Blogs

Your money or your documents: how hackers can hold your files to ransom

By Chris Hall | Yahoo News – Tue, Nov 19, 2013

Yahoo News - The Cryptolocker software locks users out of their files, and asks for payment in return for the key - which is unlikely to be delivered. (Symantec)
Britain's National Crime Agency (NCA) has issued a warning to businesses over a wave of hacking attacks that have seen hackers take control of computer files and demand a £900 ransom to unlock each one.

The attackers use spam emails to target small and medium-sized businesses, with attachments that look like invoices, voicemails or other business documents.

An example of a Cryptolocker-infected email, with malware attachment, as found by Symantec

The NCA says that 'tens of millions' of people may have been targeted in Britain, and noted that the attacks seemed to be aimed predominantly at companies. It described the attacks as a 'significant risk'.

The attachments contain a piece of malware called Cryptolocker - an automated piece of ransom software that, if activated, will search for documents and encrypt them so that they cannot be opened or read by the user.

Microsoft Office documents were the most commonly affected, but different variations of the malware also searched for other documents, such as .pdf files.

Cryptolocker then prompts the owner of the files to pay two Bitcoins (each worth £449 as of 19/11/13) for the key to unlock the files.

Bitcoins are a private and anonymous digital currency that can be traded against other major world currencies. The exchange rate can fluctuate wildly.
Ransomware has been on the rise since last year. A report from Symantec Internet Security noted that for a much cheaper ransom, of 5,300 computers infected, 'About three percent of victims paid the ransom, which netted the criminals about $30,000.'

The NCA said in its statement that it 'would never endorse the payment of a ransom to criminals and there is no guarantee that they would honour the payments in any event'.

Lee Miles, Deputy Head of the NCCU says "The NCA are actively pursuing organised crime groups committing this type of crime. We are working in cooperation with industry and international partners to identify and bring to justice those responsible and reduce the risk to the public."

The malware should be detected by up to date antivirus software. Users should exercise caution over opening unfamiliar attachments. Some of the attachments are notable for having a double file extension, such as " FORM_101513.pdf.exe."

Decrypting files that Cryptolocker has been able to encrypt is 'not feasible', according to Symantec. But there are ways that affected users can recover their files even if they have been locked out, using free Windows tools.

If you have made backups of your files, Windows Backup will be able to revert the file to its pre-locked state. Similarly, you can right-click on a file before opening it and choose to open a previous version, giving you the chance to retrieve data from the file.

If your computer does become infected, you should disconnect it from your network, and run a full antivirus scan to identify and quarantine the affected files.

A spokesman for Symantec said: 'Symantec does detect and protect against this threat. We continuously work to protect customers against this threat through various technologies, including the Symantec Email Security.cloud solution.'

NASA confirms 'super-Earth' that could hold life
By Kerry Sheridan

In another step toward finding Earth-like planets that may hold life, NASA said the Kepler space telescope has confirmed its first-ever planet in a habitable zone outside our solar system.

French astronomers earlier this year confirmed the first rocky exoplanet to meet key requirements for sustaining life. But Kepler-22b, initially glimpsed in 2009, is the first the US space agency has been able to confirm.

Confirmation means that astronomers have seen it crossing in front of its star three times. But it doesn't mean that astronomers know whether life actually exists there, simply that the conditions are right.

Such planets have the right distance from their star to support water, plus a suitable temperature and atmosphere to support life.

"We have now got good planet confirmation with Kepler-22b," said Bill Borucki, Kepler principal investigator at NASA Ames Research Center.

"We are certain that it is in the habitable zone and if it has a surface, it ought to have a nice temperature," he told reporters.

Spinning around its star some 600 light years away, Kepler-22b is 2.4 times the size of the Earth, putting it in class known as "super-Earths," and orbits its Sun-like star every 290 days.

Its near-surface temperature is presumed to be about 72 degrees Fahrenheit (22 Celsius). Scientists do not know, however, whether the planet is rocky, gaseous or liquid.

The planet's first "transit," or star crossover, was captured shortly after NASA launched its Kepler spacecraft in March 2009.

NASA also announced that Kepler has uncovered 1,094 more potential planets, twice the number it previously had been tracking, according to research being presented at a conference in California this week.

Kepler is NASA's first mission in search of Earth-like planets orbiting suns similar to ours, and cost the US space agency about $600 million.

It is equipped with the largest camera ever sent into space -- a 95-megapixel array of charge-coupled devices -- and is expected to continue sending information back to Earth until at least November 2012.
Kepler is searching for planets as small as Earth, including those orbiting stars in a warm, habitable zone where liquid water could exist on the surface of the planet.

The latest confirmed exoplanet that could support life brings to three the total number confirmed by global astronomers.

In addition to French astronomers' confirmed finding of Gliese 581d in May, Swiss astronomers reported in August that another planet, HD 85512 b, about 36 light years away seemed to be in the habitable zone of its star.

However, those two planets are "orbiting stars smaller and cooler than our Sun," NASA said in a statement, noting that Kepler-22b "is the smallest yet found to orbit in the middle of the habitable zone of a star similar to our Sun."

"The Europeans have also been very active, actively working on confirming our candidates," said Natalie Batalha, Kepler deputy science team lead at San Jose State University.

"They have already confirmed two that are published and they have got another batch that are on the preprint servers so those will be, I'm sure, in the published literature soon," she added.

"So we are just thrilled about this. We need all telescopes observing these candidates so we can confirm as many as possible."

A total of 48 exoplanets and exomoons are potential habitable candidates, among a total of 2,326 possibilities that Kepler has identified so far.

The top rankers are listed in an online catalog that indexes bodies outside our solar system, available online at http://phl.upr.edu.