Windows 10 Update Brings New Opportunity for Ransomware

By Steve Anderson August 07, 2015

The Windows 10 upgrade has prompted plenty of reaction from the computing community, with some eager to switch and others prepared to wait as long as possible before being forced to do so. But the waiting crowd has one more reason to hold up for its wait: a spike in ransomware incidents around the new software.

Cisco's security research arm, known as the Talos Group, spotted a spam operation late last week and started putting the word out about its existence. It operates in fairly standard fashion; it sends out fake emails disguised as being Microsoft-based, advertising the free upgrade. But once users download the attached zipped file, then extract and execute said file, that's when the horror show starts. The file contains the means to infect a system with CTB-Locker, an asymmetric encryption system that allows files to be encrypted, but without the decryption key being placed on the system in question.

Image via Symantec

Once successfully in place, the system then begins behaving like standard ransomware, demanding a Bitcoin-based payment and transfer of encryption keys through the TOR system. Given the distributed nature of Windows 10 upgrades, it would be comparatively easy to get at least some to believe that the fake message is actually from Microsoft and that it's just the user's turn to upgrade. Talos recommends that users make it routine practice to back up data to offline facilities, and also upgrade anti-malware programs as available, when available.

Image via Shutterstock

As Talos noted here, this is perhaps the biggest problem: the way the Windows 10 updates were set up makes it pretty much an inevitability that something like this would step in. Users are, as Talos put it, having to “...virtually wait in line to receive this update,” and that makes a great opportunity for ransomware users to step in and tell people at random “your turn is ready.” Then when users go to make the download, suddenly there's the ransomware waiting to strike and brick a perfectly good computer. This might have been a good time for Microsoft to actually go back to discs; filing a user's name and mailing address with Microsoft—which is some of the least dangerous personal information to file with a company; good luck running up false credit card charges with information that can easily be taken from any phone book and nothing else—and then having Microsoft mail out a single DVD (reports suggest the Windows 10 download is about three gigabytes, so a DVD should cover it) to run the installation would take the ransomware out of the equation.

Of course, Talos' other advice also works well here; keep files backed up in offline storage and keep the antiviral and antimalware tools up to date, so that malware has the least chance of getting through and doing comparatively little damage if it does. If ransomware no longer yields payments, it will likely stop being used. It's easy to say that Microsoft may not have had the best idea in distributing its updates, but a better response is to put blame squarely where it belongs: with those who employ ransomware in the first place.




Edited by Dominick Sorrentino

Contributing TechZone360 Writer

SHARE THIS ARTICLE
Related Articles

Why People Don't Update Their Computers

By: Special Guest    7/13/2018

When the WannaCry ransomware attacked companies all over the world in 2017, experts soon realized it was meant to be stopped by regular updating. Even…

Read More

More Intelligence About The New Intelligence

By: Rich Tehrani    7/9/2018

TMC recently announced the launch of three new artificial intelligence events under the banner of The New Intelligence. I recently spoke with TMC's Ex…

Read More

Technology, Innovation, and Compliance: How Businesses Approach the Digital Age

By: Special Guest    6/29/2018

Organizations must align internally to achieve effective innovation. Companies should consider creating cross-functional teams or, at a minimum, incre…

Read More

Contribute Your Brain Power to The New Intelligence

By: Paula Bernier    6/28/2018

The three events that are part of The New Intelligence are all about how businesses and service providers, and their customers, can benefit from artif…

Read More

TMC Launches The New Intelligence - an Unparalleled AI and Machine Learning Conference & Expo in Florida

By: TMCnet News    6/28/2018

TMC announced the launch of The New Intelligence conference and expo - The Event Powering the AI Revolution. This exciting new event will take place o…

Read More