Report: Backups May Not Be Enough Protection from Ransomware

The FBI recommends consumers and businesses back up data to minimize the impact of ransomware—malware that encrypts victims' data until they pay money, often in exchange for a virtual key.

But a new report from cybersecurity company CrowdStrike—hired by the Democratic National Committee to investigate intrusions into its networks—suggests backups aren't enough to fend off a rapidly evolving threat. CrowdStrike sells a software as a service intended to detect such attacks and respond to cybersecurity breaches. 

Increasingly, ransomware incidents are evading anti-malware protections and targeting backup files, the report said. They're also exploiting human psychology, triggering emotions such as desperation, to make victims pay ransom.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

Criminals have established that victims are willing to pay for valuable data—the Hollywood Presbyterian Medical Center paid $17,000 in bitcoin this year—and want to make even more money, the report said. Perpetrators have used malware to extort $209 million from organizations in the first three months of 2016, according to law enforcement estimates cited in the report.

"[I]f consumers or one-off business users are willing to pay $300 to $500 to unlock run-of-the-mill data on a single endpoint, businesses and other organizations would likely be willing to pay much more for mission-critical data, or to unlock an entire fleet of endpoints held hostage,” the report said.

The report comes at a time when the federal government is doubling down on efforts to educate the public about ransomware. Over the next few months, the FBI and the Secret Service will host public workshops in field offices across the country, instructing people on how to avoid malware-riddled spear-phishing attempts and other entry points for attackers. 

Here are a few lessons from CrowdStrike's report: 

1. Backups may help but aren't enough. 

Organizations that plan to simply back up data and restore instead of dealing with attackers should consider that backups aren't always complete, according to CrowdStrike. When employees telework or regularly use their own devices, those endpoints often aren't part of the organization's regular data backup plan, the report said. 

Recovering data can also be expensive, sometimes “lead[ing] to the conclusion that it’s cheaper and timelier to just pay the ransom in return for immediate access to the data.”

Even if current backups exist, new ransomware variants specifically target those files, the report said.

"[S]ophisticated extortionists recognize that they lose an opportunity for strong-arming victims when backups are in play, and they're adding this new tactic as a way to maximize their gains," according to the report. 

2. Ransomware is evolving to evade detection. 

Newer variants, such as Locky, actively avoid detection by encrypting the network devices connected to the malware infected systems and deletes backups, the report said. Even the most routine instances of malware are sophisticated enough to disguise their malicious code and end Windows processes like Task Manager and System Configuration.

3. Attackers are learning more about human psychology. 

Criminals have “preyed on basic human emotions like desperation, fear and even shame to convince users to pay up," CrowdStrike wrote. If a business is targeted, an embarrassed employee who doesn't want to talk to IT might decide to pay the ransom without telling their employer in an attempt to make the problem disappear, the report said. 

Early instances of ransomware used “scareware" that masqueraded as police locking a system on which they detected illegal activities, the report said. In a more recent case, attackers took control of an Android pornography viewing app, photographed viewers as they used the app, and showed the picture on the lock screen, demanding $500 in ransom.