Attacks/Breaches

1/4/2017
07:30 AM
Chris Ensey
Chris Ensey
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Ransomware Has Evolved, And Its Name Is Doxware

The latest form of malware holds computers hostage and compromises the privacy of conversations, photos, and sensitive files.

In recent years, ransomware has become a growing concern for companies in every industry. Between April 2015 and March 2016, the number of individuals affected by ransomware surpassed 2 million — a 17.7% increase from the previous year.

Ransomware attacks function by breaching systems, usually through infected email, and locking important files or networks until the user pays a specified amount of money. According to FBI statistics cited in a Malwarebytes report, hackers gained more than $209 million from ransomware payments in the first three months of 2016, putting ransomware on track to rake in nearly $1 billion this year.

Many companies have figured out that they can avoid paying these ransoms by wiping a system clean, restoring it with backup drives, and going about business without being held hostage. But as a result of increased ransom-avoidance, cybercriminals have created an even more insidious threat. Imagine malware that combines ransomware with a personal data leak: this is what the latest threat, doxware, looks like.

With doxware, hackers hold computers hostage until the victim pays the ransom, similar to ransomware. But doxware takes the attack further by compromising the privacy of conversations, photos, and sensitive files, and threatening to release them publicly unless the ransom is paid. Because of the threatened release, it's harder to avoid paying the ransom, making the attack more profitable for hackers.

In 2014, Sony Pictures suffered an email phishing malware attack that released private conversations between top producers and executives discussing employees, actors, industry competitors, and future film plans, among other sensitive topics. And ransomware attacks have claimed a number of recent victims, especially healthcare systems, including MedStar Health, which suffered a major attack affecting 10 hospitals and more than 250 outpatient centers in March 2016. Combine the data leak of Sony and the ransomware attack on MedStar and you can see the potential fallout from a doxware attack.

Doxware requires strategic, end-to-end planning, which means hackers will target their victims more deliberately. Therefore, malicious players will be more intentional in whom they attack, giving corporate leaders, politicians, celebrities, and other public figures cause for concern.

Looking at the data leaked from Sony, it's easy to imagine the catastrophic effect doxware would have on an executive of any major corporation. Company leaders hold countless conversations over email each day on sensitive topics ranging from product development to competition to internal politics, and if there's a doxware attack, the fallout could be extensive.

Expect Things to Get Worse
The technology behind doxware is still new, but expect the problem to become worse. Recent attacks have been contained to Windows desktop computers and laptops, but this will certainly change. Once the malware can infiltrate mobile devices, the threat will become even more pervasive, with text messages, photos, and data from apps at risk for being leaked.

It's also highly likely that doxware will target more types of files. Workplace emails are currently a big target for hackers. However, a company's internal communications/instant messaging network is also appealing to hackers using doxware, as the messaging network often serves as a platform where both sensitive business discussion and casual conversations take place, potentially exposing both company secrets and personally embarrassing exchanges.

Although doxware is largely still developing, two of its variants have been spotted in action by the Malware Hunter Team, whose Cyber Tracker website monitors phishing sites, botnet control sites, and malware distribution. One of these variants hold files ransom with the threat of release and then steals a victim's passwords. Another mutation, Popcorn Time, takes doxware even further giving victims the option to infect two of their friends with the malware instead of paying the ransom. The attacks give a glimpse at what could come from this damaging new ransomware mutation, and the reality is frightening. 

As the doxware threat evolves and a broader range of devices, users, and data are targeted, it's critical for companies and individuals to always keep data security front of mind.

Related Content:

Christopher Ensey is Chief Operating Officer of Dunbar Security Solutions, where he oversees operations across the entire spectrum of the division's managed services. With over 15 years of experience in systems engineering and digital security, he has provided strategic ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
J@wn
50%
50%
[email protected],
User Rank: Apprentice
1/4/2017 | 3:31:35 PM
Inevitable Response
This is the persistent race condition of crime and security, but with an exponential consequence. Paying an expensive ransome is bad enough, but this could easily destroy a business if it's core competency or even competitive advantage was exposed.
HardenStance
50%
50%
HardenStance,
User Rank: Strategist
1/4/2017 | 10:19:32 AM
Next Mobile Ransomrware Variants
I wouldn't be surprised to see more in terms of mobile ransomware variants that lock up the user's cloud storage resources leveraging the smartphone's authentication features.
5 Reasons the Cybersecurity Labor Shortfall Won't End Soon
Steve Morgan, Founder & CEO, Cybersecurity Ventures,  12/11/2017
Oracle Product Rollout Underscores Need for Trust in the Cloud
Kelly Sheridan, Associate Editor, Dark Reading,  12/11/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Gee, these virtual reality goggles work great!!! 
Current Issue
The Year in Security: 2017
A look at the biggest news stories (so far) of 2017 that shaped the cybersecurity landscape -- from Russian hacking, ransomware's coming-out party, and voting machine vulnerabilities to the massive data breach of credit-monitoring firm Equifax.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.