, ,

Our Client’s Cryptolocker Story – Part Two

Cryptolocker Attachments Look Legitimate

A few weeks ago a client was attacked and his computer and server user files were encrypted by a strain of ransomware malware. There are many, many strains and each are shrouded or hidden in legitimate looking attachments sent via email or legitimate looking links in the message body of emails or worse, legitimate-looking links you click on when visiting a website. Websites are compromised and malware links are put into place and made to look legitimate. User clicks on a link, thinking it is safe and malware downloads and begins encrypting user data.

Decrypt Tool Removed Malware Without Any Ransom Paid

In this blog entry I am happy to announce we were able to find a decrypt tool and decrypt all of the estimated 30,000 user files that the malware encrypted. We were extremely lucky to find a decrypt utility that worked. No bitcoin was purchased and we didn’t have to sit back and worry if the malware creator would be nice enough to send a decrypt key once the bitcoin was received. The malware was removed from the infected computer by manually deleting files and registry keys and using the decrypt utility to restore all files to their original, unencrypted state.

Our Client Was Lucky

However, this was the first IGTG client of nearly 20 where a decrypt utility worked. Some of our clients had one of the solutions listed below in place while others were unable to recover files.

A big shout-out goes to the folks who maintain www.bleepingcomputer.com where we found links to a utility. I’m not going to mention publicly what we found or how we used it because I don’t want the potential ransomware creator to read and modify their attacks.

Ransomware Is Vicious and It’s Not Going Away

I’ve been working with computer technology since college in the 1980s and been a full-time consulting engineer and instructor since 1992 and I’ve never seen more heinous attacks than those by ransomware creators. It is a sad situation that actual businesses have sprung up to attack unsuspecting computer users with the various strains of encryption malware. I firmly believe that if the United States FBI were allowed to arrest and severely punish the malware creators with long prison terms and huge fines that these attacks might disappear. However most attacks originate from overseas and our FBI can’t waltz into foreign countries and make arrests.

What Can You Do To Protect Yourself From Ransomware?

So what are you, the home computer user, the company computer user, and the IT administrator for a company supposed to do to protect against these heinous attacks? Here are solutions and if you don’t have at least one in place already, make it a priority to choose one or more and then implement the solution immediately:

–Disconnected Backup:

This could be an external USB drive that you connect to your home computer and copy your files to either automatically or manually. I use this and manually copy certain directories at least once per month. Additionally, if I’m going to take my main laptop on-site where travel is involved, I do an extra backup. The most important thing you do with this is un-plug the USB drive when your backup is complete.

When we’re discussing a business server, the company should have a disconnected backup in the form of verifiable tapes or disk backups that are managed by backup software and not accessible as writable devices by users. One of our clients was able to restore over 200 GB of data that was encrypted by the malware from a full backup taken just a day before the infection.

–Use An Online backup:

This could be provided by a variety of online vendors such as IDrive (www.idrive.com); or Carbonite (www.carbonite.com) or Mozy (www.mozy.com) and several others. You pay a monthly or annual subscription fee to these sites and then download and setup an application that will do behind-the-scenes backup. Just like the disconnected backup suggestion, you must disconnect from these services or possibly see all of your files that are stored online become encrypted too. Only connect, backup and then disconnect.

–Implement New Scanning Technology

IGTG recommends two vendors and we can provide a personal and/or business quote for you. The two vendors are Sophos (www.sophos.com) and Webroot (www.webroot.com). Sophos has its new Intercept-X technology and Webroot offers scanning based on security hash values assigned to each executable that can run on a PC. Both are cloud-based and offered on a subscription. IGTG can assist you with implementation of either.

–Take Away Access Rights

Even though it is or will be a real pain for your users, or yourself take away administrator rights to your desktop. By converting users to the Standard User role, you eliminate their login ability to write to critical places on the computer hard drive or into the operating system registry without first entering administrative credentials (admin username and password).

