spam

Article Dean Dorton

Less than a year after its predecessor, CryptoWall 3.0 (which inflicted an estimated $325 million in damages in the US alone), the most recent version of the world’s worst ransomware has surfaced, CryptoWall 4.0. While the end result for the attackers remains the same, to extort money from victims whose files have been encrypted and held for ransom, the malware itself has gotten a major facelift.

What’s new about CryptoWall 4.0

Like the previous version, this one is being transmitted through emails with a “resume.zip” extension but unlike the previous version, researchers note the encryption of filenames along with the encrypted files and data to be the biggest and most significant change in CryptoWall 4.0 (see image below).

CryptoWall 4.0 encrypted files

“This is a first,” according to Nathan Scott, an independent researcher who examined the code with Security Colleagues at Bleeping Computer. “I’m surprised more don’t do it; this makes it significantly harder to recover files except for paying the ransom. If you try to do a forensic data recovery, the files show up with these weird names and the user doesn’t know what file is what,” Scott said. “The only way to regain your data is a complete backup. If you don’t backup, the only way to get the data back is to pay the ransom.”

System Restore Points are also erased in this revamped version, taking away the option of returning to a previously saved state. Also, “CryptoWall 4.0 still includes advanced malware dropper mechanisms to avoid antivirus detection, but this new version possesses vastly improved communication capabilities,” according to Andra Zaharia of Denmark-based Heimdal Security. “It includes a modified protocol that enables it to avoid being detected, even by second generation enterprise firewall solutions. This lowers detection rates significantly compared to the already successful CryptoWall 3.0 attacks,” said Zaharia.

What should you do to mitigate your chance of a CryptoWall 4.0 infection?

There are many ways you can help to prevent a Cryptoware infection and proactive measures to put in place that will lessen the impact an attack can have.  Some of them are:

  • Back up your data constantly and frequently, ensuring that your backup systems are working properly and you have tested the restore functionality
  • Do not open spam emails or emails sent by unknown senders and do not download or open any attachments within those emails
  • Use products that can detect and block recent Cryptoware variants and ensure that your anti-virus and/or anti-malware applications are up to date
  • Keep your system up to date and always install the latest updates available

CryptoWall 4.0 Data Backup OpenDNS

Here at Dean Dorton Technology, we know that no solution is 100% guaranteed to prevent and block all ransomware from infecting your companies’ network.  For that reason, it is vitally important to ensure you have a complete backup and disaster recovery solution in place.  If you would like to learn more about the solutions we can provide, please contact John Miller at (859) 425-7701 or jomiller@ddaftech.com to set up a consultation today.

Article Dean Dorton

What controls does your business have in place to manage electronic fund transfers? How easy would it be for your Accounting Department to unknowingly participate in a fraudulent request to complete a wire transfer? Without adequate controls in place, your company could easily become the next victim of a common email phishing scheme. It is easy to think that your employees wouldn’t fall for something like this, but it happens more often than you think.

A local company recently lost over $85,000 because an employee in the Accounting Department received an email that appeared to come from one of the executives. Proper controls were not in place and funds were transferred. By the time anyone realized what had happened and the FBI could be contacted, the funds were gone and could not be recovered.

These types of scams have been around for a long time. However, the thieves are getting more sophisticated and actually put a great deal of effort into the process. It only takes a few vulnerable victims to make their effort pay off. There has been a large upswing in the number of attempts to defraud businesses – yes, even here in Kentucky!

Some attacks use a method called spoofing. Spoofing allows a sender to disguise their address and make it appear as though it came from someone else. For example, I could send an email and make it look like it came from your CEO. With the proper email security and SPAM filtering in place, most of these attempts do not make it through the filters. Properly managed email systems can recognize the spoof and block the message. More recent attempts involve the thieves actually registering a new domain name that is very similar to yours and setting up an email address that comes very close to that of your CEO or management. So close, it is very easy for your employees to not recognize the difference. Generally the email address is only one character off (e.g., jmiller@deanndorton.com instead of jmiller@deandortonstg.wpenginepowered.com.

The best defense against these attacks is to ensure there are strong controls around your electronic fund transfer processes that require more than an email request to process the transaction. For example, it is a good idea to require written sign-off. Note that an email does not equal written sign-off. If situations arise where you do need to use email, the recipient should always start a new email message to the requester (never reply to the request email). A text message to the requester would also add an additional layer of confirmation. However, completion of a company request form would be best. A strong control would require dual sign-off for transfers, especially those over a certain dollar amount and for new vendors (or new transfers). The key point here is having a two-step process to help minimize any opportunity for fraud.

Don’t put your business at risk by not having internal controls. For help evaluating and improving your information security and internal controls, please contact your Dean Dorton advisor or Jason Miller, Director of Business Consulting Services, at 859-425-7626 or jmiller@deandortonstg.wpenginepowered.com.


View Jason Miller’s Bio