Ransomware attacks are growing in popularity with hackers as they extort both users and companies out of millions of dollars every year. Each year, the damages becoming worse as the numbers rise.
Typically, ransomware involves code that will attempt to hijack a computer or network that holds its contents hostage in exchange for payment to the hacker that created or owns the code. It will usually encrypt or simply hide the content (pretending to encrypt it), locking users out from accessing it. In some cases, it might even leak the information to another server/source so the attacker can threaten to leak the information to the world if payment isn’t received.
Sadly, in most of these cases, the situation can usually be easily avoided. Not every hack involves someone on the other side of the world hammering away at their keyboard trying to find a backdoor to your network. In most cases, the damage comes from something as simple as clicking the wrong link. A link that either comes in via email or via a suspicious website, leading to a payload package that gets the ball rolling.
So the process of protecting yourself (both personally or if you have a business) is going to sound quite familiar as the most important points of defense are the same as they have always been.
1. Antivirus
Always make sure you have a good antivirus loaded that will help protect you from known ransomware attacks. The antivirus has to specifically state that it is strong in this area, else it may not be looking for much more than viruses. Thankfully, most of the popular antivirus solutions are a bit of an all-in-one these days, looking for viruses, ransomware, adware, malware, and more.
Windows 10 has Defender built-in, which does a decent job of acting as your antivirus. It also helps to keep you from having to download some of these clunky 3rd party antivirus programs. However, it isn’t exactly the best at ransomware. Microsoft is working on improving the built-in protections within Windows that can help protect the operating system from ransomware attacks, but for now, 3rd-party solutions might be your best bet (ie, Norton, McAfee, Avast, AVG, etc).
No matter what, you should always make sure you have a good defense going to protect you from the bad people that exist in this world. People who have nothing better to do than to harm others for their own sadistic kicks and for the act of thievery.
2. Educate Yourself
This is one of the most important defenses that anyone could have. So many attacks could be prevented with basic education and the use of common sense. Common sense can go a long way, but it doesn’t exist unless you are educated to know where to apply it and why you are applying it. Thankfully, the required education is quite simple.
- Emails: Pay attention to every email you receive. Look for suspicious variables within that email. We’ll include a few examples here…
- Example — If the email appears to have come from “Microsoft Support” but the from field shows it came from dingleberry01@somewebsite.com, it’s probably an attempt to phish information from you or to get you to click on something (like an attachment) that you shouldn’t be clicking on.
- Example — If you get an email from a friend or family member that sounds “odd”, that asks you to open an attachment to verify the information you never discussed beforehand, it is absolutely a smart idea to contact that person first to make sure the email is legit. Someone could have gotten into their email with malware that is sending copies of itself to everyone in their contacts.
- Suspicious Websites: Pay close attention to the URLs you type when going to a website. Or the websites that you may be led to. There are many websites out there that are dressed up to look like something else (ie, like a popular bank or retailer). Usually, these are created to lower your defenses so that you might try to log in with your credentials (which they will now record and have access to) or offer personal information. All because they “look” like the real thing.
- To protect yourself from these websites, make sure to acknowledge the address in the URL bar at the top of your browser. If you are going to Amazon, make sure it says Amazon.com and not Amaz0n.com. If you are going to Wells Fargo’s website, make sure the URL bar shows wellsfargo,com, and not something else. The process is easy and it will burn into your mind as a basic reflex as you practice this.
- Suspicious Links: This one leads back to the previous two when it comes to websites and emails. Instead of attachments, you may find yourself presented with a link (or links) that sound suspicious. One of the quickest ways to identify a bad link is to hover over it. Usually, when you hover over a link within your browser or email application, it will either pop up a small info box with details of the link (like what the address is), or it will display it at the lower left of your screen somewhere. You can see this occurring in the following screenshot, where we hover over a link and the address for that link pops up at the lower-left of the screen.
.
So clearly, if you are presented with a link for Wells Fargo, but when you hover over the link, the address it is really trying to send you to shows something completely different like “www.ThisIsWells2d5.com/ClickHere_VeryImportant”, then it might be a spoofed email, website, or post that is looking to steal something from you or send you somewhere where malware, ransomware, or adware might try to download to your system.
