Blogs

Your money or your documents: how hackers can hold your files to ransom

By Chris Hall | Yahoo News – Tue, Nov 19, 2013

Yahoo News - The Cryptolocker software locks users out of their files, and asks for payment in return for the key - which is unlikely to be delivered. (Symantec)
Britain's National Crime Agency (NCA) has issued a warning to businesses over a wave of hacking attacks that have seen hackers take control of computer files and demand a £900 ransom to unlock each one.

The attackers use spam emails to target small and medium-sized businesses, with attachments that look like invoices, voicemails or other business documents.

An example of a Cryptolocker-infected email, with malware attachment, as found by Symantec

The NCA says that 'tens of millions' of people may have been targeted in Britain, and noted that the attacks seemed to be aimed predominantly at companies. It described the attacks as a 'significant risk'.

The attachments contain a piece of malware called Cryptolocker - an automated piece of ransom software that, if activated, will search for documents and encrypt them so that they cannot be opened or read by the user.

Microsoft Office documents were the most commonly affected, but different variations of the malware also searched for other documents, such as .pdf files.

Cryptolocker then prompts the owner of the files to pay two Bitcoins (each worth £449 as of 19/11/13) for the key to unlock the files.

Bitcoins are a private and anonymous digital currency that can be traded against other major world currencies. The exchange rate can fluctuate wildly.
Ransomware has been on the rise since last year. A report from Symantec Internet Security noted that for a much cheaper ransom, of 5,300 computers infected, 'About three percent of victims paid the ransom, which netted the criminals about $30,000.'

The NCA said in its statement that it 'would never endorse the payment of a ransom to criminals and there is no guarantee that they would honour the payments in any event'.

Lee Miles, Deputy Head of the NCCU says "The NCA are actively pursuing organised crime groups committing this type of crime. We are working in cooperation with industry and international partners to identify and bring to justice those responsible and reduce the risk to the public."

The malware should be detected by up to date antivirus software. Users should exercise caution over opening unfamiliar attachments. Some of the attachments are notable for having a double file extension, such as " FORM_101513.pdf.exe."

Decrypting files that Cryptolocker has been able to encrypt is 'not feasible', according to Symantec. But there are ways that affected users can recover their files even if they have been locked out, using free Windows tools.

If you have made backups of your files, Windows Backup will be able to revert the file to its pre-locked state. Similarly, you can right-click on a file before opening it and choose to open a previous version, giving you the chance to retrieve data from the file.

If your computer does become infected, you should disconnect it from your network, and run a full antivirus scan to identify and quarantine the affected files.

A spokesman for Symantec said: 'Symantec does detect and protect against this threat. We continuously work to protect customers against this threat through various technologies, including the Symantec Email Security.cloud solution.'