Cryptolocker Attachments Look Legitimate

A few weeks ago a client was attacked and his computer and server user files were encrypted by a strain of ransomware malware. There are many, many strains and each are shrouded or hidden in legitimate looking attachments sent via email or legitimate looking links in the message body of emails or worse, legitimate-looking links you click on when visiting a website. Websites are compromised and malware links are put into place and made to look legitimate. User clicks on a link, thinking it is safe and malware downloads and begins encrypting user data.

Decrypt Tool Removed Malware Without Any Ransom Paid

In this blog entry I am happy to announce we were able to find a decrypt tool and decrypt all of the estimated 30,000 user files that the malware encrypted. We were extremely lucky to find a decrypt utility that worked. No bitcoin was purchased and we didn’t have to sit back and worry if the malware creator would be nice enough to send a decrypt key once the bitcoin was received. The malware was removed from the infected computer by manually deleting files and registry keys and using the decrypt utility to restore all files to their original, unencrypted state.

Our Client Was Lucky

However, this was the first IGTG client of nearly 20 where a decrypt utility worked. Some of our clients had one of the solutions listed below in place while others were unable to recover files.

A big shout-out goes to the folks who maintain www.bleepingcomputer.com where we found links to a utility. I’m not going to mention publicly what we found or how we used it because I don’t want the potential ransomware creator to read and modify their attacks.

Ransomware Is Vicious and It’s Not Going Away

I’ve been working with computer technology since college in the 1980s and been a full-time consulting engineer and instructor since 1992 and I’ve never seen more heinous attacks than those by ransomware creators. It is a sad situation that actual businesses have sprung up to attack unsuspecting computer users with the various strains of encryption malware. I firmly believe that if the United States FBI were allowed to arrest and severely punish the malware creators with long prison terms and huge fines that these attacks might disappear. However most attacks originate from overseas and our FBI can’t waltz into foreign countries and make arrests.

What Can You Do To Protect Yourself From Ransomware?

So what are you, the home computer user, the company computer user, and the IT administrator for a company supposed to do to protect against these heinous attacks? Here are solutions and if you don’t have at least one in place already, make it a priority to choose one or more and then implement the solution immediately:

–Disconnected Backup:

This could be an external USB drive that you connect to your home computer and copy your files to either automatically or manually. I use this and manually copy certain directories at least once per month. Additionally, if I’m going to take my main laptop on-site where travel is involved, I do an extra backup. The most important thing you do with this is un-plug the USB drive when your backup is complete.

When we’re discussing a business server, the company should have a disconnected backup in the form of verifiable tapes or disk backups that are managed by backup software and not accessible as writable devices by users. One of our clients was able to restore over 200 GB of data that was encrypted by the malware from a full backup taken just a day before the infection.

–Use An Online backup:

This could be provided by a variety of online vendors such as IDrive (www.idrive.com); or Carbonite (www.carbonite.com) or Mozy (www.mozy.com) and several others. You pay a monthly or annual subscription fee to these sites and then download and setup an application that will do behind-the-scenes backup. Just like the disconnected backup suggestion, you must disconnect from these services or possibly see all of your files that are stored online become encrypted too. Only connect, backup and then disconnect.

–Implement New Scanning Technology

IGTG recommends two vendors and we can provide a personal and/or business quote for you. The two vendors are Sophos (www.sophos.com) and Webroot (www.webroot.com). Sophos has its new Intercept-X technology and Webroot offers scanning based on security hash values assigned to each executable that can run on a PC. Both are cloud-based and offered on a subscription. IGTG can assist you with implementation of either.

–Take Away Access Rights

Even though it is or will be a real pain for your users, or yourself take away administrator rights to your desktop. By converting users to the Standard User role, you eliminate their login ability to write to critical places on the computer hard drive or into the operating system registry without first entering administrative credentials (admin username and password).

Further, include a thorough review of every network share or network drive where your users have Write Access. One of the things that ransomware malware will do once it is done encrypting the local computer files will be to go each network mapped drive (the G: drive for example) and encrypt all of the files on the server that the logged in user has access to write to. This includes the shared drive (H: drive for example), the user home directory (the U: drive) and every other mapped drive. In the attack mentioned in my first blog, the logged in user had full access to every folder on the server and the malware encrypted everything. The decrypt tool however worked perfectly on each server-based file.

Finally, contact authorities – primarily the FBI – if you get attacked by ransonware malware. If you have one or more of the recommended solutions listed above in place, the likelihood of losing much data becomes very remote.

We Can Help

As always, if you have specific questions, user our contact form by clicking here or give us a call at 513-300-5198.