Slashdot Mirror
Cisco Finds $34 Million Ransomware Industry (networkworld.com)
Ransomware is "generating huge profits," says Cisco. Slashdot reader coondoggie shares this report from Network World:
Enterprise-targeting cyber enemies are deploying vast amounts of potent ransomware to generate revenue and huge profits -- nearly $34 million annually, according to Cisco's Mid-Year Cybersecurity Report out this week. Ransomware, Cisco wrote, has become a particularly effective moneymaker, and enterprise users appear to be the preferred target.
Many of the victims were slow to patch their systems, according to the article. One study of Cisco devices running on fundamental infrastructure discovered that 23% had vulnerabilities dating back to 2011, and 16% even had vulnerabilities dating back to 2009. Popular attack vectors included vulnerabilities in JBoss and Adobe Flash, which was responsible for 80% of the successful attacks for one exploit kit. The article also reports that attackers are now hiding their activities better using HTTPS and TLS, with some even using a variant of Tor.
Many of the victims were slow to patch their systems, according to the article. One study of Cisco devices running on fundamental infrastructure discovered that 23% had vulnerabilities dating back to 2011, and 16% even had vulnerabilities dating back to 2009. Popular attack vectors included vulnerabilities in JBoss and Adobe Flash, which was responsible for 80% of the successful attacks for one exploit kit. The article also reports that attackers are now hiding their activities better using HTTPS and TLS, with some even using a variant of Tor.
If they aren't making backups, then they are lucky, because a hard drive failure often won't allow you to recover your data.
"First they came for the slanderers and i said nothing."
1. Develop networking infrastructure full of security holes even though huge profits could be ploughed into auditing.
2. Wait for vulnerabilities to be exploited.
3. Report on vulnerability findings.
4. Tell buyers that they will need to pay for a cripplingly expensive support contract to receive updates.
5. Goto 1 until people wake the fuck up. (optimized: Goto 1.)
Only $34 million,I would have thought between them,hackers and individuals are turning more than that over per month.or is that just what is lost that Cisco are responsible for ?
If the "enterprise users" are mainly targeted, and they decide to pay the ransom, bypassing the sec and legal support from the company/police, they are only aggravating the problem and should be fired on the spot.
In other news, I found my backyard this morning.
Here is what's to become of modern computing in the enterprise world.
-Staff orientation on situational awareness. There are high-tech cons artists that will scare or otherwise coax them into running malware. PEBKAC is the primary initiator of this. Antimalware software is only there to catch you when you fall; it's not guaranteed to protect you all the time. Malware is a moving target to stop.
-Pure SSD SAN/NAS storage. Once TBs of data gets whacked, you will need a quick way of restoring it; paying the ransom is NOT the option. Thankfully the hardware is dropping in price as the technology matures.
-Air gaping of networks will become increasingly important.
-Can't really go back to deadwood (filing cabinets and paper) as an ultimate physical reference source, but I suspect there will be the resurgence in Next Generation microfiche technologies. I'm not kidding.
Life is not for the lazy.
Title corrected for accuracy :)
I'd be surprised if it was only $34 million.
Unless they counted every type of ransomware and every instance of payment, my guess is they're missing quite a bit of the actual revenue generated.
Just cruising through this digital world at 33 1/3 rpm...
I think Cisco wants to increase their own profits (which are a bit larger, by a factor of 1000 or so) by scaring as many people as possible. Despicable.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The attached report doesn't explain how Cisco came up with that "$34 million" number. It's probably been pulled out some exec's buttocks to create some FUD to sell cyber-security products.... amiright? ahha? anyone?