The world of today has grown so much where we have technology advancements trending each and every day globally. The advancement in technology has resulted to high risks of system being hacked as the hackers and crackers have really increased in number. There are so many risks, threats as well as attacks that are set for attacking a given target, Program in a computer or the files in the computer. Some of the attacks and threats that are normally known are such as theft, virus, worms, phishing in emails and other type of malicious software’s. In this concept the major is on the ransomware malware which has grown and evolved very fast in the modern applications and technologies. Ransomware is a type of malicious software which has been designed by hackers that blocks the access to system of the computer and one can only regain it if he or she pays the needed ransom of money within the given period failure to which may lead total damage to the files. Many are times have been seen to be only affecting the individuals but nowadays they are majoring even business and it attaches itself just like a normal does when entering in to computer system.
This type of malicious software has been known for locking down the data unless a ransom is paid and hence giving us the name ransomware. The first one was known to have hit the scene in the late 2013. Ransomware came as a results of both the education that had been improved when using computers and the work of both the professionals in security associating themselves with the antivirus companies. Just like many malwares this malware called ransomware infects the computers maybe through clicking the links which are unsafe and downloading programs which are unsafe. This links can be found in computers emails, torrents, botnets or all other forms of transmission. This type of malware does not get to be removed from the computer even when the bios is flashed or the hard disk drive is wiped completely or even when one attempts to return to a prior restore point. [1]. The program will only lock itself in the files making them not able to be accessed and thus looking like they are encrypted.
Most of the people consider ransomware to be a malicious software that targets only the few individuals and forgetting that they also affect the business which have led negative consequences affecting the entire organization and the surrounding society. The negative impacts that may befall an organisation due to ransomware includes
All the above impacts are with regards to the business, however as ransomware affects it has been affecting other areas such as the transport and health industry and this has made it to be very hard to eliminate making the servers and computers not to be functional hence rendering one to have no access to the medical records in the health industry [2].. The following are some of the impacts that befall the health sector and that are caused by attacks such as ransomware.
Ransomware are mostly attached to emails especially when phishing, they are attached on emails where one can have associated links and incase one click it, then it might be harmful to the machine. Another area or section such malicious software affects the personal computer is when a drive is downloading from untrusted source. When the ransomware attaches itself in to your machine or computers then it takes control of the files in the machine by encrypting all the files. Ransomware behaves just like a virus and as they affect the files, one will start to receive messages that are intimidating, threatening one to pay a given amount of money (Ransom) and if one fails to pay the given amount of money within the given which may be 48 hours or 72 hours then may lose the files completely.
Proliferation of variants is manifested in many ways and some of them are as classified below.
There are two major variants of ransomware named as the lucrative and the desctructive variants which lated initiated others.
The three variants that initiated from the major two were Xorist, CryptorBit and Cryptolocker. The three variants are known for decrypting themselves to not only the files but also to the devices even those that are shared within the network. The reasons to why they are lucrative and destructive is because the encrypt in to files of the user by making them look as if they are useless until when the hacker or the criminal behind the attack receive the asked ransom.
.Two years another destructive variant was observed which infected many user computer that belonged to the health industry and hospitals in America, Europe and Asia. The locky ransomware attached itself as a spam in the emails which included some malicious document like office documents which could maybe compressed such as the RAR or ZIP files. The locky ransomware variant was said to be associated with an attachment that had files or macros in formats of java scripts that helped them to download the files of Locky ransomware.
The fifth ransomware variant is Samas which was applied to comprise the networks of health facilities. It was known for attaching itself to the servers such as the web servers and Domain Name server unlike in the case of the Locky ransomware variant [3]. They webserver after being comprised by the Samas ransomware will upload all the used files in the network where they will be shared to all the devices connected to the network.
The various ways through which a virus can be attached to the system is the same way a ransomware will attach itself to the computer programs. The only difference is in ransomware a ransom is requested upon which payment is done the hacker releases the program and decrypts the encrypted files.
The figure below shows how the system behaves when it is under ransomware attack. The software may land in one computer when phishing in emails or downloading from dangerous or untrusted sources which are seemed to be malicious. The ransomware will do an exploitation to the operating system checking all it flaws and hence will know which code to attach so that he can harmful the computer, the programs or any running application.
