Upload File

how to take the ransom out of ransomware

35
© 2016 Unitrends 1 Uni* r Take the Ransom Out of Ransomware

Upload: marketingunitrends

Post on 12-Jan-2017

56 views

Category:

Technology


3 download

Report

TRANSCRIPT

Page 1: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 1Uni*

r

Take the Ransom Out of Ransomware

Page 2: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 2

Page 3: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 3

"To be honest, we often advise people just to pay the ransom."  Joseph Bonavolonta, Asst. Special Agent, FBI Cybercrime Boston Division

Page 4: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 4

What is Ransomware?

Page 5: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 5

Encrypts victims files with strong unbreakable encryption

Demands payment for private key to unlock data

Payment typically around $200 to $500 in bitcoins

Ransomware Malware

Page 6: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 6

Ransomware is not new

Recent advances have made it a much larger risk

Early ransomware was “scareware” and “nagware” Didn’t permanently lock files. Was easily removed or avoided Criminals had difficulty in collecting fees anonymously Hacker community not as organized

Long History of Ransomware

Page 7: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 7

A Growing Menace

Page 8: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 8

Cryptolocker TorrentLocker CryptoWall CBT-Locker TeslaCrypt Locky Etc.

Many Variations and Copycats

Page 9: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 9

Popular Tools of Ransomware Variants

Anonymity Online

Electronic Payment

Unbreakable Encryption• AES• RSA• “Curve” ECC

Network to C&C Server• Tor• I2P• POST/HTTPS• Hardcoded URLs

Page 10: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 10

Requires both Public and Private Key

Page 11: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 11

Spam Email Campaigns CBT Locker & Torrent Locker

preferred vector Requires interaction from

user Can affect fully patched

systems

Exploit Kits CryptoWall and TelsaCrypt

preferred vector Does not require any

interaction Uses vulnerable installed

software

Infection Vectors

BOTH ARE HIGHLY EFFECTIVE WAYS INTO YOUR SYSTEMS

Page 12: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 12

Get 1 Free Macs vulnerable

Voice Enabled

Highly Localized

Ransomware Continuing to Advance

Page 13: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 13

How does an enterprise make sure they never have to pay?

Page 14: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 14

Play Defense Play OffenseDon’t forget about your backup players

Page 15: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 15

Keep software up to date Use virus detection and antivirus prevention Educated users on security protocols such

Avoid clicking untrusted emails and attachments

Watch out for obvious and not so obvious file extensions

Offense: Start With Basic Protection

Page 16: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 16

Disable Active-X content in Microsoft offices apps Have firewalls block Tor, I2P and restrict ports

Block active ransomware variants from calling home to encryption key servers

Block binaries from running from popular ransomware installation paths (e.g. %TEMP%)

Defense: Be Proactive with counter-measures

Page 17: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 17

Backups are Crucial

Page 18: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 18

Real World Examples

Page 19: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 19

3 copies of your data

2 different types of media

1 copy off-site

Start With The Rule of Three

Page 20: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 20

Backup all data on all systems – not just critical data Replication and Continuous Data Protection is great for low

RTO/RPO but can backup the malware with your data Create archives that are physically isolated from your production

systems You can use the archive to go back in time if necessary

Create “bare metal” images of core systems so you can get back to a known systems state quickly

Setup DR Services so you can spin up new VMs for critical systems while you recover your local production systems

Prepare NOW! Don’t wait until it too late!

Backup Best Practices: Make Sure You Never Pay

Page 21: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 21

Local On Premise or

Physical Appliance

2nd Site

Public & Private Cloud

Local backup for fast recovery Archiving to Cloud offsite Fully automated Can be isolated

Cloud Can Help

Page 22: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 22

Instant Recovery Capabilities Be able to spin up workloads from backups in minutes while

productions is cleaned

Ability to protect Windows, Windows Server, Apple Macs, etc.

Linux based backup software – not Windows based Make sure your backups don’t get encrypted too!

Differentiating Feature Of Backup Solution Against Ransomware

Page 23: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 23Unitrends cloud-empowered all-in-one continuity solutions increase your IT confidence

Keep Your Business Running With Unitrends

Page 24: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 24

Re-imagine Recovery for your digital world

Unitrends Connected Continuity Platform™ brings together the industry’s leading portfolio of cloud-empowered continuity services in a single, super intuitive platform that gives you unmatched flexibility as your business needs evolve.

Discover the power of the platform to capitalize on the potential of cloud, reduce your overall spend on IT and gain total confidence in the recovery point to come.

