{"id":30013,"date":"2017-11-06T12:33:54","date_gmt":"2017-11-06T04:33:54","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=30013"},"modified":"2017-11-06T12:33:54","modified_gmt":"2017-11-06T04:33:54","slug":"no-platform-immune-from-ransomware-says-study","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2017\/11\/06\/no-platform-immune-from-ransomware-says-study\/","title":{"rendered":"No platform immune from ransomware, says study"},"content":{"rendered":"
\"\"<\/a>

Image Credit: Pete Linforth | Pixabay<\/em><\/strong><\/p><\/div>\n

While ransomware predominately attacked Windows systems in the last six months, Android, Linux and MacOS platforms were not immune, according to the SophosLabs 2018 Malware Forecast<\/a>, a report that recaps ransomware and other cybersecurity trends based on data collected from Sophos customer computers worldwide during April 1 to Oct. 3, 2017.\u00a0<\/strong><\/p>\n

\u201cRansomware has become platform-agnostic. Ransomware mostly targets Windows computers, but this year, SophosLabs saw an increased amount of crypto-attacks on different devices and operating systems used by our customers worldwide,\u201d said Dorka Palotay, SophosLabs security researcher and contributor to the ransomware analysis in the SophosLabs 2018 Malware Forecast.<\/p>\n

The report also tracks ransomware growth patterns, indicating that WannaCry, unleashed in May 2017, was the number one ransomware intercepted from customer computers, dethroning longtime ransomware leader Cerber, which first appeared in early 2016. WannaCry accounted for 45.3 percent of all ransomware tracked through SophosLabs with Cerber accounting for 44.2 percent.<\/p>\n

\u201cFor the first time we saw ransomware with worm-like characteristics, which contributed to the rapid expansion of WannaCry. This ransomware took advantage of a known Windows vulnerability<\/a> to infect and spread to computers, making it hard to control,\u201d said Palotay. \u201cEven though our customers are protected<\/a> against it and WannaCry has tapered off, we still see the threat because of its inherent nature to keep scanning and attacking computers. We\u2019re expecting cyber criminals to build upon this ability to replicate seen in WannaCry and NotPetya, and this is already evident with Bad Rabbit<\/a> ransomware, which shows many similarities to NotPetya.\u201d<\/p>\n

The SophosLabs 2018 Malware Forecast reports on the acute rise and fall of NotPetya<\/a>, ransomware that wreaked havoc in June 2017. NotPetya was initially distributed through a Ukranian accounting software package, limiting its geographic impact. It was able to spread via the EternalBlue exploit, just like WannaCry, but because WannaCry had already infected most exposed machines there were few left unpatched and vulnerable. The motive behind NotPetya is still unclear because there were many missteps, cracks and faults with this attack. For instance, the email account that victims needed to contact attackers didn\u2019t work and victims could not decrypt and recover their data, according to Palotay.<\/p>\n

\u201cNotPetya spiked fast and furiously, and did hurt businesses because it permanently destroyed data on the computers it hit. Luckily, NotPetya stopped almost as fast as it started,\u201d said Palotay. \u201cWe suspect the cyber criminals were experimenting or their goal was not ransomware, but something more destructive like a data wiper. Regardless of intention, Sophos strongly advises against paying for ransomware and recommends best practices<\/a> instead, including backing up data and keeping patches up to date.\u201d<\/p>\n

Cerber, sold as a ransomware kit on the Dark Web<\/a>, remains a dangerous threat. The creators of Cerber continuously update the code and they charge a percentage of the ransom that the \u201cmiddle-men\u201d attackers receive from victims. Regular new features make Cerber not only an effective attack tool, but perennially available to cyber criminals. \u201cThis Dark Web business model is unfortunately working and similar to a legitimate company is likely funding the ongoing development of Cerber. We can assume the profits are motivating the authors to maintain the code,\u201d said Palotay.<\/p>\n

Rise in Android ransomware\u00a0<\/b><\/p>\n

Android ransomware is also attracting cyber criminals. According to SophosLabs analysis, the number of attacks on Sophos customers using Android devices increased almost every month in 2017.<\/p>\n

\u201cIn September alone, 30.4 percent of malicious Android malware processed by SophosLabs was ransomware. We\u2019re expecting this to jump to approximately 45 percent in October,\u201d said Rowland Yu, a SophosLabs security researcher and contributor to the SophosLabs 2018 Malware Forecast. \u201cOne reason we believe ransomware on Android is taking off is because it\u2019s an easy way for cyber criminals to make money instead of stealing contacts and SMS, popping ups ads or bank phishing which requires sophisticated hacking techniques. It\u2019s important to note that Android ransomware is mainly discovered in non-Google Play markets \u2013 another reason for users to be very cautious about where and what kinds of apps they download.\u201d<\/p>\n

The SophosLabs report further indicates two types of Android attack methods emerged: locking the phone without encrypting data, and locking the phone while encrypting the data. Most ransomware on Android doesn\u2019t encrypt user data, but the sheer act of locking a screen in exchange for money is enough to cause people grief, especially considering how many times in a single day information is accessed on a personal device. \u201cSophos recommends backing up phones on a regular schedule, similar to a computer, to preserve data and avoid paying ransom just to regain access. We expect ransomware for Android to continue to increase and dominate as the leading type of malware on this mobile platform in the coming year,\u201d said Yu.<\/p>\n

Next-generation firewall<\/b><\/p>\n

In another development, Sophos recently launched the latest version of its next-generation Sophos XG Firewall<\/a> that delivers a breakthrough in network traffic visibility. Using Synchronized Security<\/a> to obtain information from the endpoint, XG Firewall can identify, classify and allow the control of all previously unknown applications active on the network, such as those which don\u2019t have signatures or are using generic HTTP or HTTPS connections.\u00a0 Synchronized App Control on XG Firewall is an industry first and can reduce the security risks associated with unidentified traffic by allowing administrators to see exactly what is on their network.<\/p>\n

Sophos XG Firewall is available for on-premise and cloud deployment, on all the major virtualization platforms as well as through the Microsoft Azure marketplace.\u00a0 Both Sophos Endpoint Protection<\/a> and the next-generation anti-ransomware solution Intercept X<\/a> will provide the XG Firewall with the Synchronized Security data required for this new level of traffic identification.<\/p>\n

In addition, Sophos has introduced new XG Series hardware appliances that provide a modular system for connectivity with a wide variety of integrated connectivity and FleXi Port modules.\u00a0 The addition of two fail-safe bypass port pairs on-board every 1U appliance and an optional bypass FleXi Port module for all 1U and 2U XG Series models, plus optional Power over Ethernet (PoE) modules make it easy to enable Synchronized Security in any environment.<\/p>\n","protected":false},"excerpt":{"rendered":"

While ransomware predominately attacked Windows systems in the last six months, Android, Linux and MacOS platforms were not immune, according to the SophosLabs 2018 Malware Forecast, a report that recaps ransomware and other cybersecurity trends based on data collected from Sophos customer computers worldwide during April 1 to Oct. 3, 2017.\u00a0 \u201cRansomware has become platform-agnostic. […]<\/p>\n","protected":false},"author":6,"featured_media":30014,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[495,286,1591,206],"class_list":["post-30013","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-headlines","tag-cybersecurity-and-cybercrime","tag-it-security","tag-ransomware","tag-sophos"],"_links":{"self":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/30013","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/comments?post=30013"}],"version-history":[{"count":0,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/30013\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media\/30014"}],"wp:attachment":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media?parent=30013"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/categories?post=30013"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/tags?post=30013"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}