RANSOMWARE: WHAT YOU NEED TO KNOW NOW! · attack from cryptovirology that blocks access to data...

15
RANSOMWARE: WHAT YOU NEED TO KNOW NOW! Tips and Best Practices to Avoid Being Held Hostage Tom DeSot Digital Defense, Inc. Chief Information Officer

Transcript of RANSOMWARE: WHAT YOU NEED TO KNOW NOW! · attack from cryptovirology that blocks access to data...

Page 1: RANSOMWARE: WHAT YOU NEED TO KNOW NOW! · attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it. •

RANSOMWARE: WHAT YOU NEED TO KNOW NOW!

Tips and Best Practices to Avoid Being Held Hostage

Tom DeSotDigital Defense, Inc. Chief Information Officer

Page 2: RANSOMWARE: WHAT YOU NEED TO KNOW NOW! · attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it. •

© 2017 Digital Defense, Inc.

Housekeeping

• Webinar will be recorded• Attendees are in “Listen Only” mode

• Submit questions via the Questions Panel• Live Q&A at the end of the presentation

Page 3: RANSOMWARE: WHAT YOU NEED TO KNOW NOW! · attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it. •

AGENDA

1 My Background

2 Evolution of Ransomware

3 How the Bad Guys are Getting to the Goods

4 Best Practices to Mitigate Risks

5 Questions

Page 4: RANSOMWARE: WHAT YOU NEED TO KNOW NOW! · attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it. •

TomDeSot

As the Chief Information Officer of Digital Defense, Tom DeSot is charged with developing and maintaining relationships with key industry and market regulators; functioning as the “face of DDI” through public speaking initiatives, identifying key integration and service partnerships, and serving as the prime regulatory compliance resource for external and internal contacts. Tom also serves as the company’s internal auditor on security-related matters.

Digital Defense, Inc. Chief Information Officer

Page 5: RANSOMWARE: WHAT YOU NEED TO KNOW NOW! · attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it. •

WHAT IS RANSOMWARE?

• Ransomware is a type of malicious software that carries out the cryptoviral extortion attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it.

• Simple ransomware may lock the system in a way which is not difficult for a knowledgeable person to reverse.

• More advanced malware encrypts the victim's files, making them inaccessible, and demands a ransom payment to decrypt them.

• The ransomware may also encrypt the computer's Master File Table or the entire hard drive. Thus, ransomware is a denial-of-access attack that prevents computer users from accessing files since it is intractable to decrypt the files without the decryption key.

Don‘t Be Held Hostage

Page 6: RANSOMWARE: WHAT YOU NEED TO KNOW NOW! · attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it. •

- Kaspersky Labs

EVERY 40 SECONDS, A COMPANY GETS HIT WITH RANSOMWARE”

Page 7: RANSOMWARE: WHAT YOU NEED TO KNOW NOW! · attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it. •

HOW THE BAD GUYS ARE GETTING TO THE GOODS?

Most ransomware attack vectors exploit human weaknesses and take advantage of poorly patched systems.

Don’t Be Held Hostage

Hosting images or active content that has ransomware downloaders embedded into it.

SOCIAL MEDIA

Fake emails designed to trick people.

PHISHING

Spoofed phone numbers with messages that appear to be from legitimate sources

VISHING

Network weaknesses that are exploited to break in and install ransomware

SYSTEM VULNERABILITIES

Page 8: RANSOMWARE: WHAT YOU NEED TO KNOW NOW! · attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it. •

TOP VULNERABILITIES EXPLOITEDDon’t Be Held Hostage

CVE-2015-7645, CVE-2015-8446, CVE-2015-8651

FLASH FLAWS

CVE-2016-0034MICROSOFT SILVERLIGHT

MS17-010Microsoft Vulnerabilities

Page 9: RANSOMWARE: WHAT YOU NEED TO KNOW NOW! · attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it. •

4 STEPS TO TAKE IF YOU BECOME A VICTIMDon’t be Held Hostage

1 Disconnect the infected system from the wired or wireless network that it is attached to. While not foolproof, this lessens the chance that the worm will have an opportunity to spread to other computers that reside on the same network that you do.

Immediately Disconnect

2 Restore your computer(s) from a known good backup. It is strongly suggested that this not be a backup from the day of the infection as the machine(s) may become infected all over again.

Restore your Computer

3

3 Once the system is restored, update it! Make sure that you get the patch for the MS17-010 vulnerability. Also make sure that your antivirus software is up-to-date.

Update your Computer

4 Look for other systems on your network(s) that may need to be updated and patch those as well.

Look for Others

Page 10: RANSOMWARE: WHAT YOU NEED TO KNOW NOW! · attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it. •

BEST PRACTICES TO MITIGATE RISKDon’t Be Held Hostage

PATCH YOUR SYSTEMS

Ensure that the Microsoft patch for MS17-010 has been installed on your computer systems. This patches the attack vector used by malware.