.
Given, with short links like bit.ly and other in-house short link systems that companies like Amazon use, this is getting more difficult to predict. Many of these websites and companies make use of short link engines to minimize the use of incredibly long links, as well as a means to track using in-house or third-party programs (gathering analytics about the link). For example, here on Poc Network, we use affiliate links frequently when referring traffic to websites like Amazon.com. Now, if you hover over the link we just provided in the last sentence for Amazon, you’ll see it makes use of a short link using Amazon’s short link engine. That link is actually 100% legit and sends you to the Xbox Series X product page. We also use in-house links that redirect you to a proper source, as you can find in the next section below pointing to two popular backup applications–this simply makes it easier for our staff to update all copies of a link (site-wide) by only updating a single internal link. However, it prevents you from scanning it with a hover of your mouse ahead of time sadly.
.
So it isn’t always obvious anymore as more entities make use of short links, internal redirect links, and third-party redirects to track and forward traffic. However, suspicious links can still stand out like a sore thumb when you get an odd email and it shows the link as “www.ThisIsWells2d5.com/download.zip”. So try to train yourself to look for suspicious URLs within links that come your way (where possible).
3. Backups
Always back your data up frequently. Use software from companies like Acronis or EaseUS to automatically back your information to an external drive every day or every week. This way if there is any situation of data loss (let it be due to hardware failures or ransomware attacks), you should be able to quickly restore your files as needed and move on.
This is one of your best protections and it is even more efficient if you are backing this data off-site or offline. There are cloud-based solutions out there that allow you to back your data into the cloud so if anything massively affects your system(s) locally, your off-site data is completely isolated and protected. Of course, cloud-based services are expensive, so these options are more for businesses and professionals than they are the typical consumer.
Most ransomware attacks will go after your OS drive (the main drive Windows is located on, or whatever/other OS you are using). In these situations, your external drive may be a safe place to back up to and remain connected. However, if you want be serious about your backups (in scenarios where you can’t afford to lose your data), you will have to manually connect the drive for each backup and then disconnect it and store it separately (“offline”) so that it isn’t accessible when you aren’t actively in a backup. That way, if you are hit with an attack, the information is safe and waiting for restoration.
Never pay…
This is a tricky one. It isn’t a step in protecting yourself, but it is something to consider if you are hit by a ransomware attack. If an attacker reaches out or the attack features a message on how to reach out to the attacker, demanding that you send them money or bitcoin; do not do it. Hard-format the drive and walk away from it all.
Hopefully, you have backed your data up as mentioned before and you can just restore it. Depending on how you backed it up (individual files or a full image of your drive), you may have to reinstall your OS, but either way, your files should be safe (if you backed the data up).
The big picture here is that you shouldn’t support the cause of these attackers. If everyone stops paying them, their cause will no longer be supported and they will move on to other forms of causing havoc on the internet. Clearly, it isn’t a solve-all solution since the attackers are not caught and incarcerated, but at least your money and dignity are safe. Individuals need to stop supporting the bad guy’s efforts.
This is harder for companies since a company typically stores sensitive information on its networks in one form or another. However, these companies also have a firm responsibility of storing this information responsibly in a manner that is kept up to date with modern techniques. So if the companies systems/network is breached, the information should either be inaccessible or unreadable. This way, even if the information is stolen by the attacker, there is nothing they can leak that affects the privacy of its customers or the company itself. Given, we all know that most companies do not spend the time or money to do this sadly (it’s all about cutting corners and saving a penny every chance they can get).
For these companies where risk is higher, keeping a proper backup of all of the data is absolutely imperative. So if a situation were to occur, they could isolate the systems affected by the attack or restore the entire network ASAP. They should get law enforcement involved since local and federal agencies will likely jump to attention (where they likely wouldn’t bat an eye for any “one” consumer as it would cost them too many resources sadly).
It’s easier said than done, we know. However, if everyone stops paying the ransom (and companies properly encrypt their data internally), this will send a strong message to would-be attackers.
Header Image: Photo by Andrea Piacquadio from Pexels
