A computer scam making the rounds could cost you hundreds of dollars or the ability to access your most precious pictures and sensitive files.
It”s called ransomware. It”s a type of malware that locks up computers or computer files and won”t allow users to access them unless they pay up.
“It”s heartbreaking,” said Jeremy Buschine, the director of IT service and repair at ClickAway, a chain of computer repair shops headquartered in Campbell. “It”s about as close to cyberterrorism as I”ve ever seen.”
Ransomware works like other types of malware. It”s malicious software that typically gets onto users” computers when they open email attachments that have it embedded, visit infected Web pages or download certain software. But unlike those other types of malware, ransomware uses encryption to scramble users” files. While they might be able to delete the ransomware after their machine”s been infected, they often can”t unscramble their data without the hackers” help.
Ransomware”s been around for a while — the first prototype was described in the 1990s, according to security researchers — but it”s become a huge problem in just the last six months. Security researchers have noted a huge uptick in the number of actual and attempted infections and in the types of ransomware circulating in the wild.
“Beginning this year, it really became an epidemic,” said Ryan Naraine, head of the global research and analysis team at Kaspersky Lab, a security software company.
In recent months, hospitals, schools, and even police offices have been hit with ransomware. In February, for example, Hollywood Presbyterian Medical Center in Los Angeles acknowledged that it paid cybercriminals $17,000 to unlock its computers after they were infected with ransomware.
But individuals as well as institutions are being affected. Helen Tindall, a retired county worker who lives in San Jose, recently had a computer get hit with a primitive form of ransomware. Tindall, 75, allowed someone purporting to be a “Microsoft-certified technician” who reached her by phone to have remote access to her computer to supposedly fix the problems he said were coming from it. But instead of fixing any problems, the so-called technician installed software that flashed a message warning of other problems and gave a 1-800 number to call. When Tindall called the number, the helpful people who answered demanded $400 to remove the malicious software they had installed on her machine.
Fortunately for Tindall, the malware the hackers installed on her computer didn”t encrypt her files, which included some art photographs she had taken. She was able to take her computer to an actual technician at the Good Guys, Best Buy”s in-house repair service, who was able to recover her files and delete the malware from her machine. But the ordeal cost her around $200 and a lot of stress.
“I couldn”t go to sleep,” she said.
Others aren”t so lucky. A local attorney who is a client of the Cheap Squad, a small computer repair shop in downtown San Jose, recently had his work computers with his case files on them infected with ransomware. Feeling like he didn”t have a choice, the attorney paid the $500 ransom to get the key to unlock his files. But the key only unlocked the files for a limited time, which wasn”t long enough for the attorney to recover them all. He ended up paying another $500 to get more time to transfer them.
Not that long ago, the Cheap Squad would only see about one case of ransomware every three months, said owner Jeremy Prader. Now, though, the shop is seeing about two cases every week.
“It”s definitely jumped up a lot,” Prader said. “And it”s only going get worse.”
Cybercriminals are glomming on to ransomware, because it often works and it makes them money, security experts say. And it”s been boosted by two technical advances. In late 2013CyptoLocker, a malware tool that encrypts the files of infected computers, started circulating. More recently, criminals have begun selling ransomware software on the so-called Dark Web, allowing even those without a technical background to get into the cyber ransom game.
Windows users are the most at risk; the vast majority of ransomware is targets PCs. But users of other devices aren”t immune. Researchers have seen ransomware circulating on the Internet that targets Mac computers and Android smartphones and tablets.
Because there”s often no way to treat a ransomware-infected computer, the best way to defend yourself is to practice basic computer hygiene, including running anti-virus software, keeping that and other software on your computer up-to-date and making frequent backups of your data to a drive or service that is typically disconnected from your machine.
That last bit is important, because the latest versions of ransomware can infect not just your main hard drive, but any external drives that are attached and online storage services like Dropbox that appear to be external folders or drives.
“A backup solves all sorts of ills,” said Bruce Schneier, chief technology officer at Resilient Systems, an IBM-owned security company. “You can save lot money by building a better system before you”re infected.”
Mercury News research
What to do if your computer is infected
If you get ransomware on your computer, the easiest thing to do is simply to wipe it clean and restore from a backup. If you don”t have a recent backup, the situation can be more difficult, but you may not be completely out of luck. Here”s what to do:
1. Disconnect your computer. Some ransomware can”t encrypt your files without an Internet connection. In some cases, if you detect the infection early enough, you can minimize the damage by taking your PC offline.
2. Determine the scope of the infection. Try opening your files. Assuming you were able to stop the infection in time, the ransomware may not have had time to compromise your most important ones. If you can live without the ones that were compromised, backup what”s left and either run anti-virus to clear the infection or wipe your computer.
3. Look for a countermeasure. In some cases, researchers have developed tools that can be used to decrypt files that have been scrambled by ransomware, making them accessible again to users. To figure out if such decryption software can help you, you first need to determine the type of ransomware that”s infected your machine. In some cases, the malware will identify itself to users. In other cases, users can figure out which infection they”ve got by examining their affected files, looking at the extensions the ransomware has attached to them. In still other cases, they might be able to do an search on Google, looking for the warning screen the ransomware has attached. Once you”ve figured out the type, you can search for a deception solution.
4. Consult with a computer technician or repair shop. In some cases, a technician may be able to help you recover your files, particularly if the malware attack is relatively unsophisticated.
5. Pay the ransom. This should be your last resort. The FBI advises against it, as do security researchers, warning that it only encourages criminals. And there”s no guarantee if you pay the ransom that the hackers will give you either the key needed or sufficient time to recover all your files. But if you can”t get access to your files any other way and your business depends on them or they include irreplaceable items, like the first video of your kid walking, you may have no other choice.
Mercury News research