CryptoLocker Threat Worsens

Last week I reported about a new serious security issue known as "CryptoLocker" which is a real threat to an infected user's data. PC World recently re-visited this malware threat and I posted it here because it is so important to avoid.

Before I continue with PC World's article I must suggest again, "never ever open an attachment unless you specifically requested the file". This is the only way to avoid this and other security threats.

The creators of CryptoLocker, a piece of malware that encrypts user data and holds it for ransom, are giving users who removed the malicious program from their computers a second chance to recover their files, but at a much higher cost.

CryptoLocker is a malicious program that falls into a category of malware called ransomware. Once installed on a computer, ransomware applications typically prevent victims from accessing their files or even their operating system until they pay money to the malware authors.

Security researchers generally advise users against giving into this kind of extortion and in many cases there is a way to regain access to everything without paying up.

However, CryptoLocker uses solid public-private key cryptography to encrypt files that match a long list of extensions, including documents, spreadsheets, images and even AutoCAD design files. According to researchers from antivirus firm Sophos, the malware’s creators got the encryption process right and there’s no method to get the decryption keys, which are unique for every computer and are stored on attackers’ servers, without paying up.

After it infects a computer, CryptoLocker displays a message informing victims that if they don’t pay the equivalent of $300 or €300 in Bitcoins, a virtual currency, or via MoneyPak, a type of prepaid card, within 72 hours, the unique decryption key for the files will be automatically destroyed.
Users who regularly back up their data can clean their computers and restore the affected files from backups, but users who don’t have backups should consider those files lost, the Sophos researchers said.

Some files might be recoverable using the Shadow Copy technology, which is is an integral part of the System Restore feature in Windows.
However, even users who have backups might realize that they’re not enough to repair the damage done by the malware. Those backups might be too old or they might not include files from remote network shares that have also been encrypted by the malware.

It seems that the creators of CryptoLocker considered that possibility and realized that some users might have initially removed the malware, but then, for whatever reason, changed their mind about paying up. As a result, they’ve recently started offering an online decryption service that allow such users to still recover their files, but at a much higher price.

“Apparently the crooks will now let you buy back your key even if you didn’t follow their original instructions,” Paul Ducklin, the head of technology for the Asia-Pacific region at Sophos, said last Monday. “Word on the street, however, is that the crooks want five times as much as they were charging originally to decrypt your data after you change your mind.”

The cost of using the service is 10 Bitcoins—around $2300 at the current Bitcoin exchange rate—and requires users to upload one of their encrypted files. The first 1024 bytes of the file will be used to search for the associated private key, a process that can take up to 24 hours.

“We’re guessing that the delay is because the crooks have to run a brute force attack against themselves,” Ducklin said. “Without your public key to help them match up your keypair in their database, it sounds as though they have to try to decrypting your data with every stored private key until they hit one that produces a plausible result.”

However it’s not immediately clear whether using this service is still possible after the initial 72-hour deadline given by the malware. If it is, then the cybercriminals lied and the private keys are not being destroyed after that time period.

This decryption service might have also been created for users whose antivirus programs detected and deleted the malware after it encrypted the files, leaving them unable to buy the decryption key anymore.

“We’re still saying, ‘don’t buy,’ but we’re feeling your pain enough to know how tempting it will be for some people to pay the crooks, even though the blackmail charges have now ballooned to more than $2000,” Ducklin said.

Crypto Locker Warning

It seems like I write monthly about computer security but if you needed a reminder to be careful about the emails and attachments you open, it’s now. The Crypto Locker virus that is going around is said to be one of the worst ever and is infecting computers with the Windows OS all across the United States. The virus, also called “ransomware,” works by holding your files hostage until you pay a fee.

The Crypto Locker virus is passed around in emails that have innocent enough looking senders, such as UPS or FedEx, but they’re not really from these corporations, of course. Instead, when you open the attachment, your computer becomes infected and the virus locks all your files until you pay a ransom. Check out a picture of what the Crypto Locker demand screen looks like:

Ransomware causes your computer files to be non-accessible and when that happens you have two choices. You can recover if you have a backup which I hope you do or pay the ransom within 100 hours. If you do not pay the ransom you will lose all of your data.

The Crypto Locker email pretends often pretends to be from a financial institution like a bank or Pay Pal and reports that it has dire news for you and that the attachment is important. readers of these emails often panic and open the attachment and then it's too late. The PC is infected and the files are encrypted which means you cannot open your own files. The attachment will often disguise itself as JPEG images, as PDF files, as Microsoft Office files and many other file types.  After the computer becomes infected, users are usually given 100 hours to pay a fee between $100 and $700 to get the files decrypted.

This Is Important - Follow These Rules

1.  If you get an email from somebody you do not know, especially if it has attachments, do not open anything with it, just delete the email. 

2.  If you did not specifically ask for an attachment do not open it. If you are curious reach out to the send by phone before opening anything. If you cannot contact the send do not open it!

Backing Up Your Files is More Important Then Ever

Make sure you have all of your files backed up both on a local disconnected USB hard drive and in the cloud. There are many free and affordable cloud services available so there is really no excuse not to do this. If your PC gets infected with the Crypto Locker virus you backup may be your digital salvation.

