Language:
SEARCH

ransomware

Defeat ransomware: Backup your data

Wednesday, July 5th, 2017

The destructive Petya ransomworm caused destruction and major interruptions of services around the world last week. Unfortunately, it’s becoming progressively more difficult to avoid these attacks as cybercriminals become more clever and inventive in their methods. While there are ways to prevent that you fall prey to such an attack, there’s one thing you can do which will ensure that you are safe. And it’s not technical or difficult to do.

Once a week, backup all your data. Yes, this is a menial, boring administrative task – and we all hate those, but by ensuring that your data is safe and sound elsewhere, it won’t matter if your PC is infected by ransomware or any other malware. If you do lose your data, you will have another version available. 

Here are a few quick tips to help you:

  1. Choose one day a week which suits you and make an appointment in your diary to do a weekly backup.
  2. Try not to overwrite your previous backup. Rather make consecutive copies in various folders on your external hard drive or on your network space and name each with the particular day’s date. If any of the documents become corrupt for some reason, you can always fall back on a previous version.
  3. Regularly check that the medium on which you made your backup is still in working order and you’re able to access your documents.
  4. Use more than one backup medium, for example, your network space AND an external hard drive.

Where should you backup data?

  1. Each staff member has access to his/her own network space (usually the h-drive) where you can save an allocated amount of data for free. You have 1GB at your disposal to backup your most critical documents. At an extra cost of R10-00 per 1GB this space can also be increased. This network space is also available via the web at storage.sun.ac.za if you find yourself away from the SU network. 
  2. On your departmental network space (usually the g-drive). The departmental drive can be used for files used by more than one person and 15GB is allocated to each department. SharePoint can also be used by groups for sharing documents.
  3. OneDrive allows each staff member 5TB of storage space. This is available via the Office365 suite. https://portal.office.com/
  4. If you choose to have your data close at hand, get yourself an external hard drive. Never save important data on a flash drive – its sole function is for transporting data from one device to another and is not a dependable medium for backup. Just ensure that these devices are stored somewhere else (not also in your office) or in a safe. If confidential, SU documents are kept on an external hard drive, files have to be protected with a password or encrypted. Keep in mind that if you lose the password, not even IT can salvage your data.
  5. Alternatively, you can save data in the cloud. We’ve already mentioned OneDrive, but GoogleDrive or Dropbox are also examples of this. It is extremely important that cloud storage is only for personal use, not for any academic information or sensitive data. Also keep in mind that if you use more than one device, you have to sync data across devices and this will incur costs.

More tips on backups, as well as activating Windows’ automatic backup function on www.backblaze.com.

 

 

Petya wreaks havoc worldwide

Wednesday, June 28th, 2017

A serious ransomware attack, similar to WannaCry, has reached Asia after spreading from Europe to the US, hitting businesses, banks, airports, power stations, port operators and government systems. This ransomware is being described by the press and security researchers as “Petya Ransomware.”  Read more on Fin24.

Ransomware is a type of computer virus usually downloaded that attacks and takes over a computer, sometimes installing a password or encrypting the entire hard drive, preventing any access. The victim is then extorted for money, usually payable in Bitcoin, in order to unlock their precious data.”

“This is a new generation of ransomware designed to take timely advantage of recent exploits. This current version is targeting the same vulnerabilities that were exploited during the recent Wannacry attack this past May. This latest attack, known as Petya, is something we are referring to as a ransomworm. In this variant, rather than targeting a single organization, it uses a broad-brush approach that targets any device it can find that its attached worm is able to exploit.” (www.blog.fortinet.com)

While many of you might not be too concerned about this attack, since it originally happened in Ukraine, a small country on the other side of the world, the nature of the Internet and the fact that we are all connected in some way or another, means that it will only be a matter of time before we start to experience attacks on South African soil. There are already reports of infected emails from the Ukraine attack being detected in parts of Western Europe and the USA. 

This attack seems to have began with a extensive phishing attack of emails sent out with infected Excel attachments, or a Trojan virus that attempts to disguise itself as a type of Microsoft Excel online document. Once opened the infected attachment will gain control over the victim’s computer and start encrypting the hard drive contents, preventing any access.

To ensure that you don’t fall prey to this attack, you can follow these instructions from Microsoft.

Please be wary of emails that come from unknown sources, (or even from senders who are unaware that their computers are controlled by ransomware and are busy sending out infected emails.) especially if they have .XLS, .PDF and .HTML attachments or ask you to login to verify details or click on links.

  • The best defense against ransomware is to outwit attackers by not being vulnerable to their threats in the first place. This means backing up important data daily, so that even if your computer gets infected, you won’t be forced to pay to see your data again. Do you have a backup of ALL your important data? Operating systems can be easily rebuilt or reinstalled – your personal data cannot.
  • Be aware of emails that carry a malicious attachments or instruct you to click on a URL.
  • Watch out for “malvertising” – this involves compromising an advertiser’s network by embedding malware in ads that get delivered through web sites you know and trust. Ad blockers are one way to block malicious ads, and patching known browser security holes will also thwart some malvertising. Is your computer up-to-date?
  • Finally, don’t be trigger-happy and click on links, no matter how legitimate they might look. Think first before clicking. If you have doubts about an email, phone up the IT HelpDesk and find out or ask your local computer geek for their opinion.

Many of you are on holiday and at home where your protection *might* not be a good as what we enjoy at the university. 

