Bangkok--27 Jun--Core & Peak
Trend Micro: Ransomware, a continuation of phishing, is slowly becoming a threat to home users.
The internet world has recently been encountering more and more malware attacks motivated by profit. Internet security experts
Trend Micro explained that ‘ransomware’ is a continuation of ‘phishing,’ and is slowly becoming a greater threat to home computers.
Ransomware trap home users into schemes originally meant for large corporations. This change of targets has gradually altered the threat
landscape; these internet extorters have realized that although targeting ‘big fish’ can result in large profit, targeting home users or
small businesses present a much smaller risk of being caught.
The term ‘ransomware’ did not appear until May 2005 with the discovery of TROJ_PGPCODER.A, the first Trojan that utilized malware
encryption to blackmail users directly for money. This malware quietly sneaks onto systems and automatically initiates blackmailing by
encrypting certain files; unless the decoder is obtained and used, these files can no longer be read. The malware also leaves a text file
explaining how to decode the files. This was the start of a new trend in malware; antivirus experts dubbed this type of malware
‘ransomware,’ after blackmailers who demand ransom in exchange for stolen objects.
Since May 2005, ransomware has been synonymous with PGPCODER. However, this malware was followed by three variants in October,
TROJ_CRYZIP.A in March of this year, and the two newest member of the ransomware family, TROJ_RANSOM.A, which has taken over the
file-napping torch, with a message popping up on infected systems basically saying that the computer is locked and may only be unlocked when
the affected user pays this Trojan's author, and TROJ_ARHIVEUS.A which blackmailed the user into accessing and purchasing products from
several pharmaceutical Web sites in order to get the password to unlock the encrypted files.
BOTs Threaten Large Companies; Ransomware Threatens Small Companies and Individuals
Trend Micro explained that before the appearance of ransomware, online blackmail targeted large companies, mostly by BOT worms. These
authors would continually release numerous variants within a few months’ time, accumulating a shocking number of infected systems to form a
zombie network, which is in turn used to conduct distributed denial of service attacks.
After gaining this ability, the author would then blackmail corporations, threatening them with flood attacks on their websites if
they don’t pay a certain amount of money.
Many companies have received internet blackmail threats over the last several years. These companies sometimes cooperate with the
authorities to track down these criminals, which are sometimes successful. For example, a criminal group captured in Russia in 2004
apparently blackmailed several sports gambling companies for hundreds of thousands of US dollars, but in March of 2004, the four were
arrested after attempting to blackmail a large broadband company in Japan.
Some companies completely ignore these threats, leading to distributed denial of service attacks on their websites, which create a
shocking number of hits that paralyze the site. Other companies agree to pay these ransoms, unwilling to publicize the issue in order to
protect the company.
However, ransomware changes the method of blackmail, targeting individual users instead. These individuals could be an executive
of a large company, or a regular office employee. They do not necessarily have contact with their network administrator, who in turn may not
necessarily contact the relevant authorities for help. However, as long as the relevant authorities can be involved, these criminals can be
caught, just as the ones who blackmail large corporations can.
If Files are Held Ransom, Should You Go to the Police or Find an Antivirus Expert?
Most targets of ransomware are individual users or small companies who possess insufficient antivirus support, or who believe that
contacting the police is the best choice. Trend Micro advises you to also ask for help from your antivirus vendor if you encounter malware
blackmail, so that these ransomed files at least have a chance of being saved.
Trend Micro explained that malware authors will continuously make new innovations, as new technologies will allow for new forms of
attack, and new vulnerabilities will be found for further exploitation. The internet is unable to completely avoid the dangers posed by
malware authors. It is clear that they are no longer simply conducting destructive attacks on corporations, or trying to affect the most
number of systems with one program in order to make a name for themselves. More and more evidence points to these authors committing these
crimes for nothing more than pure profit. Ransomware is simply the newest type of malware to threaten computers around the world.
Ransomware Comparison Chart
Ransomware TROJ_PGPCODER.A TROJ_CRYZIP.A TROJ_RANSOM.A TROJ_ARHIVEUS.A
Extortion Method File encryption File compression and password protection Delete files every half hour Compress files
Ransom US$200 US$300 US$10.99 None (buy products from online pharmacy)
Distribution Methods Installs itself while browsing websites Browsing adult websites Spam or malicious web pages Browsing adult websites
Payment Methods Contact by email Random e-gold accounts Western Union Online purchase
Initial Discovery May 2005 March 2006 April 2006 May 2006
Source: TrendLabs
Trend Micro: www.trendmicro.com
For more information, please contact;
Srisuput Siangyen, Core & Peak Co., Ltd. Tel.02-439-4600 ext. 8300