Ransomware: fighting a crime without borders

Two or three times a week, cyber­se­cu­ri­ty expert Jason Hart takes calls from busi­ness­es hit by ran­somware attacks. 

The lucra­tive crime sees hack­ers break into a firm’s com­put­er sys­tem, encrypt­ing the data, which they will only release for a fee. It’s hard to police, with ran­soms paid in anony­mous and unreg­u­lat­ed cryp­tocur­ren­cy. Pub­lic ser­vices are fre­quent­ly tar­get­ed: one of Hart’s recent requests for help came from a school. 

The crooks can be any­where in the world, oper­at­ing across bor­ders, says Hart, a for­mer eth­i­cal hack­er who’s the co-founder and CEO of cyber­se­cu­ri­ty firm Fresh Secu­ri­ty. 

“They can be in El Sal­vador, hacked into a com­pa­ny in Amer­i­ca, using a proxy back into Peru then across to Spain via Korea. They could be any­where.”

State backing

Ran­somware made glob­al head­lines in May 2021, when the hack­er group Dark­Side forced the shut­down of Colo­nial Pipeline’s net­work, which sup­plies fuel to much of the east coast of the US. How­ev­er, many ran­somware attacks tar­get low-pro­file small and medi­um-sized busi­ness­es and often go unre­port­ed.

The crime is seiz­ing atten­tion at the high­est lev­els. “Ran­somware is quick­ly becom­ing a nation­al emer­gency,” accord­ing to Bran­don Wales, act­ing head of the US Cyber­se­cu­ri­ty and Infra­struc­ture Secu­ri­ty Agency (CISA), who was speak­ing before a sen­ate hear­ing in late 2020. An EU report from the same year found that ran­somware attacks grew 365% in 2019, inflict­ing about £8.7 bil­lion of loss­es on busi­ness­es.

To com­pli­cate mat­ters fur­ther, cyber­crim­i­nals in coun­tries like North Korea, Iran and Rus­sia some­times oper­ate with their government’s bless­ing and even encour­age­ment, imple­ment­ing attacks which can cause huge prob­lems for oth­er nations. The Wan­nacry 2.0 ran­somware attack in 2017 – which has been blamed on North Korea – seri­ous­ly dis­rupt­ed the UK Nation­al Health Ser­vice and Germany’s state rail­way. Telling­ly, DarkSide’s code auto­mat­i­cal­ly avoids encrypt­ing a com­put­er sys­tem which uses Russ­ian as its lan­guage.

“There are non-demo­c­ra­t­ic states which invest a lot of mon­ey into these types of cyber­at­tacks,” says Dr Lena Yury­na Con­nol­ly, assis­tant pro­fes­sor in cyber­se­cu­ri­ty at Zayed Uni­ver­si­ty. “They are very sophis­ti­cat­ed, and you can imag­ine the resources they have to hand. But if there is no evi­dence and no admis­sion, how can anoth­er gov­ern­ment respond?”

There have been some gov­ern­men­tal respons­es, though not many. In Feb­ru­ary 2021, French and Ukrain­ian pros­e­cu­tors arrest­ed a gang who rent­ed out pow­er­ful ran­somware for oth­er cyber­crim­i­nals, and in April the US gov­ern­ment sanc­tioned sev­er­al Russ­ian enti­ties, cit­ing “dis­rup­tive ran­somware attacks and phish­ing cam­paigns” on Ukraine, Geor­gia, the US and France.

Curbing cryptocurrency

Chi­na recent­ly blocked sev­er­al cryp­to-relat­ed accounts on Wei­bo as part of a broad­er crack­down on cryp­tocur­ren­cy and its links to crim­i­nal­i­ty. So is ban­ning cryp­tocur­ren­cy the answer to ran­somware? Con­nol­ly doesn’t think so. 

“Before cryp­tocur­ren­cy, crim­i­nals had oth­er means to com­mit crime,” she says. “Cryp­tocur­ren­cy is a won­der­ful tech­nol­o­gy, it can open up so many oppor­tu­ni­ties for busi­ness­es and indi­vid­u­als. It feels nar­row-mind­ed to ban it. The inter­net is also a facil­i­ta­tor, but we don’t talk about ban­ning that.”

How­ev­er, cryp­tocur­ren­cies could be reg­u­lat­ed, she says, as is begin­ning to occur in Switzer­land. 

For Con­nol­ly, ran­somware is preva­lent because it’s rel­a­tive­ly low risk for crim­i­nals and extreme­ly prof­itable. Research by the cyber­se­cu­ri­ty firm Kasper­sky found that over half of ran­somware vic­tims paid the ran­som, but only just over a quar­ter got their full data back.

“Vic­tims are pay­ing,” says Con­nol­ly. “Law enforce­ment agen­cies advise them not to, but sit­u­a­tions are dif­fi­cult some­times. Ran­somware doesn’t just encrypt, it steals data, so you have the fear of incrim­i­na­tion, embar­rass­ment, loss of intel­lec­tu­al prop­er­ty. We’re human beings with emo­tions and that affects how we make deci­sions.”

Shoring up cybersecurity

One promis­ing gov­ern­ment ini­tia­tive is the new Ran­somware Task Force, a US-led coali­tion between gov­ern­ment agen­cies like the Nation­al Cyber Secu­ri­ty Cen­tre in the UK and soft­ware firms, cyber­se­cu­ri­ty ven­dors, aca­d­e­mics and non­prof­its. It aims to find pol­i­cy solu­tions, like incen­tivis­ing vic­tims not to pay ran­soms by cov­er­ing the costs of their sys­tem recov­ery needs and sub­si­dis­ing real-time back­ups.

The most impor­tant step that gov­ern­ments like the UK could take would be to force com­pa­nies to pro­tect their data through reg­u­la­tion, Hart says. If a com­pa­ny holds cer­tain sen­si­tive data, there might be manda­to­ry secu­ri­ty pro­to­cols in place, he says. 

For Hart, who doesn’t advise vic­tims to pay hack­ers, there’s a lot of noise and atten­tion around ran­somware, but he sees it as a symp­tom of a far big­ger prob­lem. “If the basics of cyber­se­cu­ri­ty were actu­al­ly dealt with, ran­somware wouldn’t be so pro­lif­ic,” he says. 

He’s worked with some of the world’s largest organ­i­sa­tions, as well as small­er com­pa­nies; only about 1% have con­duct­ed a prop­er risk assess­ment of their data. 

“The first thing I say is, ‘what are you try­ing to pro­tect?’ And they don’t know.”

Com­pa­nies might think they are safe because they have a fire­wall, a secure VPN and anti-virus soft­ware. How­ev­er, this can result in a “vanil­la blan­ket of secu­ri­ty across the whole organ­i­sa­tion”, says Hart, when there could be spe­cif­ic data that is at greater risk. He encour­ages clients to “think like a hack­er” and look at all the types of data they have in their organ­i­sa­tion, pro­vid­ing extra pro­tec­tion to the data that needs it, includ­ing lim­its to access with­in the busi­ness. 

For exam­ple, a school might hold sen­si­tive stu­dent data that could be dam­ag­ing to a child and their fam­i­ly if released to the out­side world. A ran­som attack could also com­pro­mise the integri­ty of cer­tain aca­d­e­m­ic data, he not­ed, if it aimed to change a student’s grade. 

“A hack­er can change people’s lives with­out them even real­is­ing.”