Windows 10 Update Brings New Opportunity for Ransomware

By Steve Anderson August 07, 2015

The Windows 10 upgrade has prompted plenty of reaction from the computing community, with some eager to switch and others prepared to wait as long as possible before being forced to do so. But the waiting crowd has one more reason to hold up for its wait: a spike in ransomware incidents around the new software.

Cisco's security research arm, known as the Talos Group, spotted a spam operation late last week and started putting the word out about its existence. It operates in fairly standard fashion; it sends out fake emails disguised as being Microsoft-based, advertising the free upgrade. But once users download the attached zipped file, then extract and execute said file, that's when the horror show starts. The file contains the means to infect a system with CTB-Locker, an asymmetric encryption system that allows files to be encrypted, but without the decryption key being placed on the system in question.

Image via Symantec

Once successfully in place, the system then begins behaving like standard ransomware, demanding a Bitcoin-based payment and transfer of encryption keys through the TOR system. Given the distributed nature of Windows 10 upgrades, it would be comparatively easy to get at least some to believe that the fake message is actually from Microsoft and that it's just the user's turn to upgrade. Talos recommends that users make it routine practice to back up data to offline facilities, and also upgrade anti-malware programs as available, when available.

Image via Shutterstock

As Talos noted here, this is perhaps the biggest problem: the way the Windows 10 updates were set up makes it pretty much an inevitability that something like this would step in. Users are, as Talos put it, having to “...virtually wait in line to receive this update,” and that makes a great opportunity for ransomware users to step in and tell people at random “your turn is ready.” Then when users go to make the download, suddenly there's the ransomware waiting to strike and brick a perfectly good computer. This might have been a good time for Microsoft to actually go back to discs; filing a user's name and mailing address with Microsoft—which is some of the least dangerous personal information to file with a company; good luck running up false credit card charges with information that can easily be taken from any phone book and nothing else—and then having Microsoft mail out a single DVD (reports suggest the Windows 10 download is about three gigabytes, so a DVD should cover it) to run the installation would take the ransomware out of the equation.

Of course, Talos' other advice also works well here; keep files backed up in offline storage and keep the antiviral and antimalware tools up to date, so that malware has the least chance of getting through and doing comparatively little damage if it does. If ransomware no longer yields payments, it will likely stop being used. It's easy to say that Microsoft may not have had the best idea in distributing its updates, but a better response is to put blame squarely where it belongs: with those who employ ransomware in the first place.




Edited by Dominick Sorrentino

Contributing TechZone360 Writer

SHARE THIS ARTICLE
Related Articles

How Valuable is Your Personal Data?

By: Special Guest    9/25/2017

Pressure has been growing in the past few weeks for politicians and regulators to clamp down on the monopoly power of Big Tech. Indeed, scrutiny is gr…

Read More

Designing Insightful Dashboards for Decision Making

By: Special Guest    9/21/2017

As businesses continue to accumulate data that has the potential to improve operations and increase revenue, dashboard design is becoming a key compon…

Read More

Artificial Intelligence: The Human to Bot Handoff

By: Special Guest    9/21/2017

Artificial intelligence (AI) is one of the most talked about and debated topics of conversation happening today. It is touching every industry.

Read More

Dark Data - Do You Have a Plan?

By: Special Guest    9/19/2017

Practically every organization has vast amounts of "dark data" in the form of weblogs, machine logs, and logs from sensors on everything from oil rigs…

Read More

Open is the New Black for Mobile Voice Services

By: Special Guest    9/18/2017

It's time for some fresh thinking about voice services. Once the dominant source of revenue for mobile operators, voice calls are now a rare form of c…

Read More