Page 25: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 25Unitrends cloud-empowered all-in-one continuity solutions increase your IT confidence

Page 26: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 26

Protect Everything You Have

Everywhere You Need ContinuityGuaranteed Recovery and Continuity

Within a Single Intuitive Platform

Unitrends Connected Continuity Platform

Page 27: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 27

Protect Everything You Have

Protect your ideas/businessProtect Your Ideas/Business

Page 28: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 28

Everywhere you need continuity

Local On Premise or

Physical Appliance Virtual Appliance

/ Software

2nd SitePublic & Private Cloud

Page 29: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 29

Recovery Assurance allows you to have absolute certainty in your recovery

Usable in your local environment, your DR site, or the Unitrends Cloud

Fully automated, flexible application-aware testing Recover confidently from Certified Recovery Points

Guaranteed Recovery via Recover Assurance

Recovery Assurance

Page 30: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 30

Incredible Easy to Use UI and Automated Reports

Page 31: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 31

Transforming Continuity

On Premise All-In-One Data Protection• Deploy as a virtual or physical backup appliance• Adaptive inline deduplication (20 to 1 ratio)• Instant Recovery Options for VMs and windows • Built-in real-time replication engine

DRaaSSpinup critical workloads in less than 1 hour

Forever CloudBest value for cloud storage & long term retentionRecovery Assurance

• Automated Backup & DR failover testing

• Assured recovery in the cloud & on premise

Page 32: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 32

Scalable and Flexible Industry’s #1 hybrid cloud

solution Deployment options to fit

any environment All-in-one software that

runs on your hardware

Recovery Assurance Automated testing of

backup and DR 100% confidence in the

recovery point to come RPO/RTO Actual

reporting

Intuitive UI One simple

interface Real time alerts

and reporting Enterprise

management

What Makes Unitrends Unique

Page 33: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 33

About Unitrends

15,000+ customers globally8,000+ registered partners globallyEBs of data protected30PB+ of Cloud Data ManagedIndustry leading 98% Customer Satisfaction

Worldwide HQ: Burlington, MAInternational HQ: London, UK

Global Datacenter PresenceUSA (multiple), Canada, U.K., Germany, Australia

Canada

USA (Multiple)

UKGermanyMadrid

Sydney

Page 34: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 34

Unitrends is Redefining Recovery For Your Digital WorldHow can we help you protect what matters most to you?

Are you ready to never worry about

recovery again?

Can you imagine not spending time on

“backup”?

Page 35: How to Take the Ransom Out of Ransomware

© 2016 Unitrends 35

Try Us Out – Visit www.Unitrends.com

Unitrends Enterprise

BackupGet a free trial

7 New Rules of Recovery

Download now

http://www.unitrends.com/
http://www.unitrends.com/products/download/ueb
http://pages.unitrends.com/new-rules-of-recovery-ebook
https://plus.google.com/+Unitrends/posts
https://www.facebook.com/unitrends
https://www.linkedin.com/company/25406?trk=vsrp_companies_res_name&trkInfo=VSRPsearchId:167744091433949382256,VSRPtargetId:25406,VSRPcmpt:primary
https://twitter.com/Unitrends

Update on Ransomware Technology · Example 1 Example 2 Beware of attachments! Beware of sender & links! Update on Ransomware Technology Sample Ransom Demand. Whaling Emails Enter

Holding healthcare to ransom - Marsh & McLennan …...of healthcare customers’ businesses was $68 million EB 2017 MAY 2017 Hospitals globally were hit by the global ransomware attack

PREVENT Don’t Reactstatic.us.zyxel.com/landing_page/2017/ransomware/Ransomware_Inf… · paid in ransom by companies in Q1 $209 Million NEW families of ransomware 62 ransomware

FIGHTING RANSOMWARE · Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in

VARONIS WHITEPAPER: Ransomware Guide · Ransomware Guide Overview Ransomware – malware that encrypts a victim’s data, extorting a ransom to be paid within a short time frame or

THE STATE OF RANSOMWARE 2020...(473 of the 496 organizations that paid the ransom). When it comes to paying the ransom, we see some noticeable regional variations. In India two out

RESISTING RANSOMWARE: Strategies to protect your …ransomware attacks said their companies paid that ransom, and 20% of them paid more than $40,000. Due to the relatively low entry

THE NEW CYBER THREAT AND HOW TO STOP IT · OTHER TYPES OF RANSOMWARE OCKER ALL Backup 12.5 REVETON OCKER TYPICAL RANSOM AMOUNTS $500-1000 IN RANSOMWARE VIA SOCIAL MEDIA 650% INCREASE

protection test against ransom ware threats test against ransom ware threats October 2016 RANSOMWARE Date of the test: October 2016 An objective of the test conducted by AVLab in October