Figure 1 bitcoin registration so that one can pay the ransom
After it attaches itself to the machine the ransomware will encrypt all the files in the computer while in other situation jumbling to an extent the files will no longer exist and hence not readable and finally refusing to give the key for decrypting the encrypted files.
Figure 2 paying the ransom for decryption
The hacker will have full access to your system as one cannot access any file and for the user to access the files he or she will have to pay the asked amount which is always asked in a currency that is anonymous like the use of Bitcoins [4].
Figure 3 the message after payment
There are many threats that are brought about by its attack before or even after. In this case the infection vector and additional capability threats are as discussed below.
Additional Capabilities are some of the features of the of ransomware that have led to expansion of very high rates which may include the infiltration of data , Denial of Service attacks which are distributed all over the system and some of the antidetection components in the system. The variant may be used for deleting the files even when one has paid for ransom. Lastly on additional capabilities is the lock down on the backups of the cloud where the system will continuously backup in the real-time or when synchronization of the system is taking place. They also affect the smart phones and the devices used in the Internet of Things.
Infection Vectors is a threat that is imposed by the user themselves as they are propagated through what the actions initiate knowingly and unknowingly such as when we click any link that might be malicious. These links might be found on the email spams or when a click takes you to a compromised website. The other instances that may disseminate threats is when there malvertising and downloading by the drive which will not require the user in engaging when the infection is said to be successful [5].
There has been a lot of attacks from ransomware which have been reported while others have not been reported. Locky is one of the commonest ransomware variant that have used a lot varieties of ransomware with evident from the research study done by Phishme. In 2016 SFMTA became a victim of locky ransomware which led to disruptions of their management systems that is the train and the bus. The attackers were so ruthless and they asked amount over 100 bitcoins which was about over 75, 000 dollars [6]. The biggest advantage is that there was speedy backup system that backed up all files for SFMTA in two days and a comprehensive restore was achieved. They incurred some losses for the two days when the system was down travelers did not pay anything. They were riding for free. The attack was researched and termed as Mamba.
The first mitigation will be installing a popup blocker where the is need to have an extension at the browser that will be used in helping to block the third party popup ads and keeping the computer and running programs safe. Some ads risks may be addressed when downloading on the drive duping it when clicking in to website that is malicious and making it harmless.
The other mitigation is to disable the windows PowerShell. Many perps may attach the functionalities of the windows in PowerShell where they will deploy their attacks there. Many organizations such as health industry have been victims of ransomwares such as the crypto which are used when doing automation and configuration of management frameworks such as downloading the infected files from the server that is in a remote place and doing the execution of the bad scripts. The use and adaption by disabling the windows PowerShell will be used in helping the malware code to evade being detected by the antivirus hence creating some tricks in preventing the malware from attacking.
In the research the main aim was to discuss the overview in network security where the major was ransomware attacks. This type of a malicious software have been so common in the modern world as the technology advances every day. The impact of ransomware has been said to be lucrative and so destructive. There are three major variants of ransomware namely the CryptorBit, Xorist and the Cryptolocker. There are threats that have been potentially posed by ransomware and this has resulted to negative impacts to the different organisations and to the entire society. In conclusion the report has explained the way a ransomware attack infect a machine and some of the risk mitigations to be recommended to help in preventing such attack and how effective they may be if applied.
Essay Writing Service Features
Our Experience
No matter how complex your assignment is, we can find the right professional for your specific task. Contact Essay is an essay writing company that hires only the smartest minds to help you with your projects. Our expertise allows us to provide students with high-quality academic writing, editing & proofreading services.
Free Features
Free revision policy
$10Free bibliography & reference
$8Free title page
$8Free formatting
$8How Our Essay Writing Service Works
First, you will need to complete an order form. It's not difficult but, in case there is anything you find not to be clear, you may always call us so that we can guide you through it. On the order form, you will need to include some basic information concerning your order: subject, topic, number of pages, etc. We also encourage our clients to upload any relevant information or sources that will help.
Complete the order form
Once we have all the information and instructions that we need, we select the most suitable writer for your assignment. While everything seems to be clear, the writer, who has complete knowledge of the subject, may need clarification from you. It is at that point that you would receive a call or email from us.
Writer’s assignment
As soon as the writer has finished, it will be delivered both to the website and to your email address so that you will not miss it. If your deadline is close at hand, we will place a call to you to make sure that you receive the paper on time.
Completing the order and download