How to avoid the massive WannaCry ransomware attack
Daniel Howley
On Friday a major piece of malware hit the web, and throughout the weekend infected hundreds of thousands of computers, taking down everything from businesses to the U.K.’s National Health Service. The software, dubbed WannaCry 2.0, is what’s known as ransomware.
A type of malware that burrows into your computer, ransomware encrypts the files on your machine, keeping you from being able to access them. The malware’s creator then asks that you to pay a fee to unlock your data.
The first round of the WannaCry 2.0 attack seems to have passed. But chances are the creator, or some other hacker, will repurpose the malware and send it back into the wild again.
Here’s how can you avoid this software, and what can you should if your machine is infected. The biggest tip I can give you is to simply keep your computer’s software updated.
And of course, never pay these ransoms.
Ransom?
Let’s start with the basics. A particularly nefarious form of malware, ransomware is a piece of software criminals use to lock you out of your computer by encrypting its files and holding them for ransom for a specific dollar amount. WannaCry 2.0 uses a vulnerability in Microsoft’s (MSFT) Windows operating system to attack users’ computers.
The vulnerability was originally made public when a hacking group released the exploit online, claiming to have stolen software exploits from the National Security Agency.
If your machine is infected, and you don’t pay up, you can potentially say goodbye to your photos, tax documents, pay stubs, and any other documents you’ve saved throughout the years.
This isn’t some idle threat, either. If you don’t pay, your documents will disappear or simply stay locked up until you completely reformat your system.
Ransomware programs sometimes require you to pay in Bitcoin, an anonymous currency that can’t be tracked.
However, criminals have increasingly begun demanding payment in the form of iTunes or Amazon gift cards, since the average person doesn’t know how to use Bitcoin, according to McAfee’s Gary Davis.
The amount you have to pay to unlock your computer can vary, with some experts saying criminals will ask for up to $500.
To be clear, ransomware doesn’t just target Windows PCs. The malware has been known to impact systems ranging from Android phones and tablets to Linux-based computers and Macs.
Where it comes from
According to Davis, ransomware was actually popular among cybercriminals over a decade ago. But it was far easier to catch the perpetrators back then since anonymous currency like Bitcoin didn’t exist yet. Bitcoin helped changed all that by making it nearly impossible to track criminals based on how victims pay them.
There are multiple types of ransomware out there, according to Chester Wisniewski, a senior security advisor with the computer security company Sophos. Each variation is tied to seven or eight criminal organizations.
Those groups build the software and then sell it on the black market, where other criminals purchase it and then begin using it for their own gains.
How they get you
Ransomware doesn’t just pop up on your computer by magic. You actually have to download it. And while you could swear up and down that you’d never be tricked into downloading malware, cybercriminals get plenty of people to do just that.
Here’s the thing: That email you opened to get ransomware on your computer in the first place was specifically written to get you to believe it was real. That’s because criminals use social engineering to craft their messages.
For example, hackers can determine your location and send emails that look like they’re from companies based in your country.
“Criminals are looking are looking up information about where you live, so you’ll click (emails),” Wisniewski explained to Yahoo Finance. “So if you’re in America, you’ll see something from Citi Bank, rather than Deutsche Bank, which is in Germany.”
Cybercriminals can also target ransomware messages to the time of year. So if it’s the holiday shopping season, criminals might send out messages supposedly from companies like the US Postal Service, FedEx or DHL. If it’s tax time, you could receive a message that says it’s from the IRS.
Other ransomware messages might claim the FBI has targeted you for using illegal software or viewing child pornography on your computer. Then, the message will tell you to click a link to a site to pay a fine — only to lock up your computer after you click.
It’s not just email, though. An attack known as a drive-by can get you if you simply visit certain websites. That’s because criminals have the ability to inject their malware into ads or links on poorly secured sites. When you go to such a site, you’ll download the ransomware. Just like that, you’re locked out of your computer.
How to protect yourself
Ransomware attacks vulnerabilities in outdated versions of software. So, believe it or not, the best way to protect yourself is to constantly update your operating system’s software and apps like Adobe Reader. That means you should always click that little “update” notification on your desktop, phone, or tablet. Don’t put it off.
Beyond that, you should always remember to back up your files. You can either do that by backing them up to a cloud service like Amazon (AMZN) Cloud, Google (GOOG,GOOGL) Drive or Apple’s (AAPL) iCloud, or by backing up to an external drive.
That said, you’ll want to be careful with how you back up your content. That’s because, according to Kaspersky Lab’s Ryan Naraine, some ransomware can infect your backups.
Naraine warns against staying logged into your cloud service all the time, as some forms of malware can lock you out of even them. What’s more, if you’re backing up to an external hard drive, you’ll want to disconnect it from your PC when you’re finished, or the ransomware could lock that, as well.
Naraine also says you should disconnect your computer from the internet if you see your system being actively encrypted. Doing so, he explains, could prevent all of your files that have yet to be encrypted from being locked.
Above all, every expert I spoke with recommended installing some form of anti-virus software and some kind of web browser filtering. With both types of software installed, your system up to date, and a backup available, you should be well-protected.
Oh, and for the love of god, avoid downloading any suspicious files or visiting sketchy websites.
What to do if you’re infected
Even if you follow all of the above steps, ransomware could still infect your computer or mobile device. If that’s the case, you have only a few options.
The first and easiest choice is to delete your computer or mobile device and reinstall your operating system. You’ll lose everything, but you won’t have to pay some criminal who’s holding your files hostage.
Some security software makers also sell programs that can decrypt your files. That said, by purchasing one, you’re betting that it will work on the ransomware on your computer, which isn’t always the case. On top of that, ransomware makers can update their malware to beat security software makers’ offerings.
All of the experts agree that the average person should never pay the ransom — even if it means losing their files. Doing so, they say, helps perpetuate a criminal act and emboldens ransomware makers.
Even if you do pay up, the ransomware could have left some other form of malware on your computer that you might not see.
In other words: Tell the criminals to take a hike.
