Ransomeware, data security and compliance with data protection laws

January 25, 2015 |

The Economist in Your money or your data highlights the increasing use of ransomware which compounds a data breach. The unauthorised access of personal/business information is bad enough but for that information to be encrypted and, as the name suggests, held for ransom makes a highly embarrassing problem potentially catastrophic.  The starting point must be proper data security practices to avoid downloading malware.  The article reinforces the need to have proper data breach notification laws so that there can be some proper understanding of the scope of the problem and the development of ransomware.

The article provides:

WHEN internal e-mails and unreleased films from Sony were leaked late last year, it was the origin of the hack (perhaps North Korea) and the embarrassing details (withering comments on film stars) that made the news. Less remarked was that the hackers had offered the media giant the chance to avoid the leak by acquiescing to its demands, which have not been made public.

Such cyber-hold-ups are on the rise globally and go far beyond big firms. More typical is the story of an Italian architectural draughtsman who turned to Digital Forensics Bureau, a computer-security firm in Turin, after unwittingly downloading “ransomware”—a virus that encrypted all his files and posted an onscreen message demanding cash to unlock them. Neither he nor the firm succeeded in cracking it. Faced with losing every file from his 14-year career, he capitulated, paid up and received a decryption key by e-mail.

Ransomware is here to stay, says Troels Oerting of Europol’s European Cybercrime Centre. The emergence of bitcoin, a digital cryptocurrency that can be used anonymously, is a big part of the reason. Most ransoms must be paid in it, and ransom notes typically explain how to buy it. Other online options such as PayPal require a credit or debit card, or a bank account, making them riskier for criminals.

Many of the extortionists are from Russia; its authorities are uninterested in hunting them down. Their victims are everywhere. In Australia alone, estimates the Australian Crime Commission, a government agency, between August and mid-December around 16,000 individuals, firms and government bodies paid a total of A$8m ($7m) after downloading ransomware. Not all victims get their data back: some refuse to pay, and just as 17th-century highwaymen sometimes took first money and then lives, their digital equivalents can renege on promises to unlock files.

Ransomware programmers keep ahead of antivirus software by continually tweaking their code. Last year Europol and the Dutch National High-Tech Crime Unit warned that ransomware “kits” were available online, complete with tips on hiding profits from the authorities. And tricking people into downloading ransomware via an e-mail attachment is not the only approach. Extortionists often pay associates to post “malvertising” banner ads that lure traffic to websites that can take control of visiting computers, says a Parisian security researcher known as Malekal.

Until recently a victim with some technical skill might have been able to work around ransomware code, says Paolo Dal Checco of Digital Forensics Bureau. Now speedy innovation by attackers means victims are usually outgunned. In June a team led by the FBI seized computers that had been distributing CryptoLocker, a piece of ransomware. Specialists cracked it and created DeCryptoLocker, a free decryption service. But CryptoWall, an immune version, quickly appeared. In September Nixu Corporation, a Finnish IT-security firm, found a way to disable particularly fierce ransomware called TorrentLocker—but within weeks its makers had fixed the weakness that the firm had spotted.

According to Gregg Housh, an online marketer who is close to Anonymous, a hackers’ collective, the average ransom has fallen from about $800 in the past few years as extortionists have found the sweet spot where their victims simply pay up. In October Maria Grazia Mazzolari, an official in Bussoleno, a small town in northern Italy, paid a €510 ($644) ransom herself when the authorities balked at using taxes to reward criminals. Shortly afterwards the sheriff’s office in Dickson County, Tennessee, paid $572 to recover thousands of files. Ransoms have fallen even further in Paris, says Eric Larchevêque. Most victims who buy bitcoin at La Maison du Bitcoin, his shop, spend between €160 and €275.

Daylight robbery

Estimating the profits from any type of cybercrime is tricky. But even though ransoms are falling, the new Dick Turpins are raking it in. To collect ill-gotten gains in bitcoin, they must give a bitcoin-account number: anyone can view transactions, though not the holder’s identity. Accounts used by whoever held Bussoleno to ransom racked up $109,400-worth of bitcoin in the next eight days.

Ruses used by 17th-century travellers, such as hiding valuables, hiring guards and picking routes with care, have echoes today. Web-users should back up files, use antivirus software and firewalls, and avoid suspicious attachments and sites. But now, as then, the unwary and unlucky fall victim—and many see no choice but to pay.






One Response to “Ransomeware, data security and compliance with data protection laws”

  1. Ransomeware, data security and compliance with data protection laws | Australian Law Blogs

    […] Ransomeware, data security and compliance with data protection laws […]

Leave a Reply