How to protect from ransomware?

Amaede · 13 May 2017 at 14:48

With the recent "wannacry" saga and I, personally been affected, I was wondering if there's any sure shot strategy to counter ransomware threats as I guess these might increase in the future.

Found these two resources to get a hint of what can be done

https://www.purevpn.com/blog/how-to-protect-from-ransomware/

http://www.telegraph.co.uk/technology/0/protect-ransomware/

Hacking experts, shed some light please...

Caged · 13 May 2017 at 14:50

https://www.ncsc.gov.uk/guidance/protecting-your-organisation-ransomware

This is a good resource because it doesn't do the snake-oil salesman technique of pretending antivirus adds any value, to the point where it's not even mentioned.

Amaede · 13 May 2017 at 14:53

Caged said:
https://www.ncsc.gov.uk/guidance/protecting-your-organisation-ransomware

This is a good resource because it doesn't do the snake-oil salesman technique of pretending antivirus adds any value, to the point where it's not even mentioned.

What if the data has already been compromised, any way it can be backed up?

Caged · 13 May 2017 at 14:56

Pay the ransom, hope that the people distributing the malware are honest.

V F · 13 May 2017 at 14:57

Caged said:
Pay the ransom, hope that the people distributing the malware are honest.

LOL!

Rroff · 13 May 2017 at 14:57

Duplicate, ideally write protected, offline backups.

Puzzled · 13 May 2017 at 15:00

I've been running the free malwarebytes anti ransomware software for a while but noticed it is now packaged as a complete bundle along with anti exploit, no idea how effective it is though. Just makes me feel better

This latest one seems to able to spread around a lot more effectively and with time delay payload even offline backups may be infected. So any home user friendly protection / advice would be appreciated as a lot of family members seem worried about this.

PiKe · 13 May 2017 at 15:03

Rotating daily backups are the best way.

Rroff · 13 May 2017 at 15:03

MonkeyMan said:
This latest one seems to able to spread around a lot more effectively and with time delay payload even offline backups may be infected. So any home user friendly protection / advice would be appreciated as a lot of family members seem worried about this.

Make sure you don't backup executable files (including checking the actual extension of downloaded attachments, etc.) - if you backup before the payload has been executed data files will be intact (even if the ransomware has been sitting dormant on your system). To double down here have 2 or 3 copies of the data offline and round robin them periodically so as to have some older copies as well as the latest data.

Pawnless Endgame · 13 May 2017 at 15:08

Amaede said:
What if the data has already been compromised, any way it can be backed up?

Caged said:
Pay the ransom, hope that the people distributing the malware are honest.

V F said:
LOL!

20 years ago, it was imperative to keep backups. It's the same now. Weekly is ideal for a home computer, and make sure that the backup medium is of a removable sort. This is because once you're hit, you can't get your data back unless you pay the ransom. DON'T do this, because it usually funds organised crime.

As for ransomware detection, I don't think virus scanners can pick these up as they don't count as being a virus? Can someone please confirm as I'm not 100%. I know though it relies on social engineering, so in the NHS, it would be down to someone (typically in the accounts dept) opening a file that ends with .pdf.exe, and boom... a disciplinary hearing.

Caged · 13 May 2017 at 15:09

Even if you do full system backups, any backup application worth using will let you extract individual files from that backup rather than forcing you to restore the entire system state and execute any malware contained within it. Just backing the executable for the malware up doesn't mean much since it's not being executed within a backup archive.

V F · 13 May 2017 at 15:11

Pawnless Endgame said:
I know though it relies on social engineering, so in the NHS, it would be down to someone (typically in the accounts dept) opening a file that ends with .pdf.exe, and boom... a disciplinary hearing.

Funny to think you'd only hear this stuff back in the early 00s in college. Now a world wide problem.

IronWarrior · 13 May 2017 at 15:26

Disconnect from the Internet.

Rroff · 13 May 2017 at 15:29

Pawnless Endgame said:
As for ransomware detection, I don't think virus scanners can pick these up as they don't count as being a virus? Can someone please confirm as I'm not 100%. I know though it relies on social engineering, so in the NHS, it would be down to someone (typically in the accounts dept) opening a file that ends with .pdf.exe, and boom... a disciplinary hearing.

Heuristics might be able to stop a previously unknown deployment, known versions of ransomware can be detected and/or stopped - but customised versions or those using a new exploit might not match known patterns, etc. and get right through.

Manually interacting with malware masquerading as a datafile and/or as too many do ignoring any warning prompts can circumvent any antivirus potentially depending on circumstances.

chroniclard · 13 May 2017 at 15:31

From a companies prospective it can be cheaper to actually pay the ransom than sort it out.

Yas786 · 13 May 2017 at 16:03

My brother works for an American company that deals with ransomware. He helps design robust security systems to protect companies from getting caught out.

Having asked him, his response is to download the whole internet then disconnect and browse offline

.

I've already downloaded all teh internetz so I'm safe

demonix · 13 May 2017 at 16:18

1. Keep a backup of all data that is only connected to a computer to do said backup

2. Make sure that you have all windows updates installed since this latest threat has come from the already patched security holes that were abused by the NSA whose tools were leaked to the internet recently.

CREATIVE!11 · 13 May 2017 at 16:26

Backup data, don't download dodgy crapp, watch email attachments like a hawk, keep windows up to date, have good anti virus.

Pray to our lawd saviour Jeebus.

LoadsaMoney · 13 May 2017 at 16:30

Ive updated Defender, but ive not had any updates for my Win 7, since they changed em to the Win 10s way, so downloaded this one from the catalogue :- March, 2017 Security Only Quality Update for Windows 7 for x64-based Systems (KB4012212), which i got from here :- https://technet.microsoft.com/en-us/library/security/ms17-010.aspx, via the Win 7 64bit SP1 link down in the 'Affected Software' list.

Is that the right one i need to install ? (as theres another one underneath it called March, 2017 Security Only Quality Update for Windows 7 (KB4012212), which is only 18.8mb, but im guessing thats for 32bit).

Thanks.

Quoted from another thread, as might get answer here

Nate--IRL-- · 13 May 2017 at 16:43

LoadsaMoney said:
Quoted from another thread, as might get answer here

List of fixes per OS

https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Nate