{"id":8381,"date":"2016-06-15T00:01:54","date_gmt":"2016-06-15T07:01:54","guid":{"rendered":"http:\/\/www.wambooli.com\/blog\/?p=8381"},"modified":"2016-06-11T11:16:44","modified_gmt":"2016-06-11T18:16:44","slug":"cryptolocker-again","status":"publish","type":"post","link":"https:\/\/www.wambooli.com\/blog\/?p=8381","title":{"rendered":"CryptoLocker (Again)"},"content":{"rendered":"

A special type of computer malware is succeeding where other viruses only dream to tread: The CryptoLocker virus is on the move, infecting computers, encrypting data, and requiring individuals and organizations to pony up money to get their data back. It’s insane that people are falling for this ruse.
\n
\nI originally wrote about CryptoLocker back in November, 2013<\/a>. Not much has changed: When the virus arrives, it may act immediately or it might delay. Eventually, it encrypts all the data on the PC’s primary storage device. (CryptoLocker is currently specific to Windows.)<\/p>\n

When you start the PC, or just log in, you see a message: Pay $n<\/em> to get your data back, where n<\/em> is a monetary amount, typically $300 or so. The malware is successful because, frankly, the price is low enough to make it profitable. That’s the insidious key to CryptoLocker’s success: People keep paying up.<\/p>\n

The money is often sent via bitcoin to some unknown server or even a temporary address. Then the decryption password is provided — another credit to the Bad Guys for keeping their word — and the user gets his data back.<\/p>\n

The recent spate of CryptoLocker attacks have targeted government agencies. Everything from police departments to state tax commissions have been hit. Government IT departments are training their employees, but a lot of work still needs to be done.<\/p>\n

At my local City Hall, a fake phishing message was recently sent out. The IT department fabricated the message to see who exactly would reply. The exact numbers aren’t known, but a terrifyingly huge amount of employees responded to the phishing attack.<\/p>\n

Had the attack been CryptoLocker, those employees would have downloaded the virus, which arrives as a text file. Coupled with a Microsoft Word macro-infected document, the text file type is changed to an executable Java file, which is then launched. The Java program invites CryptoLocker in from the Internet, the computer’s data is scrambled, or in the case of a government agency, network storage is scrambled. Then the ransom note appears.<\/p>\n

If you don’t want to pay the ransom, you can restore files from a backup. The shocking news is that too many of these government agencies don’t keep backups. In fact, a local Fire District paid $300 just last month to recover their data because they didn’t have a backup.<\/p>\n

Because of the way CryptoLocker is installed via a text file, most antivirus programs don’t intercept it. So the best way to avoid infection is to be smart: Don’t click on unknown links in email messages. Don’t open unexpected attachments, especially ZIP files. And, as I mentioned in the preceding paragraph, backup! A regular computer backup is your best defense against a host of maladies.<\/p>\n","protected":false},"excerpt":{"rendered":"

The viral scourge is hitting again, and CryptoLocker is proving to be a long-term success for the Bad Guys.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[15,17],"class_list":["post-8381","post","type-post","status-publish","format-standard","hentry","category-main","tag-pc","tag-troubleshooting"],"_links":{"self":[{"href":"https:\/\/www.wambooli.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/8381","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wambooli.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wambooli.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wambooli.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wambooli.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8381"}],"version-history":[{"count":3,"href":"https:\/\/www.wambooli.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/8381\/revisions"}],"predecessor-version":[{"id":8390,"href":"https:\/\/www.wambooli.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/8381\/revisions\/8390"}],"wp:attachment":[{"href":"https:\/\/www.wambooli.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8381"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wambooli.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8381"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wambooli.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8381"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}