes after the U.S. Computer Emergency Readiness Team, a division of the Department of Homeland Security, said it's "received multiple reports" of ransomware infections called Bad Rabbit in many countries around the world, including Russia, Ukraine and Germany.

A fake Adobe Flash update reportedly helped spread the malware. Once installed on one computer, the hackers could use other techniques to spread it to other computers on the same network. The hack predominantly affected Russian users and even interrupted service in Ukrainian mass transit. However, the source of the attack is still unclear. "There is a lot of speculation that Russia is the main target, which may be true, but does not rule out Russia as the attacker," Dr. Andrea Little Limbago, chief social scientist at Endgame, said.

https://www.upi.com/Top_News/World-...?utm_source=sec&utm_campaign=sl&utm_medium=14
Click to expand...

Hotdogr · Oct 29, 2017

The best protection against ransomware is a reliable daily backup strategy that stores your data off-site, or on removable media.

waltky · Dec 21, 2017

Mebbe it wasn't the No. Koreans after all...

5 arrested in Romania for spreading ransomware in U.S., Europe
Dec. 20, 2017 -- Romanian officials have arrested five people they believe are responsible for one of the most widespread ransomware crimes ever, authorities said Wednesday.

Officials said the group of five were arrested on suspicion of unauthorized computer access, serious hindering of a computer system, misuse of devices with the intent of committing cyber crimes and blackmail. A device compromised with ransomware will not function until the user pays a price.

Romanian officials said Wednesday five people were arrested, believed to be responsible for one of the most widespread ransomware schemes ever.

Officials believe three of the suspects infected computer systems by spreading the Curve-Tor-Bitcoin Locker malware. The other two are believed to be involved with spreading Cerber, a ransomware focused on extorting money from users in the United States. The five suspects did not design the software but are believed to have paid the designers 30 percent of their take.

According to computer security software company McAfee, CTB-Locker was the widest used ransomware in 2016. In July, Google ranked Cerber as the most criminally profitable ransomware, with a haul of nearly $7 million from victims.

https://www.upi.com/Top_News/World-...?utm_source=sec&utm_campaign=sl&utm_medium=11
Click to expand...

Injeun · Dec 21, 2017

waltky said: ↑

Mebbe it wasn't the No. Koreans after all...

5 arrested in Romania for spreading ransomware in U.S., Europe
Dec. 20, 2017 -- Romanian officials have arrested five people they believe are responsible for one of the most widespread ransomware crimes ever, authorities said Wednesday.
Click to expand...

An example needs to be made of these people, and others like them.

Log in or Sign up

Ransomware

longknife New Member

waltky Well-Known Member

Deckel Well-Known Member Past Donor

waltky Well-Known Member

waltky Well-Known Member

waltky Well-Known Member

waltky Well-Known Member

BillRM Well-Known Member

Angrytaxpayer Banned

waltky Well-Known Member

waltky Well-Known Member

Hotdogr Well-Known Member Past Donor

waltky Well-Known Member

Injeun Well-Known Member

Share This Page

Log in or Sign up

Ransomware

longknife New Member

waltky Well-Known Member

Deckel Well-Known Member Past Donor

waltky Well-Known Member

waltky Well-Known Member

waltky Well-Known Member

waltky Well-Known Member

BillRM Well-Known Member

Angrytaxpayer Banned

waltky Well-Known Member

waltky Well-Known Member

Hotdogr Well-Known Member Past Donor

waltky Well-Known Member

Injeun Well-Known Member

Share This Page

Useful Searches