Further, include a thorough review of every network share or network drive where your users have Write Access. One of the things that ransomware malware will do once it is done encrypting the local computer files will be to go each network mapped drive (the G: drive for example) and encrypt all of the files on the server that the logged in user has access to write to. This includes the shared drive (H: drive for example), the user home directory (the U: drive) and every other mapped drive. In the attack mentioned in my first blog, the logged in user had full access to every folder on the server and the malware encrypted everything. The decrypt tool however worked perfectly on each server-based file.

Finally, contact authorities – primarily the FBI – if you get attacked by ransonware malware. If you have one or more of the recommended solutions listed above in place, the likelihood of losing much data becomes very remote.

We Can Help

As always, if you have specific questions, user our contact form by clicking here or give us a call at 513-300-5198.

/by
,

Our Client’s Cryptolocker Story – Part One

Cryptolocker Attacks Our Client’s Files

This past weekend one of our clients mistakenly clicked on an attachment in an email that appeared to legitimately come from FedEx International. The PDF attachment was a shipping label or so it said. Up-to-date A/V scanned it as it was opening, but nothing actually opened! The PDF was a silent script that sent malware out into the computer, encrypting all PDFs, all Office docs, pictures, music files, text files, etc. Once done on the local computer, it went to ALL mapped drives the workstation was using to connect to the server. EVERY folder where the logged in user had write access provided, the malware encrypted every user-created file in those directories as well. We estimated that over 30,000 files were affected.

Ransom Demanded

As soon as it was done, a text file pop-up appeared on the computer screen with instructions on how to get a decrypt key. This particular ransomware thief only wanted .18787 bitcoin which translated to $122.11. The process is poorly documented and appears quite shady. And unfortunately, it is very likely the only hope available to get recent data restored. Backups exist but aren’t as up-to-date as they should be.

FBI Discourages Paying Cryptolocker Thieves

Researching bitcoin purchases, we came across a blog where the FBI asks customers to NOT pay the ransom as it encourages further attacks. The article suggests contacting FBI resources to report the attack…something we are going to help the customer do.

Simple Steps to Prevent Cryptolocker or Other Ransomware

How can you prevent or recover from a Ransomware attack? Here are four ways:

 

  • 1) Make regular disconnected backups of your data on workstations and servers. Run the backup to a USB external drive from your workstation and then unplug it. This could be simple drag-copy of your important files to the external storage. Or if you use Carbonite, Mozy, One-Drive or other cloud storage, as soon as you’re done synchronizing, logout.

 

  • 2) Use Malwarebytes with the Ransomware plug-in or contact us to provide a quote for you to use the Sophos Central cloud scanning with their new Intercept-X ransomware killer. I’m not trying to make a sale here, I’m hopefully providing protection solutions for you. Be sure that the anti-virus product you use is up-to-date and that it will at least try to protect against ransomware.

 

  • 3) Convert all regularly used login accounts to Standard User so that a user doesn’t have complete access to the entire computer hard drive or the computer registry. Evaluate/audit who (which log-in accounts) has Write access to network shares/drives. If someone doesn’t need Write access to a server location, take it away.

 

  • 4) Educate all of your users to be wary of anything coming into their email/mailbox, whether it is coming from a sender they are familiar with or not. You don’t know if a familiar sender’s email account has been compromised by a ransomware creator or not. If there is even the slightest hint of a problem…tell your staff to pick up the phone and call the sender to verify before opening. The few minutes they spend making a call, could save your company data.

 

Ransomware attacks are the most heinous of any malware attacks I’ve seen in more than 25 years in the computer industry. There isn’t any punishment possibly because nearly all attacks originate overseas. The attack mentioned above from this weekend offered five URLs to contact after payment is made…four of the five are from Russia.

 

Any questions or concerns? Please contact us at skunau@igtg.net.

 

Please share this blog post with your colleagues to help prevent more malware/ransomware attacks.

 

In the next entry on this blog topic, we will detail how we were able to solve this ransomware attack.

 

 

/by