Cloud Hosting

Ransomware is one of the oldest cyberthreats, but ithas made a big comeback in the past couple of years because it has become much easier to perpetrate against consumers, businesses, hospitals, and government agencies.

With ransomware, cyber thieves steal a users data and threaten to destroy it unless the user pays them a ransom. One studyby Infobloxfound that ransomware increased 3,500 percent from the fourth quarter of 2015 to the first quarter of 2016. Ransoms paid also went up 10 times during that period. (Heres a chronicle of ransomware attacks).

Chris Young, CEO of Intel Security, said last week at a private dinner and in his keynote speech at the RSA security conference that ransomware was first detected in 1989, but it didnt explode until recently. In the past, it was easier for law enforcement to catch the perpetrator as they tried to pick up the ransom.

It wasnt until the advent of Bitcoin in our society that ransomware was able to take off, Young said. Because now, as an attacker, I can anonymously monetize my target.

Above: Chris Young, CEO of Intel Security, at RSA.

Image Credit: RSA

He added, The weaponization of data becomes a real threat to all of us. Id argue its quite likely to be our next advanced, persistent threat.

Bitcoin, the crypto currency introduced in 2008, enables two parties to exchange money without knowing who the other one is. During the past year, security firm Kaspersky identified ransomware as the biggest cybersecurity threat.

At first, cyber criminals used ransomware schemes against unsuspecting consumers. The criminals stole their passwords, locked down their computers with cryptography, and then demanded ransoms in the hundreds of dollars to unlock the computers. Faced with no choice, the victims paid the ransoms in Bitcoin. And that helped the problem grow and become much more lucrative, saidSteve Grobman, chief technology officer at Intel Security, at the dinner.

The ransomware threat has been growing.A ransomware app even made it into the Google Play store in January.

Young said that the growing number of attack types has also come with new attack surfaces, as the number of devices that we use in our daily lives is growing well beyond computers and smartphones. The Internet of Things devices, such as security cameras or TV webcams, are also vulnerable to viruses and other attacks. And they can be used as stepping stones to larger, more threatening attacks.

Andransomware is moving on to bigger targets. The focus is increasingly on places like hospitals, which have restrictions on what they can do with patient data. The bad guys find out where the computer backups are stored, they penetrate them and encrypt them, and then they hold the data for ransom.

Cyber attackers held an Austrian hotel network for ransom. The criminals demanded $1,800 in Bitcoin to unlock the network while preventing guests from checking in and out of the hotel and locking them out of their guest rooms. The hotel paid up.

A crypto ransomware attack also hit San Franciscos Municipal Transportation Agency as an infection spread across the Muni systems networks, taking down ticketing systems. The criminals asked for $73,000 in exchange for restoration of the Muni data.

Above: Ed Skoudis, instructor at the SANS Institute.

Image Credit: RSA

Ed Skoudis, instructor at the SANS Institute, predicts that the crypto ransomware perpetrators will go after small to mid-sized banks next.

One of the biggest problems in the last couple of years has been the explosion of crypto ransomware, Skoudis said in an RSA talk. Crytpo ransomware is so much more powerful, especially when it uses public key cryptography.

Crytography is useful in enabling secure communications and ecommerce, but there are 150 active families of crypto ransomware today, Skoudis said. Companies say this is one of their biggest fears, he said, and many more increasingly sophisticated attacks against networks are expected.

Young, meanwhile, worries about the attack targets in homes, thanks to the Internet of Things.

The target is now the weapon, Young said. Now we have to turn our attention to data being weaponized against us. What we used to think about protecting we now have to be protectedagainst. Its the strangest irony. The target is now the weapon. Weve given the enemy all of the scale they could possibly want by connecting our homes with smarter, better, faster devices.

Above: No More Ransom helps ransomware victims.

Image Credit: nomoreransom.org

And yes, Im still waiting for some good news on this front.

To prevent ransomware attacks, companies and individuals have to make themselves into harder targets. If one workstation gets attacked, it shouldnt make the whole network and its servers vulnerable.

If your organization gets hit with ransomware, who is going to decide whether to pay the bad guys? he said. Your business principles might get hit by the business reality.

Young said that the fragmented cybersecurity industry must work together.

Were the most fragmented sector in all of IT, he said.

The industry has formed the collaborative Cyber Threat Alliance group, and it has created No More Ransom, a site that helps victims of ransomware recover their data.

Read more from the original source:
Ransomware has exploded thanks to Bitcoin's anonymity - VentureBeat