Ransomware: Past, Present, and Future - Trend Micro · PDF file6 | Ransomware: Past, Present, and Future Ransom notes evolved as well. All forms of intimidation have been used, including

Ransomware in Healthcare - ClearDATA...Anatomy of an Attack • Critical choices: - Pay ransom - Restore from backup • Paying ransom increases risk of future attacks 1 The Bait •

Nelson Mandela - PUCP · 2016-08-08 · Cómo prever un cibersecuestro de datos Cerber es el último ransomware (del inglés ransom, ‘rescate’, y ware, por software) detectado

HELD FOR RANSOM - SecTor 2018 · What is Ransomware? • Windows ransomware, such as Cryptolocker, Cryptowall, Locky, and Samas, does not bother to steal your critical files (Office

ShieldFS: The Last Word In Ransomware Resilient Filesystems · Ransomware [20] is a class of malware that encrypts valuable files found on the victim’s machine and asks for a ransom

RANSOMWARE: A RISING THREAT....Ransomware is a type of malicious program that encrypts files on a victim’s computer, blocking the access to the contents of the device until a ransom

Proofpoint Ransomware Survival Guide · According to the FBI, ransomware attackers collected more than $209 million in ransom during the first three months of 2016 alone, with the

Carbon Black Threat Report: Non-Malware Attacks and Ransomware Take Center Stage in 2016

Know your threats series · better understand ransomware and the steps you can take to defeat it. Know your threats series: Ransomware uncovered 5 Whitepaper A typical ransomware

Fraud Mitigation Strategies for Business · •Ransomware •Email Account Ransom •Webcam Image Extortion. Ransomware 14 Ransomware is a form of malware that restricts the target

WANNACRY RANSOMWARE ANALYSIS...If a system becomes infected with the WannaCry ransomware, it is best to try to restore files from backup rather than paying the ransom, as there is

Ransomware - peakresources.com...•Ransomware is Malware -Malicious software that encrypts and holds data/systems hostage for a ransom payment. •Organizations will use Bitcoin or

Over Peover Online How to…. · Ransomware One special type of virus is named Ransomware because, as its name suggests, it locks the computer completely and extorts a ransom to unlock

protection test against ransom ware threats · Nowadays, ransomware threats have gained a new name: crypto-ransomware. These viruses encrypt specific types of files, and then display

Heat Software Cloudsec 2016€¦ · Ransomware is a type of malware that holds to ransom an infected computer system in some way, and demands that the user pay a monetary ransom to

The Complete Ransomware Recovery Guide › wp-content › uploads › 2020 › 06 › ransom... · No matter which backup and recovery tool you use, having this snapshot should be

Panduan Penanganan Insiden Ransom · 2020. 11. 11. · Panduan Penanganan Insiden Ransomware 1 Badan Siber dan Sandi Negara PENDAHULUAN Ransomware merupakan jenis malicious software

Next Generation Security - HIMSS Chapter · HealthCare – Ransomware attacks 5 Attackers ask $3.6 million ransom - Hospital’s network down for more than a week - Systems for CT

Tech Demo: Take the Ransom Out of Ransomware

Ransomware Trends 2021 - HHS · “Ransomware attackers are by definition liars, thieves, extortionists and members of a global criminal enterprise, and they take extreme technological

AIT 681 Secure Software Engineering · 2020-01-29 · Ransomware downtime average downtime is 16.2 days Ransom payments Bitcoin Common types of ransomware ... industries Professional

RANSOMWARE PREVENTION ADVISORY - AKS IT Services IT_Ransomware Preventio… · Ransomware is a form of malware that encrypts a victim's files. The attacker then demands a ransom from

Avaddon Ransomware · The ransomware also creates a file containing the ransom note in every directory it encrypts, named [0-9]+-readme.html. The ransom message directs the users

A King’s Ransom for Encryption Ransomware Classification ...classify new variants if the model is simply retrained or fine-tuned using a single training image. Consequently, our

Cyber Ransom Survival Guide - ITWebv2.itweb.co.za/whitepaper/Radware_Cyber_Ransom_eBook.pdfRansomware-as-a-Service New types of ransomware are cropping up quickly—taxing antivirus

Threat Intelligence Report - assets1.dxc.technology · August 2019 Threat updates Ransom demands nearly double in second quarter The average payment demand related to a ransomware