This blog is about Ransomware and how to protect yourself from this. This nuisance malware does much more than encrypting your data and ask for money to unlock it. Read more to follow the plan to be safe:

What is Ransomware?

If you don't know about Ransomware and no idea what is going on in Cyber World then let me brief what it is

Ransomware.

Ransomware is malicious code that is used by cyber criminals to launch data kidnapping and lock screen attacks. The motive for ransomware attacks is monetary, and unlike other types of security exploits, the victim is usually notified that an attack has occurred and is given instructions for how to recover data. Payment for recovery instructions is often demanded in virtual currency to protect the criminal's identity.

Ransomware malware can be spread through malicious e-mail attachments, infected software apps, infected external storage devices and compromised websites. In a lock screen attack, the malware may change the victim's login credentials for a computing device; in a data kidnapping attack, the malware may encrypt files on the infected device as well as files on other connected network devices.

Ransomware kits on the dark web have allowed cybercriminals with little or no technical background to purchase inexpensive ransomware-as-a-service (RaaS) programs and launch attacks with very little effort. Attackers may use one of the several different approaches to extort digital currency from their victims.

For example:

The victim may receive a pop-up message or email warning that if the ransom is not paid by a certain date, the private key required to unlock the device or decrypt files will be destroyed.

The victim may be duped into believing he is the subject of an official inquiry. After being informed that unlicensed software or illegal web content has been found on his computer, the victim is given instructions for how to pay an electronic fine.

The attacker encrypts files on infected computer devices and makes money by selling a product that promises to help the victim unlock files and prevent future malware attacks.

How to Protect from Ransomware

To protect against ransomware attacks and other types of cyber extortion, experts urge users to backup computing devices on a regular basis and update software -- including anti-virus software -- on a regular basis. End users should beware of clicking on links in emails from strangers or opening email attachments and victims should do all they can to avoid paying ransoms.

While ransomware attacks may be nearly impossible to stop, there are important data protection measures individuals and organizations can take to ensure that damage is minimal and recovery is quick as possible. Strategies include compartmentalizing authentication systems and domains, keeping up-to-date storage snapshots outside the main storage pool and enforcing hard limits on who can access data and when access is permitted.

"Ransomware attacks happen, but the important thing is to minimize the impact and demonstrate a timely recovery."

How to Protect from WannaCrypt

Microsoft Windows users already know what to do to defeat WannaCrypt (unless they've been asleep). Now the company's published its advice for its Azure customers.

Since there aren't any surprises in Microsoft's note for Azure users, Vulture South suspects this is a prod for people who are slow to respond or complacent about security.

WannaCrypt is the ransomware/worm built using NSA exploits leaked by Shadow Brokers. It exploits a bug in the ancient and should-have-been-retired SMB1 protocol as one of its most important vectors.

That bug (CVE-2017-0145) was plugged by Microsoft in its service pack – all the way back to Windows XP, so serious was it – but there's a bit of work for Azure users to secure their cloud computers.

Microsoft writes that customers should review any services that expose SMB endpoints to the Internet (or perhaps just hit yourself with the clue-stick because that exposure should be avoided). The appropriate IP ports (TCP 139, TCP 445, UDB 137 and UDP 138) should be blocked at the firewall unless absolutely essential.

Follow these instructions if you haven't already disabled SMB1, and watch your environment with Azure Security Center.

Windows Update should have taken care of users running Azure Cloud Services or IaaS, and all guest operating system versions released since March 14 include MS17-010.

Finally, use Network Security Groups to restrict network access; run malware protection, and apply multi-factor authentication to all backups.

Here are few FREE and effective solutions for protection from malware:

Disable macros in office unless business critical on specific hosts.
Use Windows 10. It is 2017
Install Emet, configure with max security settings
Remove Flash
Associate hta, vbs and js files with Notepad.
Scripts should not be executable by users
Backup your critical files to the Cloud. There is Google Drive, OneDrive, Dropbox, more than enough options. Use 2-factor auth on these accounts.
Use application whitelisting - at the very least prevent execution by regular users from the Downloads, Desktop, and My Documents folders.

Share this post so more people could get actionable prevention measures rather than pay "security vendors" for their "solutions".

What is Ransomware and how to protect from them.

Khwaja Naveed

RECENT POSTS