Windows 10 Update Brings New Opportunity for Ransomware

By Steve Anderson August 07, 2015

The Windows 10 upgrade has prompted plenty of reaction from the computing community, with some eager to switch and others prepared to wait as long as possible before being forced to do so. But the waiting crowd has one more reason to hold up for its wait: a spike in ransomware incidents around the new software.

Cisco's security research arm, known as the Talos Group, spotted a spam operation late last week and started putting the word out about its existence. It operates in fairly standard fashion; it sends out fake emails disguised as being Microsoft-based, advertising the free upgrade. But once users download the attached zipped file, then extract and execute said file, that's when the horror show starts. The file contains the means to infect a system with CTB-Locker, an asymmetric encryption system that allows files to be encrypted, but without the decryption key being placed on the system in question.

Image via Symantec

Once successfully in place, the system then begins behaving like standard ransomware, demanding a Bitcoin-based payment and transfer of encryption keys through the TOR system. Given the distributed nature of Windows 10 upgrades, it would be comparatively easy to get at least some to believe that the fake message is actually from Microsoft and that it's just the user's turn to upgrade. Talos recommends that users make it routine practice to back up data to offline facilities, and also upgrade anti-malware programs as available, when available.

Image via Shutterstock

As Talos noted here, this is perhaps the biggest problem: the way the Windows 10 updates were set up makes it pretty much an inevitability that something like this would step in. Users are, as Talos put it, having to “...virtually wait in line to receive this update,” and that makes a great opportunity for ransomware users to step in and tell people at random “your turn is ready.” Then when users go to make the download, suddenly there's the ransomware waiting to strike and brick a perfectly good computer. This might have been a good time for Microsoft to actually go back to discs; filing a user's name and mailing address with Microsoft—which is some of the least dangerous personal information to file with a company; good luck running up false credit card charges with information that can easily be taken from any phone book and nothing else—and then having Microsoft mail out a single DVD (reports suggest the Windows 10 download is about three gigabytes, so a DVD should cover it) to run the installation would take the ransomware out of the equation.

Of course, Talos' other advice also works well here; keep files backed up in offline storage and keep the antiviral and antimalware tools up to date, so that malware has the least chance of getting through and doing comparatively little damage if it does. If ransomware no longer yields payments, it will likely stop being used. It's easy to say that Microsoft may not have had the best idea in distributing its updates, but a better response is to put blame squarely where it belongs: with those who employ ransomware in the first place.




Edited by Dominick Sorrentino

Contributing TechZone360 Writer

SHARE THIS ARTICLE
Related Articles

Pai Makes His Case for Title II Repeal

By: Paula Bernier    11/21/2017

FCC Chairman Ajit Pai today made clear his plans to repeal Title II net neutrality rules. The commission is expected to pass his proposal at its Dec. …

Read More

Mist Applies AI to Improve Wi-Fi

By: Paula Bernier    11/9/2017

Mist has created an AI-driven wireless platform that puts the user and his or mobile device at the heart of the wireless network. Combining machine le…

Read More

International Tech Innovation Growing, Says Consumer Technology Association

By: Doug Mohney    11/8/2017

The Consumer Technology Association (CTA) is best known for the world's largest trade event, but the organization's reach is growing far beyond the CE…

Read More

Broadcom Makes Unsolicited $130B Bid for Qualcomm

By: Paula Bernier    11/6/2017

In what could result in the biggest tech deal in history, semiconductor company Broadcom has made an offer to buy Qualcomm for a whopping $130 billion…

Read More

How Google's 'Moonshot' Could Benefit Industrial Markets

By: Kayla Matthews    10/30/2017

The term "moonshot" encapsulates the spirit of technological achievement: an accomplishment so ambitious, so improbable, that it's equivalent to sendi…

Read More