Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/31/2017
12:00 PM
Dawn Kawamoto
Dawn Kawamoto
Slideshows
50%
50%

How to Make a Ransomware Payment - Fast

Paying ransom in a ransomware attack isn't recommended, but sometimes, it's necessary. Here's how to pay by cryptocurrency.
Previous
1 of 8
Next

Image Source: Steve Heap via Shutterstock

Image Source: Steve Heap via Shutterstock

Against their better judgment, sometimes IT security professionals are pressured to help their CEOs, chief financial officers, or boards of directors make a ransomware payment.

Paying ransom in a ransomware attack is not as easy as wiring money from a bank, or filling a suitcase full of hundred-dollar bills. Ransomware attacks typically call for sending cryptocurrency to unlock kidnapped data, with values ranging from a few hundred to even millions of dollars

And although traditional financial institutions reportedly are beginning to show interest in cyrptocurrencies, that payment avenue will likely remain blocked for ransomware payments under anti-money laundering and know-your-customer regulations that institutions must abide by. Last year, New York prosecutors charged a Bitcoin exchange operator with violating anti-money laundering laws when it facilitated making a ransomware payment, according to a Fortune report. However, Coin Center, a nonprofit cryptocurrency research and advocacy group, contended it should not be a crime to help ransomware victims.

Meanwhile, cybercriminals are ramping up the deadlines for victims to make ransom payments, or face the potential of having their locked up data, files, photos, and video destroyed. Some attacks delete files if a victim can't meet tight deadlines in time.

"People are being put on a countdown timer and data will be deleted if they don't pay. As a result, companies want to make the payment as fast as possible. Jigsaw, for example, will delete an individual file every hour that you don't pay," says Rick McElroy, security strategist for Carbon Black.

Nearly 60% of employees hit by a ransomware attack at work personally paid the extortion money, according to a new report released today by Intermedia.

While law enforcement as well as security experts in general don't recommend paying ransom, here are seven tips for how to make a ransomware payment in that dire case where there is no other choice. 

 

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
11/1/2017 | 3:48:49 PM
Re: backup, backup and backup again
TOTALLY AGREE!!!  Any business that does not have a valid and tested system restore protocol AND server backup plan deserves what it gets!!!  Tht said - an ransomware payment should come out of the salary pool of the IT staff which would then MAKE THEM MUCH MORE AWARE of the problems.  None of this is NEWS FOR TODAY folks!!!  Valid DR and restore protocols have been around for years.  NOBODY wants to implement or test them. 
jenshadus
50%
50%
jenshadus,
User Rank: Strategist
11/1/2017 | 12:50:57 PM
backup, backup and backup again
My work computer is backed up once a day.  Plus I use a VDI within my laptop and leave few files on my laptop.  Just the essentials for when I travel.  At home I backup everyday, keep my firewall on, and keep the anti-virus scanning.  If I get hit, which I doubt (cross my fingers) I'll just wipe my own computer. 
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2079
PUBLISHED: 2019-11-22
A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal.
CVE-2019-11325
PUBLISHED: 2019-11-21
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
CVE-2019-18887
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
CVE-2019-18888
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. T...
CVE-2019-18889
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.