Avoiding Malware 101

Here is yet another article about the increasing problems surrounding malware. Take a few moments to learn about some of the new attack methods hackers are using so you can avoid having to pay the IT guy (hopefully me) to fix your broken PC.

1. USB malware

A great number of the cyber security threats companies face come from the Internet and reach the network through users’ web-facing machines. That’s why a lot of the security tools companies use are focused on blocking those web-based security threats.

However, the Internet isn’t the only place malware can come from. In fact, among the companies surveyed by Bit9 who had been stung by a malware attack, 25% said the threat got onto the network from a USB device that a user plugged into a PC.

Those USB-based attacks are becoming more common, according to a report released earlier this year by McAfee.

Often, problems occur when employees use free USB drives they receive as promotional items — or when they use lost drives they pick up from the street.

Some of the steps being considered by IT staffs everywhere (including me) to help keep malware from moving off of a USB drive onto the company’s network:

• Disable USB ports for users who don’t need them
• Disable auto-play for USB drives
• Require storage devices to be approved by IT before they’re used, and
• Train users not to use drives if they don’t know where they came from, and not to open unknown files contained on drives.

2. Attacks against remote users

Many companies rely on perimeter defenses designed to keep threats away from the internal network.
But as more work is being done remotely on laptops, smartphones and other devices, that means a lot of endpoints aren’t being protected.

According to Bit9′s report, 17% of malware infections occurred while an employee was using a device outside of the company’s network. Another 8% of respondents said an attack originated from an employee’s mobile phone.

Those attacks might give hackers access to sensitive data stored on the remote device, and the malware may spread once the employee returns to office and connects the device to the network.
What it means for IT: It’s important to make sure that all of the devices employees use are being protected regardless of their physical location. That includes both company-issued and employee-owned devices.

3. Malware antivirus programs can’t catch

Close to half (40%) of the companies surveyed that had been hit with malware attacks said the threats simply bypassed the antivirus systems the organization was using.

Recent tests have found that antivirus software is unable to detect many of the threats out there. The main issue is that those programs rely mostly on malware signatures for detection — that means a virus has to be labeled as dangerous before the software will be able to catch it.

Even when virus definition files are updated, there’s typically a lag between when a threat appears and when those signatures are created.

On top of that, cyber criminals are turning more toward sophisticated methods to avoid detection, such as creating specific malware meant to target a single organization.

As I always say, "never ever click on links that your are not familiar with and do not download attachments unless your are 100% sure of where it came from!

Hackers Gone Smishing

Many users are finally getting wise to the typical email hoaxes and probably as a result of this hackers are beginning to try a new angle to make our lives miserable.

Text Message Spam


This SMS phishing - dubbed smishing, because everything needs a clever name - will often claim to be from banks, or cell network carriers.

The typical smartphone can access a lot of sensitive company & personal information. Here are some points to be aware of in order to stay safe:

1. Watch for numbers. These texts will often come from "5000" or other non-cellphone numbers.

2. Never Reply. Banks or cellphone companies have plenty of ways to get in touch with you. They will not text!

3. Report It. Forward suspicious messages to "7726" (SPAM). This lets carriers know to block the number.

Just like email do not respond to unsolicited messages, unless you can verify the validity of the messenger!

Watch Out For That Fake Expedia Email

It looks like cybercriminals have found an efficient new way to trick you into downloading their malware. These cybercriminals are now also using fake email pretending to be from the travel booking website Expedia.com.

This new phishing scam tries to get people to install malware onto their computers by hiding it in an email that claims to contain an itinerary for a recently booked travel plan.

The email does a pretty good job of looking legitimate, even using the Expedia logo and color scheme. However, the email address does not use Expedia's official site, which is  expedia.com.au.

The file attached to the email is a .zip, a type of archive file that bundles together several smaller files. If users download that file and "unzip" it to view its contents, they'll see a file that looks like a PDF, that is, like it has the file extension .pdf. But the ".pdf" is just part of the file's name — with the actual extension, it looks something like itinerary.pdf.exe.

This is a fairly old and insidiously simple trick; because periods are allowed in file names, it's easy to name a file so that it looks at first glance like it has a different file extension. Executable files are programs that run on your computer, and most malware programs come as .exe files.

Actual "Expedia" Malware Email

Once downloaded, the malicious program that was attached to the fake Expedia email searches for and gathers confidential information stored on the infected computer; the malware then connects that computer to a remote server operated by the cybercriminals.

This type of server, called a "command-and-control server," can then send commands to the infected computer via the malware program, and even install more malware onto the machine.

In using Expedia as the hook to get people to read the email and download the malware, the criminals aren't just targeting travelers. If you saw an Expedia email, but you hadn't booked a flight, you might think someone had stolen your credit card data, and you might click on the email to try to figure out what was happening.

Malware scams disguised as itineraries are fairly common, and similar attempts have circulated in recent years, with hackers masquerading as companies like Jetstar, Delta Airlines, American Airlines and more.

You can learn more about this new malware threat at Expedia's website.