Ransomware

On Tuesday, computers in government offices in Bharuch, Amreli, Patan, Ahmedabad and Anand districts of Gujarat were found infected with ransomware. The virus affected various departments and agencies that included the police stations, anti-corruption bureau network, collector offices, registrar offices, regional transport offices and civil hospitals in Gandhinagar and Godhara forcing the Gujarat state authorities to start upgrading their systems and networks.

In Kerala, staff in far-flung village offices in Wayanad, Pathanamthitta, Kollam and Thrissur districts told the police that they opened their internet-linked workstations after the weekend to find them infected. At the Tirumala Tirupati Devasthanams, 20 workstations assigned for normal office work and running on Windows 7 and XP operating systems were infected by the virus and were immediately isolated from the network.

There were reports that Nissan’s Chennai Plant has been affected, but thankfully there was no major impact on business.

Globally the ransomware attack has claimed 200000 victims so far in more than 150 countries. Some reports suggested that the Ransomware attack was carried out by a tool stole from the National Security Agency (NSA) of the United States, which was then dumped online by a group called the Shadow Brokers.

So what exactly is a Ransomware? How does it spread, why it is creating a menace in India and what can be done to prevent this? Ransomware attacks are not new, but the one which has come to light recently is because of its large scale. Ransomware is basically a form of malicious software that locks up your system, encrypts the files on your computer and demands that you pay to decrypt your files. The recent attack has been of the same nature, Wanna Decryptor or Wanna Cry ransomware affects outdated Microsoft’s Windows operating system. Cyber attackers who unleashed it used this gap in the system to gain remote access to the user’s system and locked them out of their files.

When the system is infected, a popup window appears that prompts you to pay a certain amount of money to get your files back in 3 days, according to some sources, the amount starts from $300 and if you fail to make the payment within 3 days the amount goes up or is doubled. And if you fail to pay within 7 days your files are gone forever. Ransomware demands payment in Bitcoins which obviously are tougher to trace than normal currency to decrypt the files.

Reports have suggested that this ransomware, Wanna Cry spreads when it encounters an outdated and unpatched software. Wanna cry spreads through an internet worm – a malicious software that hacks into the user’s computer on a network and makes multiple copies of itself.

The answer to why it is creating a menace in India is simple, Indian systems are running on the outdated version on Microsoft’s windows usually Windows 7 or XP. While the Information Technology Minister Ravi Shankar Prasad said that these are “isolated incidents” and denied the knowledge of banking system being affected, there have been rumours that ATMs have been affected and ATMs in remote areas are shut to upgrade their operating system. This can be understood as most ATMs in India are still working on Windows XP. Though Microsoft released a patch to remove the gaps in the system, it might be a possibility that the software patch wasn’t updated in some of the government institutions which created a chink in the armour. Microsoft’s President and Chief Legal Officer, Brad Smith said that government should consider it “a wake-up call” and criticised the government that hoarding such vulnerabilities have affected civilians.

How can you prevent your system from being attacked by a ransomware? The best way is to create regular backups of important files, whether on the cloud or on a separate hard drive. As the malware only affects the files on the system, your backup will be completely safe. If you have created a thorough backup of your system, you can restore your files from the backup and you are done. Other precautionary measures include updating your operating system and anti-virus software regularly, enabling a popup blocker and avoid downloading or running suspicious software on your system.

Here are some simple steps suggested by cyber-security firm Symantec to escape a ransomware attack

Always keep your security software up to date as new ransomware variants appear on a regular basis
Software updates will frequently include patches for newly discovered security vulnerabilities so keep operating system and other software updated.
Email is one of the main infection methods. Be wary of unexpected emails especially if they contain links and/or attachments.
Be extremely wary of any Microsoft Office email attachment that advises you to enable macros to view its content. Unless you are absolutely sure that this is a genuine email from a trusted source, do not enable macros and instead immediately delete the email.
Backing up important data is the single most effective way of combating ransomware infection. Back-ups should be appropriately protected or stored off-line so that attackers can’t delete them.
Using cloud services could help mitigate ransomware infection, since many retain previous versions of files, allowing you to “roll back” to the unencrypted form.

Here’s a more technical list of dos and don’ts from the Indian Computer Emergency Response Team (Cert-In)

Best practices to prevent ransomware attacks:

Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, this data should be kept on a separate device, and backups should be stored offline.
Establish a Sender Policy Framework (SPF),Domain Message Authentication Reporting and Conformance (DMARC), and DomainKeys Identified Mail (DKIM) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
Don’t open attachments in unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization’s website directly through browser
Restrict execution of powershell /WSCRIPT in enterprise environment Ensure installation and use of the latest version (currently v5.0) of PowerShell, with enhanced logging enabled. script block logging, and transcription enabled. Send the associated logs to a centralized log repository for monitoring and analysis.
Application whitelisting/Strict implementation of Software Restriction Policies (SRP) to block binaries running from %APPDATA%, %PROGRAMDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations. Enforce application whitelisting on all endpoint workstations.
Deploy web and email filters on the network. Configure these devices to scan for known bad domains, sources, and addresses; block these before receiving and downloading messages. Scan all emails, attachments, and downloads both on the host and at the mail gateway with a reputable antivirus solution.
Disable macros in Microsoft Office products. Some Office products allow for the disabling of macros that originate from outside of an organization and can provide a hybrid approach when the organization depends on the legitimate use of macros. For Windows, specific settings can block macros originating from the Internet from running.
Configure access controls including file, directory, and network share permissions with least privilege in mind. If a user only needs to read specific files, they should not have write access to those files, directories, or shares.
Maintain updated Antivirus software on all systems
Consider installing Enhanced Mitigation Experience Toolkit, or similar host-level anti-exploitation tools.
Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
Regularly check the contents of backup files of databases for any unauthorized encrypted contents of data records or external elements, (backdoors /malicious scripts.)
Keep the operating system third party applications (MS office, browsers, browser Plugins) up-to-date with the latest patches.
Follow safe practices when browsing the web. Ensure the web browsers are secured enough with appropriate content controls.
Network segmentation and segregation into security zones – help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks.
Disable remote Desktop Connections, employ least-privileged accounts.
Ensure integrity of the codes /scripts being used in database, authentication and sensitive systems, Check regularly for the integrity of the information stored in the databases.
Restrict users’ abilities (permissions) to install and run unwanted software applications.
Enable personal firewalls on workstations.
Implement strict External Device (USB drive) usage policy.
Employ data-at-rest and data-in-transit encryption.
Carry out vulnerability Assessment and Penetration Testing (VAPT) and information security audit of critical networks/systems, especially database servers from CERT-IN empaneled auditors. Repeat audits at regular intervals.
Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee files will be released. Report such instances of fraud to CERT-In and Law Enforcement agencies

This attack has exposed the lack of cyber security measure among government and private institutions. India is going through a digital revolution and such attacks will create an environment where people might feel insecure to use digital means of transaction, which the government pressed on heavily since last year’s demonetisation drive. Events like this will once again start the debate on how secure is your Aadhar Information from any future cyber attacks. The Recent cyber attack has shown that small vulnerabilities in the cyber security can have massive implications. It has also presented an opportunity before the governments around the world to push for global cooperation and global laws.