Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

Guest Blog // Selected Security Content Provided By Sophos
What's This?
11/21/2013
03:56 PM
Maxim Weinstein
Maxim Weinstein
Security Insights
50%
50%

What You Need To Know About CryptoLocker

CryptoLocker ransomware is terrorizing home and business users alike. Here's how to protect yourself

During the past couple months, ransomware known as CryptoLocker has made its presence known in homes and businesses around the world. While ransomware is not a new concept, the pervasiveness of CryptoLocker, combined with its strong encryption, make it a particularly nefarious ongoing threat.

CryptoLocker is Windows-based ransomware that encrypts files on local drives and network shares, and then demands payment to unlock them. Funds are requested via untraceable payment methods like Bitcoin and MoneyPak. CryptoLocker uses asymmetric encryption, with the private key held by the author or distributor of the malware. Unfortunately, it uses a strong algorithm that makes it practically impossible to decrypt the data without knowing the key. Here's a video showing CryptoLocker in action.

CryptoLocker has, to date, been spread predominantly through email attachments and through other malware that has already infected PCs via other means. It has also been seen as a payload in drive-by downloads.

While CryptoLocker itself can be removed, the strong encryption prevents data encrypted by the malware from being unlocked. Thus, the best remedy for an infection is often to wipe the PC, reinstall Windows, and restore data from a backup that was made preinfection.

Fortunately, CryptoLocker is generally preventable. The best endpoint security products not only detect and block known versions of the malware, but also have techniques for identifying new variants and for blocking exploits and known malicious URLs. Perimeter and anti-spam protection can also be employed to reduce the risk of infection.

The irreversible damage to data reminds us of the importance of having an ironclad backup strategy for users' data. This has to extend beyond simple syncing of local files to a network drive or cloud storage; it must include the ability to recover older versions of files from tape, snapshots, etc. If you haven't recently assessed what information your users are storing locally and how much it would cost in time and lost productivity if that information became inaccessible, then it may be time to revisit your backup strategy.

CryptoLocker represents an evolutionary step in ransomware: the first really widespread attack that uses strong, irreversible encryption. You can expect that additional evolution will occur. Perhaps the next iteration of CryptoLocker will self-replicate or lock users out of their online accounts, for example. The best security against any future iteration is a layered approach that patches vulnerabilities, detects and blocks exploits, risky URLs, and malicious code throughout your environment, and ensures you can recover systems and data in the event that an attack succeeds. And, of course, a bit of user education always helps, too.

Thanks to Paul Ducklin and my colleagues in SophosLabs, whose research I drew on heavily for this column. Maxim Weinstein, CISSP, is a technologist and educator with a passion for information security. He works in product marketing at Sophos, where he specializes in server protection solutions. He is also a board member and former executive director of StopBadware. Maxim lives ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RustyS685
50%
50%
RustyS685,
User Rank: Apprentice
7/31/2014 | 6:37:53 PM
Very Funny
Anyone who still uses the windows operating system and then complains about security deserves everything they get.

Linux users dont have to worry about firewalls, antivirus programs, registry cleaners, anti malware and adware programs, defragmenters and all the other garbage used to keep windows running.

Not only is linux a smoother more powerful secure operating system, it is also easier to operate, takes less resources, it does everything windows does and more AND FREE!

Keep those viruses coming. I can always use a good laugh. Send microsoft some more of your money to clean out the garbage that should not even be there in the first place.

 

 
kenchu
50%
50%
kenchu,
User Rank: Apprentice
12/26/2013 | 11:57:05 PM
re: What You Need To Know About CryptoLocker
Great Article,have been trying to follow this... and understanding it..
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
The Problem with Artificial Intelligence in Security
Dr. Leila Powell, Lead Security Data Scientist, Panaseer,  5/26/2020
GDPR Enforcement Loosens Amid Pandemic
Seth Rosenblatt, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5572
PUBLISHED: 2020-05-29
Android App 'Mailwise for Android' 1.0.0 to 1.0.1 allows an attacker to obtain credential information registered in the product via unspecified vectors.
CVE-2020-5573
PUBLISHED: 2020-05-29
Android App 'kintone mobile for Android' 1.0.0 to 2.5 allows an attacker to obtain credential information registered in the product via unspecified vectors.
CVE-2020-13693
PUBLISHED: 2020-05-29
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.
CVE-2020-13173
PUBLISHED: 2020-05-28
Initialization of the pcoip_credential_provider in Teradici PCoIP Standard Agent for Windows and PCoIP Graphics Agent for Windows versions 19.11.1 and earlier creates an insecure named pipe, which allows an attacker to intercept sensitive information or possibly elevate privileges via pre-installing...
CVE-2019-6342
PUBLISHED: 2020-05-28
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.