UPDATE YOUR ANTIVIRUS SOFTWARE

Ensure that your antivirus has the latest signature set so that it can detect the malware

USER EDUCATION

Users need to be educated about the risks associated with ransomware and understand what they can do to help the company avoid infections.

BE CAREFUL WITH USB DRIVES

Use caution when sharing USB drives with other users or USB drives from conferences and trade shows.

DISABLE REMOTE DESKTOP PROTOCOL

Many of the ransomware programs look for Remote Desktop Protocol (RDP) services to be running on a computer as a means of propagating the malware to other computerson the same network.

BACK UP DATACompanies should complete full backups at least weekly and then do incremental / differential backups on a daily basis to ensure that any files that are created or modified on the system are backed up.

Page 11: RANSOMWARE: WHAT YOU NEED TO KNOW NOW! · attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it. •

WHAT IF I DON’T HAVE A BACKUP?

If You Do Not Have a Backup You Have Two Options:

1. Destroy the Drive ContentsReformat the hard drive and re-install the operating system and applications. In this scenario, all information that is currently on the drive will be lost with no way of recovery.

2. Pay the Ransom.Follow the instructions on the FAQ provided by the malware to pay the ransom.

Don’t Be Held Hostage

Page 12: RANSOMWARE: WHAT YOU NEED TO KNOW NOW! · attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it. •

3 REASONS NOT TO PAY THE RANSOMDon’t Be Held Hostage

02 ASSOCIATING WITH CRIMINALS

You will be forced to reach out to the ransomware authors for assistance in decrypting your files (it is unlikely you will get a response).

01BITCOIN

Note that the payment will have to be made in BITCOIN, not regular currency.

03 SUCCESS IS NOT GUARANTEED

There is a high likelihood that you will not be able to decrypt your files even after paying the ransom.

Page 13: RANSOMWARE: WHAT YOU NEED TO KNOW NOW! · attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it. •

PROACTIVE SECURITY SOLUTIONS TOMITIGATE AN ATTACK

Don’t Be Held Hostage

Security Awareness Training

Consistent Vulnerability Scanning

Remote Social Engineering

Page 14: RANSOMWARE: WHAT YOU NEED TO KNOW NOW! · attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it. •

BE SURE TO ASK ABOUT…

Digital Defense, is offering to webinar participants special pricing on solutions to help defend against ransomware. To learn more contact us at www.DigitalDefense.com/ContactUs

Don’t Be Held Hostage

http://www.digitaldefense.com/ContactUs
Page 15: RANSOMWARE: WHAT YOU NEED TO KNOW NOW! · attack from cryptovirology that blocks access to data until a ransom is paid and displays a message requesting payment to unlock it. •

HAVE QUESTIONS?Thank You For Your Time

888.273.1312

[email protected]

DigitalDefense.com

Tom DeSot


Ransomware: Past, Present, and Future - Trend Micro · PDF file6 | Ransomware: Past, Present, and Future Ransom notes evolved as well. All forms of intimidation have been used, including

Ransomware: Past, Present, and Future - Trend Micro · PDF file6 | Ransomware: Past, Present, and Future Ransom notes evolved as well. All forms of intimidation have been used, including

CURRENT RANSOMWARE THREATS · Ransomware is formally categorized as part of the cryptovirology field, which focuses on ways in which cryptography can be used as a component of malware.

CURRENT RANSOMWARE THREATS · Ransomware is formally categorized as part of the cryptovirology field, which focuses on ways in which cryptography can be used as a component of malware.

The Complete Ransomware Recovery Guide › wp-content › uploads › 2020 › 06 › ransom... · No matter which backup and recovery tool you use, having this snapshot should be

The Complete Ransomware Recovery Guide › wp-content › uploads › 2020 › 06 › ransom... · No matter which backup and recovery tool you use, having this snapshot should be

GNISREVER A POLYMORPHIC FILE-INFECTING RANSOMWARE … 1... · Malware Honeycomb virus POS bot botnet worm ransom ware . 5 trojan script/ macro Virlock virus POS bot botnet worm ransom

GNISREVER A POLYMORPHIC FILE-INFECTING RANSOMWARE … 1... · Malware Honeycomb virus POS bot botnet worm ransom ware . 5 trojan script/ macro Virlock virus POS bot botnet worm ransom

APAC MSP Ransomware Research - Datto€¦ · against ransomware attacks For those customers who fell victim to ransomware, ... can be costly, but not back breaking If a ransom was

APAC MSP Ransomware Research - Datto€¦ · against ransomware attacks For those customers who fell victim to ransomware, ... can be costly, but not back breaking If a ransom was

RANSOMWARE: A RISING THREAT....Ransomware is a type of malicious program that encrypts files on a victim’s computer, blocking the access to the contents of the device until a ransom