[ARTICLE BY DAVID WILES]

How to avoid ransomware attacks

Friday, June 2nd, 2017

Ransomware is a type of malware designed to encrypt users’ files or lock their operating systems so attackers can demand a ransom payment. According to a 2016 Symantec report, the average ransom demand is almost $700 and “consumers are the most likely victims of ransomware, accounting for 57 percent of all infections between January 2015 and April 2016.”

Similar to a phishing attack, ransomware executes when a user is lured to click on an infected link or e-mail attachment or to download a file or software drive while visiting a rogue website. Sophisticated social engineering techniques are used to entice users to take the desired action; examples include

  • an embedded malicious link in an e-mail offers a cheap airfare ticket (see figure 1);
  • an e-mail that appears to be from Google Chrome or Facebook invites recipients to click on an image to update their web browser (see figure 2); or
  • a well-crafted website mimics a legitimate website and prompts users to download a file or install an update that locks their PC or laptop.

Figure 1. Phishing e-mail with ransomware embedded in a link

Figure 2. A fake Google Chrome e-mail

To avoid becoming a victim of ransomware, users can follow these tips:

  • Delete any suspicious e-mail. Messages from unverified sources or from known sources that offer deals that sound too good to be true are most likely malicious (see figure 3). If in doubt, contact the alleged source by phone or by using a known, public e-mail address to verify the message’s authenticity.
  • Avoid clicking on unverified e-mail links or attachments. Suspicious links might carry ransomware (such as the CryptoLocker Trojan).
  • Use e-mail filtering options whenever possible. E-mail or spam filtering can stop a malicious message from reaching your inbox.
  • Install and maintain up-to-date antivirus software. Keeping your operating system updated with the latest virus definitions will ensure that your security software can detect the latest malware variations.
  • Update all devices, software, and plug-ins on a regular basis. Check for an operating system, software, and plug-in updates often — or, if possible, set up automatic updates — to minimise the likelihood of someone holding your computer or files for ransom.
  • Back up your files. Backup the files on your computer, laptop, or mobile devices frequently so you don’t have to pay the ransom to access locked files.
Figure 3. An example ransomware e-mail message

Figure 3. An example ransomware e-mail message

 

How to protect yourself from ransomware

Friday, May 19th, 2017

A serious virulent ransomware threat known as WannaCrypt0r/WannaCry has been affecting Windows computers on shared networks in around 150 countries worldwide. Once one computer on a network is affected, the malware infection easily spreads to other Windows computers on the same network, shutting down entire government agencies and national infrastructure companies. More on this attack. 

Ransomware forms part of a group of malicious computer software called malware,  which installs itself on your PC. It can be installed by means of an e-mail attachment, an infected programme or unsafe website with malware installed on it.  The software “kidnaps” your data by encrypting or limiting your access to it and then sending you a message demanding money to regain your access.  The only way access is possible again, is by acquiring an encryption key from the creator of the ransomware at a fee and this isn’t necessarily guaranteed.

But how do you protect yourself from ransomware

  • If you use Windows, install the patch that Microsoft has released to block the specific exploit that the WannaCry ransomware is using. Instructions can be found in the Microsoft Knowledge Base. You can also directly download the patches for your OS from the Microsoft Update Catalogue. (Take note that this is mostly applicable to devices that are not on the university network.)
  • Update your Antivirus software definitions. Most AV vendors have now added detection capability to block WannaCry. (Devices running on the SU network should be up to date)
  • If you don’t have anti-virus software enabled on your Windows machine, enable Windows Defender, or Avast! AV or Avira AntiVirus, which is free.
  • Backup regularly and make sure you have offline backups. That way, if you are infected with ransomware, it can’t encrypt your backups.
  • For further reading, this is an excellent detailed write-up on the WannaCry ransomware.  
  • Get the word out.

[INFORMATION SUPPLIED BY DAVID WILES]

Critical ransomware attack targeted Windows computers

Saturday, May 13th, 2017
A serious virulent ransomware threat known as WannaCrypt0r/WannaCry has been affecting Windows computers on shared networks in at least 150 countries worldwide. Once one computer on a network is affected, the infection easily spreads to other Windows computers on the same network, easily shutting down entire government agencies and national infrastructure companies. More information on this attack

Ransomware is a malicious script or software that installs itself on your computer without you knowing. Once it’s installed and running, it will lock down your system and won’t allow you to access any files or programs on that computer. To unlock your system and regain access to the computer being held hostage, the lock screen informs you that you must pay for an unlock tool or decryption key from the hacker.

If your Windows computer is connected to a shared network, such as those at the University, Information Technology will automatically keep your Windows up-to-date so you don’t have to.

If you are running Windows and automatic updates are enabled you should be okay. If you don’t and haven’t updated recently you should update to the most recently released version immediately. Information Technology does manage automatic updates on many of our computers, but users also have to check their computers, especially with laptops that are taken home, in hostels and connect to other less well-managed networks. 

Keep an eye open for phishing e-mails requesting that you click on links and fill in your username and password. Beware sites that you visit that have suspicious popups that ask you to install software or “inform” you that your computer is infected with viruses.

Just because the mail looks like it has been sent from a university address or the site that you visit looks like a university or Internet banking website, don’t be fooled. Check the address and what you are being asked to do. If in doubt ask Information Technology, or your local “computer nerd”. They will be able to help and advise you.

More articles on ransomware.

[ARTICLE BY DAVID WILES]

 

© 2013-2017 Disclaimer: The views and opinions expressed in this page are strictly those of the page author(s) and content contributor(s). The contents of this page have not been reviewed or approved by Stellenbosch University.