97 Things Every Information Security Professional Should Know

Chapter 22. Ransomware

David McKenzie

Ransomware as a concept is very simple—a bully takes your stuff and you have to pay to get it back. In reality, it can quickly get complicated and murky. Pay or don’t pay—should it be an ethical or business decision? Is it absolute or does it depend on circumstances?

History

Ransomware has been around since 1989. The first recorded attack, named the AIDS_Trojan or PC_Cyborg, was spread by floppy disks—the lure offered a risk analysis of an individual contracting AIDS, preying on the topical fear of developing the condition, by analyzing their lifestyle via a questionnaire. Once the system was infected, the virus waited until the machine had been rebooted 90 times before encrypting the local disk and triggering a pop-up that demanded $189 for the safe return of the files.

Ransomware became truly popular with the advent of cryptocurrency, when suddenly criminals didn’t have to deal with account creation, money mules, or gift cards. Anybody could set up an “untraceable” cryptocurrency wallet and GET PAID. With early ransomware, the encryption methods were often written by the attacker and could at times be broken—some ransomware didn’t encrypt at all, but simply changed the file extension. Over time, ransomware evolved, best practices such as “never roll your own crypto” came into play, and, today, reverse engineering often finds no solution ...