RANSOMWARE: A RISING THREAT....Ransomware is a type of malicious program that encrypts files on a victim’s computer, blocking the access to the contents of the device until a ransom

[PPT]Presentation Title - Data Connectors · Web viewInsulating your company from Ransomware The true cost of a ransomware goes far beyond the ransom lost productivity loss of data

[PPT]Presentation Title - Data Connectors · Web viewInsulating your company from Ransomware The true cost of a ransomware goes far beyond the ransom lost productivity loss of data

Cisco Security Experts Series: Ransom Where…Everywhere: Breaking …€¦ · Breaking Down the Ransomware. 2 Better Security Visibility Securing the Mobile Enterprise Harden and

Cisco Security Experts Series: Ransom Where…Everywhere: Breaking …€¦ · Breaking Down the Ransomware. 2 Better Security Visibility Securing the Mobile Enterprise Harden and

Fraud Mitigation Strategies for Business · •Ransomware •Email Account Ransom •Webcam Image Extortion. Ransomware 14 Ransomware is a form of malware that restricts the target

Fraud Mitigation Strategies for Business · •Ransomware •Email Account Ransom •Webcam Image Extortion. Ransomware 14 Ransomware is a form of malware that restricts the target

Tech Demo: Take the Ransom Out of Ransomware

Tech Demo: Take the Ransom Out of Ransomware

AIT 681 Secure Software Engineering · 2020-01-29 · Ransomware downtime average downtime is 16.2 days Ransom payments Bitcoin Common types of ransomware ... industries Professional

AIT 681 Secure Software Engineering · 2020-01-29 · Ransomware downtime average downtime is 16.2 days Ransom payments Bitcoin Common types of ransomware ... industries Professional

VARONIS WHITEPAPER: Ransomware Guide · Ransomware Guide Overview Ransomware – malware that encrypts a victim’s data, extorting a ransom to be paid within a short time frame or

VARONIS WHITEPAPER: Ransomware Guide · Ransomware Guide Overview Ransomware – malware that encrypts a victim’s data, extorting a ransom to be paid within a short time frame or

Cyber Ransom Survival Guide - Bitpipedocs.media.bitpipe.com/io_13x/io_133658/item_1410675/Radware_C… · CYBER RANSOM SURVIVAL GUIDE10 Ransomware Ransomware isn’t new—it’s

Cyber Ransom Survival Guide - Bitpipedocs.media.bitpipe.com/io_13x/io_133658/item_1410675/Radware_C… · CYBER RANSOM SURVIVAL GUIDE10 Ransomware Ransomware isn’t new—it’s

Storybook (translated from Chinese;-) Malicious ... · Short intro to cryptovirology Ransomware in real life : the buzz? Improved use of cryptography for malware design Roadmap 1

Storybook (translated from Chinese;-) Malicious ... · Short intro to cryptovirology Ransomware in real life : the buzz? Improved use of cryptography for malware design Roadmap 1

Holding healthcare to ransom - Marsh & McLennan …...of healthcare customers’ businesses was $68 million EB 2017 MAY 2017 Hospitals globally were hit by the global ransomware attack

Holding healthcare to ransom - Marsh & McLennan …...of healthcare customers’ businesses was $68 million EB 2017 MAY 2017 Hospitals globally were hit by the global ransomware attack

RANSOMWARE PREVENTION ADVISORY - AKS IT Services IT_Ransomware Preventio… · Ransomware is a form of malware that encrypts a victim's files. The attacker then demands a ransom from

RANSOMWARE PREVENTION ADVISORY - AKS IT Services IT_Ransomware Preventio… · Ransomware is a form of malware that encrypts a victim's files. The attacker then demands a ransom from

WANNACRY RANSOMWARE ANALYSIS...If a system becomes infected with the WannaCry ransomware, it is best to try to restore files from backup rather than paying the ransom, as there is

WANNACRY RANSOMWARE ANALYSIS...If a system becomes infected with the WannaCry ransomware, it is best to try to restore files from backup rather than paying the ransom, as there is

RANSOMWARE - Niagara College · • You may be extorted for more money after the original ransom is paid. • You can make yourself a future target. • Extortion via Ransomware is

RANSOMWARE - Niagara College · • You may be extorted for more money after the original ransom is paid. • You can make yourself a future target. • Extortion via Ransomware is

What the Kidnapping & Ransom Economy Teaches Us About Ransomware

What the Kidnapping & Ransom Economy Teaches Us About Ransomware

How NOT to code your ransomware Liviu Itoafă - OWASP · Psychological tactics • Scaremongering victims – Gradually increasing the ransom amount – Warnings to not delete any

How NOT to code your ransomware Liviu Itoafă - OWASP · Psychological tactics • Scaremongering victims – Gradually increasing the ransom amount – Warnings to not delete any