Melanie

That nasty thing above is the screen for a new, on the rise RansomWare called CryptoLocker.  We’ve discussed RansomWare before in a previous couple of posts here and here.   As a review of what this malware does – it locks your computer and then holds it for – yep, you guessed it – a ransom fee.  Hence the name.

However with this particular RansomWare it encrypts all your files and then offers, as above in the screen shot, a way to decrypt them –  for a price – anywhere from $100 – $700 or in some cases, 2 Bitcoins – 10 Bitcoins ( $450 – $2100).   In fact, with this new attack, they offer a “Decryption Service” that allows victims to purchase a “decryption key”.  Of course, that’s the last thing you want to do.  Bottom line: your files get encrypted and you may lose them forever and ever.  Amen.  …unless you have the decryption key.

How do you get infected?

CryptoWare is spread through email attachments and it ihas been noted that the hackers are targeting companies through phishing attacks.

What kind of files are  being targeted on an infected computer?

The file extensions, according to MalwareBytes, are listed below:

3fr, accdb, ai, arw, bay, cdr, cer, cr2, crt, crw, dbf, dcr, der, dng, doc, docm, docx, dwg, dxf, dxg, eps, erf, indd, jpe, jpg, kdc, mdb, mdf, mef, mrw, nef, nrw, odb, odm, odp, ods, odt, orf, p12, p7b, p7c, pdd, pef, pem, pfx, ppt, pptm, pptx, psd, pst, ptx, r3d, raf, raw, rtf, rw2, rwl, srf, srw, wb2, wpd, wps, xlk, xls, xlsb, xlsm, xlsx

How far has this malware spread?

According to The Hacker News, “…64% of its victims are from the US.”   It targets Windows systems.

Removal:

Regretfully, there is no specific tool known to be able to decrypt and restore asymmetrically encrypted files except a private key.  MalwareBytes will detect CryptoLocker as “Trojan.Ransom” but it also cannot restore your encysted files.  Your best defense is to back up your files frequently.  And since this malware can cross through external drives such as USB and mapped drives, don’t leave X-drives mounted.   Keep your anti-virus up to date and work at using file sharing services rather than relying on email attachments.

This is a special notice from CERT that we have just been made aware of: Ransomware is back but under the guise of a false warning from the Department of Homeland Security.   For a review of what Ransomware is and how it works, you might want to read our past post on this malware.

So how does this new Ransomware work?

Users who are being targeted by the ransomware receive a message claiming that use of their computer has been suspended and that the user must pay a fine to unblock it. One iteration of this malware also takes a webcam (if available) photo or video of a recipient and posts it in a pop-up to add to the appearance of legitimacy. The ransomware falsely claims to be from the U.S. Department of Homeland Security and the National Cyber Security Division. – CERT

Reports of this particular nastiness are said to be occurring in the wild which means that this is  a malware that has been reported by at least two verifiable occurrences along with a sample submitted by Wildlist reporters (those with expertise in the field).

Advice:

• Don’t pay the ransom
• Notify the FBI – Internet Crime Complaint Center
• If infected by this Ransomware,
  • Contact a skilled professional OR
  • Reformat your Hard Drive and then  perform a clean reinstall of your OS.
• Change ALL passwords after safely removing the malware from your system to STRONG PASSWORDS.  If its easy for you to remember, its easy for it to be hacked – socially or using hacking software.

Prevention Tips:

• Don’t click on unsolicited links in email messages.
• Make sure your email program SCANS ALL INCOMING EMAIL MESSAGES AND ATTACHMENTS
• Reduce reliance on Email Attachments.  Instead use Google Drive inside a protected intranet and maintain strong password usage.
• Maintain updated antivirus and malware software.  Scan frequently.
• Don’t pass along email chain letters. Delete them
• Log out of all instances online.
• Review this CERT document on recognizing Email Scams
• Review this CERT document on Avoiding Social Engineering and Phishing Attacks.  We’ve covered this information in past posts but its always good to go over it again.

You really don’t want this on your computer.  So be safe and obey the rules of the road on this one.

No, this isn’t about pool safety at the YMCA, this is about making sure you have a secure connection on an insecure connection, namely every time you connect to the Internet at a public wi-fi spot.

Wifi is a public network and any data transfer passing through can be intercepted, monitored or recorded by any number of interested parties with the right software and know how.  That means if you try to access your bank online or make a purchase or login to a web application while on a public wifi network your banking details, credit card numbers, passwords, and other sensitive data can be stolen.   So what can you do to protect yourself?

By now you may have heard the term VPN. What is it exactly?  Its an acronym that stands for Virtual Private Network, a secure , encrypted “tunnel”, if you will, through which all your online data can pass safely.  It works for any application that requires an Internet connection: be it a web browser, email client, or an IM client (chat).

Searching Google  will turn up a number of free VPN’s you can use, one  such is proXPN*, but take note, they don’t all provide the same level of protection.  If you want to be sure that you are getting as much protection as you can get, you might want to think about making the monthly investment.

* Switched-On-Sites does not necessarily endorse this service.  

Several tragedies of recent have provided opportunities for people to reach out and give to help those affected.  Giving online has become easier because of technology and  its also becoming the means of choice.  Unfortunately, this also affords those who have a bad purpose to take advantage of tragic circumstances with scams.  According to a recent release from National Cyber Awareness System, there are already some who are trying to take advantage of the Boston Marathon tragedy and those who are willing to contribute.   How can they do this?  By registering fake domain names and fake social media accounts.  The US-CERT had this to say:

For example, Twitter account
@_BostonMarathon was created shortly after the explosions took place.
The account stated it would donate $1 for each retweet, and was crafted
to closely resemble the legitimate Boston Marathon Twitter account
(@BostonMarathon). This account has since been suspended by Twitter;
however, the likelihood that similar social media accounts will surface
remains high.

US-CERT recommends that you look to official charities if you wish to donate money to support those affected by tragedies, especially those that have recently happened, such as the Boston Marathon bombing,  the West, Texas Fertilizer plant explosion and the Beaumont, Texas Oil Refinery fire.

Use caution when clicking links or interacting with social media accounts that claim to be representing a charity for a recent tragedy or need.   Do your homework.  Check out legitimate news agencies for verification or trusted  local organizations and churches.