[Cryptography] Ransomware: Newest viral marketing gimmick ?

[Henry Baker]

FYI --

There's an old joke about a man whose spouse's credit card had been stolen by identity thieves, but he didn't report it because the identity thieves racked up smaller monthly charges than his spouse did.  (rimshot!)

Perhaps OPM should utilize Chimera for encrypting government employee data, because:
* Chimera charges less than EMC; and
* Chimera implements better encryption than EMC.

http://arstechnica.com/security/2015/11/booming-crypto-ransomware-industry-employs-new-tricks-to-befuddle-victims/

Booming crypto ransomware industry employs new tricks to befuddle victims

High-pressure tactics try to extort more people into paying to recover their data.

by Dan Goodin - Nov 5, 2015 10:35 pm UTC

Ransomware that uses strong cryptography to hold entire hard drives' worth of data hostage keeps getting nastier, as criminals attempt to find new ways to extort more people into paying increasingly hefty ransoms to recover their files.

A case in point is Chimera, a relative newcomer to the crypto ransom racket that targets primarily businesses.  In an attempt to turn up the pressure on infected victims, the malware threatens to publish their pictures and other personal data somewhere on the Internet unless a ransom of $638 in bitcoins is paid.  There's no evidence yet that the new cryptoware title has made good on the threat to post victims' private data online, but it's a likely bet the prospect is enough to convince some undecided victims to go ahead and pay the fee.

The threat, according to a blog post published Tuesday, comes only after the cryptoware has encrypted data stored not only on local hard drives but also those on network drives.  To add drama to the attack, all file extensions are changed to .crypt.  Chimera is also programmed to target specific employees within an infected company, presumably to make sure the ransom demand doesn't get missed.

A second example of cryptoware turning up the pressure on victims is the latest version of CryptoWall, one of the early entrants in the industry.  The recently released CryptoWall 4.0 now replaces names of encrypted files with pseudo-randomly generated letters and numbers, presumably to further befuddle victims who are suddenly unable to access their data.  The new version appears to continue encrypting data with 2,048-bit RSA keys, which when implemented correctly are practically impossible to break.

That's not the only attention-grabbing ploy.  The notification the malware sends to deliver the news that victims' data has been encrypted congratulates them on becoming a part of the "large community CryptoWall."  Besides the snarky tone, the notice is also notable for its almost pristine grammar and spelling and its clarity in explaining how strong crypto works.

"Encryption is a reversible transformation of information in order to conceal it from unauthorized persons but providing at the same time access to it for authorized users," the notice reads, according to this blog post published by antivirus provider Bitdefender.  "To become an authorized user and make the process truly reversible i.e. to be able to decrypt your files you need to have a special private key.  In addition to the private key you need the decryption software with which you can decrypt your files and return everything in its place."

The notice goes on to warn users not to attempt to break the encryption lest the files be lost forever.  CryptoWall 4.0 also employs advanced mechanisms to avoid detection by antivirus and Firewall programs, according to researchers at Heimdal Security.

The refinements show that cryptoware purveyors operate much like other online businesses, which are constantly updating their products and services in an attempt to bring in new business.  That dedication only makes sense, given FBI estimates earlier this year that CryptoWall alone generated losses of more than $18 million.  A separate report estimated US damages of $325 million from CryptoWall 3.0.  That translates into huge profits, especially when considering the revenue is tax-free.

Now that crypto ransomware is a threat that won't be going away any time soon, there's been a fair amount of debate about whether victims should pay the ransom as demanded.  Recently, an FBI agent reportedly told businesses it may be easier for them to pony up.  The comments generated howls of protest among security professionals, who warned there's no guarantee the fees will ensure the encrypted data is restored.

The critics are right that there can be no certainty that the ransomware operators will make good on their promise.  And there's always the possibility a programming error or law enforcement takedown will allow keys to be recovered without paying the fee, as was the case last year with the CryptoLocker brand.  Then again, there are plenty of reports of victims with no other recourse who paid the ransom and recovered their files.  Ultimately, the decision should be made on a case-by-case basis.  No doubt, paying the increasingly large fees is a risk, and it only rewards truly pernicious and illegal behavior.  Then again, for people who have lost data valued in the thousands or hundreds of thousands of dollars, paying a $700 ransom may be worth the risk and cost, although the move shouldn't be taken lightly.