Ransomware

Chapter 2. Pros and Cons of Paying the Ransom

Ask any security professional whether or not a victim should pay the ransom, and the answer will almost assuredly be a loud no. Unfortunately, as covered briefly in Chapter 1, in the wake of a ransomware incident, the answer can be more complicated and may depend on the amount of advanced planning the organization has done.

Before diving any deeper into this topic, take a step back and remember what ransomware does. Almost all ransomware looks for certain files on the hard drive of the victim and then encrypts those files. Generally those files include things like Microsoft Office documents, PDFs, images, movies, music, and text files; each ransomware family has a slightly different set of files it chooses to encrypt. Some ransomware also looks for shared drives and proceeds to encrypt the same file types on those shared drives. The ransomware usually does not encrypt everything on the hard drive because then the computer would cease to function and the hacker group would not get their money. One notable exception to this is the Petya ransomware family, which overwrites the master boot record and encrypts the master file table, making the system nonfunctional.

Petya Ransomware

Upon its initial release, the Petya ransomware did something that mimicked very early malware by overwriting the master boot record. But it failed to interpret or back up the GUID partition table that exists in modern operating systems, making it dangerous to ...