Slashdot Mirror
'Alarming' Rise In Ransomware Tracked (bbc.com)
An anonymous reader quotes a report from BBC: Cyber-thieves are adopting ransomware in "alarming" numbers, say security researchers. There are now more than 120 separate families of ransomware, said experts studying the malicious software. Other researchers have seen a 3,500% increase in the criminal use of net infrastructure that helps run ransomware campaigns. The rise is driven by the money thieves make with ransomware and the increase in kits that help them snare victims. Ransomware was easy to use, low risk and offered a high reward, said Bart Parys, a security researcher who helps to maintain a list of the growing numbers of types of this kind of malware. Mr Parys and his colleagues have now logged 124 separate variants of ransomware. Some virulent strains, such as Locky and Cryptolocker, were controlled by individual gangs, he said, but others were being used by people buying the service from an underground market. A separate indicator of the growth of ransomware came from the amount of net infrastructure that gangs behind the malware had been seen using. The numbers of web domains used to host the information and payment systems had grown 35-fold, said Infoblox in its annual report which monitors these chunks of the net's infrastructure. A lot of ransomware reached victims via spear-phishing campaigns or booby-trapped adverts, he said, but other gangs used specialized "crypters" and "packers" that made files look benign. Others relied on inserting malware into working memory so it never reached the parts of a computer on which most security software keeps an eye. Ars Technica reports that drive-by attacks that install the TeslaCrypt crypto ransomware are now able to bypass Microsoft's EMET.
Once you're hacked the bad guys can do a lot of nasty things to you and your data, shaking you for a few bitcoins if you don't have backups is pretty much the cheapest way you can find out about having a security hole. Data theft, APTs or even remote sabotage by a state agent can cause a lot more harm than ransomware, often without you even noticing. The spread of ransomware is actually very good for security, because it brings hidden vulnerabilities to light and associates an exact cost to them rather than for example the nebulous cost of losing sensitive data of costumers. Thus, ransomware alerts companies to vulnerabilities and bad backup practices, provides a financial incentive to fix those problems, all the while causing much less harm than the lack of those fixes would. Ransomware is doing more for security than a thousand conferences could.
A lot of ransomware reached victims via spear-phishing campaigns or booby-trapped adverts
And this is why people use ad blockers.
Summation 2
Why pay the ransom? Restore from your previous backup and carry on.
What's that, you say? You don't make backups?
The personal computer revolution began in the mid 1970's and was in full swing by the end of the 70's with everyone from Radio Shack to Apple jumping on the bandwagon. That's 40 years that people have had available to learn. For almost that entire span, the advice has been to make backups. Remember all the advice to store your important data on two separate cassettes, because they were so fiddly?
If, after 40 years of hearing "make frequent backups!" and "back up your important data!" people are still not making backups, well, the consequences of that choice belong to them. Yes, it's assholish to deploy ransomware, but it isn't like computers don't give you both ample means of almost perfectly protecting yourself, and ample means of recovering after the fact even if you failed to do that.
If you don't avail yourself of either, maybe it's about time you learned. People don't learn by being shielded from the consequences of their choices. The world does contain bad people, and always will, and what you should do is protect yourself rather than holding the unrealistic expectation that nobody will ever try to do anything bad to you.
If ads are where the viruses is, who can we hold responsible for them? The website hosting the ads, the company supplying the ads to the website, or are they hacked ads?
I was expecting a more intelligible title from the BBC. They are British ffs
The problem isn't that ransom-ware funded organisations exist, it's that people keep paying them. Selfish, short-sighted people.
Once the bogeyman visits you? Next you'll tell us you believe in fairies too. And bad guys? You've just told us they're doing us a service. How can that be bad?
I'm not sure what you're getting at, but being deliberately obtuse is something the "computer security industry" is pretty good at. Next to continuously "warning" and "alarming" and "advising" us with their tales of woe. What they're not good at is actually fixing the mess that they're promising to "protect" us against. Their "fixes" often as not aren't. In fact, it's fairly clear they're making too much money out of our misery to actually deliver us from all that. And these are the "good guys"? What?
They wouldn't do it if people didn't pay them.
Are we classifying systemd as Ransomware yet?
People could pretty easily block ads since the late 90s (with ad-blocking proxies, and then Firefox's plugins brought it to the masses in 2002), and even back then we had good justification for it (speed; I was on dialup until 2006!!). Yet most people didn't bother.
Something changed in just the last couple years. It didn't really get easier or much more justified (from the PoV of techies). What I think really happened, was this: Snowden.
The mainstream has finally caught on that the Internet is an us-vs-them situation, where you're in zero-sum conflict with a lot of enemies. "They" are watching you, and the hostility is no longer concealed. We don't always agree on who "they" are, but now you're not a tinfoil hat guy if you say "they" exist and are definitely spying on you. So fuck "them." And the ad companies are either "them" or technologically similar to "them" so they're caught in the crossfire.
We won't need a new justification. The nerds gave it to the mainstream in 2013, and this one is forever. There won't -- can't -- come a day when it ceases to apply. It's not like "they" are going to stop using the Internet.
When the recommended advice of security professionals is to pay them, what did you expect to happen?
They feel more effective than "you've won lottery" or African heir spams. I dont click on any.
Even companies with good backup practices are still getting burned. Developers routinely wait until code changes are tested and working before committing them to version control, which means that even with good backups, a company can lose a few weeks of developer time when ransomware strikes. Most companies do not do daily backups of developer laptops on a daily basis.
Granted, it won't bankrupt most companies, but it's still costly nonetheless. Worse, if there's a shared directory mounted, even if backed up, recovery can take a day or more.
This is why you run adblockers everywhere...
"GET / HTTP/1.0" 200 51230 "-" "Mozilla/4.0 (compatible; Setec Astronomy)"