[tomskunk]

Ransomware has been in the news here lately and can affect home users as well as big corporations like Colonial Oil during the ransomware attack they suffered that caused supply disruptions in gas and fuel. Its important people are educated on the different types of Ransomware out there as part of an effort to combat this epidemic:



Cryptoware Ransomware- Encrypts all or some files on a computer system or device and demands payment in return for the decryption key. This type of ransomware can also go after other computers or devices networked with the compromised system, network shares, and also encrypt data on Cloud services. Some examples of cryptoware ransomware are Locky, WannaCry, Bad Rabbit, Ryuk, SamSam, and of course, we never want to forget our favorite, Petya.

Locker Ransomware- This type of ransomware blocks access to computer systems entirely. It totally prevents a system from being used and violates the "Availability" part of the CIA triad (Confidentiality, Integrity and Availability). Examples of locker ransomware include MrLocker, Metropolitan Police scam, FBI MoneyPak scam. This type of ransomware malware will claim the user visited illegal websites and impersonate law enforcement like the FBI for example even if the user hasn't visited any sort of illegal websites. It basically scares the user into paying the ransom preying on their fears. Below are examples of FBI MoneyPak scam locker ransomware from Youtube.

Doxware Ransomware- Doxing is where somebody posts somebody else's personal information online. This is generally sensitive personal information. Doxware threatens to do this unless a ransom is paid. Doxware takes the system hostage and will threaten to release private personal information such as photographs for example unless the ransom is paid. I am sure celebrities and other public figures would be a target of Doxware. Also, hospitals or health companies that must be compliant with HIPPA laws and regulations would certainly be a big target of Doxware. Doxware like LeakerLocker also target smartphones and search for sensitive personal information there.

Ransomware as a Service- Then there are the inventive enterprising criminals of the Dark Web who have come up with the concept of Ransomware as a Service. Ransomware as a Service is like the Public Cloud Software as a Service Office 365 of criminal enterprise on the Dark Web. It's a "service" that leases ransomware malware in the same way that legitimate software developers lease SaaS products. This gives everyone, including those without much technical knowledge, the ability to launch ransomware attacks simply by signing up for a service on the Dark Web. It is a subscription-based "service."

Mobile Ransomware- Of course, we can't leave out mobile ransomware either. This type of ransomware is usually is Locker type ransomware which is using its own password to prevent a user from getting access to their smartphone to be able to use it. Some of this mobile ransomware malware, once the user is tricked into giving the malware administrative privileges on their smartphone, will take a stealth picture of the user and then use that picture to extort the owner of the smartphone.



Scareware can also be used as a form of ransomware by scaring users into paying fees like claiming their computer is infected and if they just pay the money, they will disinfect the computer. These are examples of the various different kinds of ransomware variants out there and for security professionals it's important we understand these variants.

Especially, since ransomware has become such an epidemic and big problem here over these past few years. We can see these cybercriminals come up with some new inventive, creative ways for extorting people out of their money and making money illegally on the Dark Web. They are always looking for a new way to "innovate."

[tomskunk]

Here are a few ways for individuals and organizations to defend against Ransomware attacks:

If you are dealing specifically with a ransomware attack, you definitely want to disconnect that compromised system so that the ransomware infection doesn't spread to other systems within an organization. But it's also very important to identify the scope of the ransomware infection throughout the organization network.

You want to isolate ALL those systems from the rest of the network. You don't want to wait and watch to see if something like crypto-ransomware is going to start infecting other systems because they likely will in my opinion. There is probably a better approach to determining the scope and magnitude of ransomware infection besides waiting to see which system is going to get infected and encrypted next. This is probably not a good idea in my opinion.

It is therefore, my opinion, that if an organization wants to combat ransomware successfully it must do extensive preparing against ransomware beforehand and not wait till they get infected. So an organization MUST have a written policy before becoming a victim of ransomware of how to first prevent ransomware attacks and then if ransomware infection happens, how a cybersecurity incident response team responds to the ransomware infection. Let's start with prevention first. Some ideas on preventing ransomware are listed below. There plenty more things you can add to this list to combat and prevent and make responding to ransomware attacks better. These are just some ideas listed below.

