Attacks/Breaches

1/4/2017
07:30 AM
Chris Ensey
Chris Ensey
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Ransomware Has Evolved, And Its Name Is Doxware

The latest form of malware holds computers hostage and compromises the privacy of conversations, photos, and sensitive files.

In recent years, ransomware has become a growing concern for companies in every industry. Between April 2015 and March 2016, the number of individuals affected by ransomware surpassed 2 million — a 17.7% increase from the previous year.

Ransomware attacks function by breaching systems, usually through infected email, and locking important files or networks until the user pays a specified amount of money. According to FBI statistics cited in a Malwarebytes report, hackers gained more than $209 million from ransomware payments in the first three months of 2016, putting ransomware on track to rake in nearly $1 billion this year.

Many companies have figured out that they can avoid paying these ransoms by wiping a system clean, restoring it with backup drives, and going about business without being held hostage. But as a result of increased ransom-avoidance, cybercriminals have created an even more insidious threat. Imagine malware that combines ransomware with a personal data leak: this is what the latest threat, doxware, looks like.

With doxware, hackers hold computers hostage until the victim pays the ransom, similar to ransomware. But doxware takes the attack further by compromising the privacy of conversations, photos, and sensitive files, and threatening to release them publicly unless the ransom is paid. Because of the threatened release, it's harder to avoid paying the ransom, making the attack more profitable for hackers.

In 2014, Sony Pictures suffered an email phishing malware attack that released private conversations between top producers and executives discussing employees, actors, industry competitors, and future film plans, among other sensitive topics. And ransomware attacks have claimed a number of recent victims, especially healthcare systems, including MedStar Health, which suffered a major attack affecting 10 hospitals and more than 250 outpatient centers in March 2016. Combine the data leak of Sony and the ransomware attack on MedStar and you can see the potential fallout from a doxware attack.

Doxware requires strategic, end-to-end planning, which means hackers will target their victims more deliberately. Therefore, malicious players will be more intentional in whom they attack, giving corporate leaders, politicians, celebrities, and other public figures cause for concern.

Looking at the data leaked from Sony, it's easy to imagine the catastrophic effect doxware would have on an executive of any major corporation. Company leaders hold countless conversations over email each day on sensitive topics ranging from product development to competition to internal politics, and if there's a doxware attack, the fallout could be extensive.

Expect Things to Get Worse
The technology behind doxware is still new, but expect the problem to become worse. Recent attacks have been contained to Windows desktop computers and laptops, but this will certainly change. Once the malware can infiltrate mobile devices, the threat will become even more pervasive, with text messages, photos, and data from apps at risk for being leaked.

It's also highly likely that doxware will target more types of files. Workplace emails are currently a big target for hackers. However, a company's internal communications/instant messaging network is also appealing to hackers using doxware, as the messaging network often serves as a platform where both sensitive business discussion and casual conversations take place, potentially exposing both company secrets and personally embarrassing exchanges.

Although doxware is largely still developing, two of its variants have been spotted in action by the Malware Hunter Team, whose Cyber Tracker website monitors phishing sites, botnet control sites, and malware distribution. One of these variants hold files ransom with the threat of release and then steals a victim's passwords. Another mutation, Popcorn Time, takes doxware even further giving victims the option to infect two of their friends with the malware instead of paying the ransom. The attacks give a glimpse at what could come from this damaging new ransomware mutation, and the reality is frightening. 

As the doxware threat evolves and a broader range of devices, users, and data are targeted, it's critical for companies and individuals to always keep data security front of mind.

Related Content:

Christopher Ensey is Chief Operating Officer of Dunbar Security Solutions, where he oversees operations across the entire spectrum of the division's managed services. With over 15 years of experience in systems engineering and digital security, he has provided strategic ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
J@wn
50%
50%
[email protected],
User Rank: Apprentice
1/4/2017 | 3:31:35 PM
Inevitable Response
This is the persistent race condition of crime and security, but with an exponential consequence. Paying an expensive ransome is bad enough, but this could easily destroy a business if it's core competency or even competitive advantage was exposed.
HardenStance
50%
50%
HardenStance,
User Rank: Strategist
1/4/2017 | 10:19:32 AM
Next Mobile Ransomrware Variants
I wouldn't be surprised to see more in terms of mobile ransomware variants that lock up the user's cloud storage resources leveraging the smartphone's authentication features.
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Are you sure this is how we get our data into the cloud?
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-8298
PUBLISHED: 2018-09-24
Multiple SQL injection vulnerabilities in the login page in RXTEC RXAdmin UPDATE 06 / 2012 allow remote attackers to execute arbitrary SQL commands via the (1) loginpassword, (2) loginusername, (3) zusatzlicher, or (4) groupid parameter to index.htm, or the (5) rxtec cookie to index.htm.
CVE-2018-14825
PUBLISHED: 2018-09-24
A skilled attacker with advanced knowledge of the target system could exploit this vulnerability by creating an application that would successfully bind to the service and gain elevated system privileges. This could enable the attacker to obtain access to keystrokes, passwords, personal identifiable...
CVE-2018-17437
PUBLISHED: 2018-09-24
Memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (memory consumption) via a crafted HDF5 file.
CVE-2018-17438
PUBLISHED: 2018-09-24
A SIGFPE signal is raised in the function H5D__select_io() of H5Dselect.c in the HDF HDF5 through 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. It could allow a remote denial of service attack.
CVE-2018-17439
PUBLISHED: 2018-09-24
An issue was discovered in the HDF HDF5 1.10.3 library. There is a stack-based buffer overflow in the function H5S_extent_get_dims() in H5S.c. Specifically, this issue occurs while converting an HDF5 file to a GIF file.