• Identify which information assets and systems are irreplaceable, critical, and must remain confidential.
  
• Turn on File History on all systems (this is so you can go back to your backup history and discover exactly when the infection took place and restore backups at the time before the ransomware infection). This should be done to an external removable device.
  
• Make sure to use backups AND If you can, store those backups on an entirely separate network disconnected from the organization's main network. This is so ransomware can't infect those backups and encrypt them due to the fact it is on a separate network that is not connected in any way to the main network that is under ransomware attack.
  
• If you are using Public Cloud Storage as a Service to store your backups on the cloud, make sure to disable auto-synchronization of the cloud-based backup, that way the ransomware doesn't infect the backups on the cloud.
  
• Have offline backups too that might not be on a network. Keep all backup systems isolated from main organization network.
  
• Test your recovery procedures using the backup restoration to be sure it actually works so there are no surprises in the event a CSIRT team must respond and recover from a ransomware infection of the organziation's network.
  
• Make sure the main network is segmented into various VLANs and secondary isolated private VLANs. This will make containing a ransomware infection easier in the event of a ransomware infection.
  
• Create a written policy for handling and dealing with ransomware and make sure all relevant employees know these policies and procedures.
  
• Have written communications policies and make sure all relevant employees know them.
  
• If possible, disable RDP on Windows systems.
  
• If possible, disable PowerShell on Windows systems.
  
• Deploy a DNS sinkhole to prevent access to malicious URLs which might have ransomware or other malware.
  
• The organization needs a policy against using pirated software, torrenting, and if possible file sharing. Torrenting and file sharing along with pirated software are all attack vectors for ransomware
  
• Use pop up blockers in browsers given that pop ups are used to infect systems.
  
• Harden browsers and configure them for security.
  
• On Windows 10 Professional systems (not sure if this is available on Windows 10 Home systems as I have Windows 10 Professional), use Controlled Folder Access to protect valuable data and files from a ransomware attack.

Here are some ideas on responding to ransomware as part of a cybersecurity incident response team. Bear in mind, if the organization doesn't make preparations to prevent and respond to ransomware it will likely end up paying the ransom from a ransomware attack or losing critical and irreplaceable data, plus suffer reputational harm. Here are some ideas for organizations that made preparations.

• Identify infected systems, data and scope, and magnitude of the ransomware infection and isolate all those systems from the rest of the network.
  
• Manage communications per the communications policy (make sure you are communicating out of band).
  
• Investigate how the ransomware infection happened, take any necessary digital forensic copes of compromised systems for further analysis and evidence.
  
• After getting digital forensic copies, eradicate the ransomware malware by using non-infected backups.
  
• After all systems have been recovered, change all usernames and administrative passwords.
  
• If possible, don't pay the ransom. There is no guarantee you will get your data back even if you do pay. Plus, it just gives cyber criminals an incentive to continue ransomware attacks.

These are just some ideas on how to prepare and respond to a ransomware attack. There are many other things we could be added to the above list.

[tomskunk]

One thing that is important to mention is that Ransomware cyber threat actors will encrypt and exfiltrate the data (steal the data from the network) they will want to encrypt on that network and hold for ransom. This is so that in the event that an organization has backups that are not connected to their network, they can still threaten to release the data to a publicly available website in order to still get paid the ransom regardless.

Two ways to combat this are shown below.

1) The use of bandwidth quotas to prevent these cyber threat actors from being able to exfiltrate data out of a network to threaten release to a publicly available website. This quota would be effective even if the threat actor were to encrypt the data they are attempting to steal and exfiltrate out. Such encryption of data helps the threat actor from being able to exfiltrate that data out of the network they are stealing from undetected.

2) The use of Data Loss Prevention tools/software/solutions. One of these is called Endpoint Protector. Personally, I feel that the use of bandwidth quotas is more effective in preventing undetected and encrypted exfiltrations from an organization's network so that it can be held for ransom.