Ransomware – What to Do?

Increasingly, it looks like Washington is finally waking up to the fact that ransomware is becoming a critical problem for the nation. This means that Congress might actually do something to fix the problem. Okay, if you believe that, I have some land for sale about 20 miles south of Key West. But really though, something does need to be done. What are the options?

Scope of the Problem

When ransomware was affecting just individual computers owned by small businesses and private citizens, it was not an issue of national concern. The money was small potatoes, and the effects were of no consequence to the economy. At this level the ‘solution’ was easy; routinely backing up files would allow owners of ransomed machines to erase the affected files and restore them from secure backups. Still, the key to ransomware at this level was the presence of cryptocurrencies, predominantly Bitcoin, that allowed the attacker to anonymously collect their toll.

To make real money, ransomware authors needed targets with deeper pockets, with more to lose from encrypted computers. Those targets would only be found in larger companies, corporations and government agencies. To be effective, the attacker had to be able to gain access to the internal network of the target and either find the most critical computer to encrypt or encrypt large portions of the network. Single computer backups were still effective so network encryption became the key. Network backups are harder to do (but not impossible by any means) and it is much more time consuming to delete and restore as a mitigation measure as more machines are involved. It was just easier to pay the ransom.

As attackers started increasing the amount of money demanded for removing their encryption, it became easier to justify the time and cost of backup, remove and restore. And it did not take long for attackers to realize that they needed to find another incentive to paying ransoms. They quickly hit on stealing sensitive data as part of their network invasion and encryption attack. If the target does not pay up, they just publicly release the data, ransomware has become extortionware.

Security Measures

The most obvious solution is to make it harder for the attackers to gain access to the network. This is much like rich families in Mexico increasing their personal security staffs to avoid being kidnapped. It works, for a while. Lesley Carhart made an interesting point about this tactic on Twitter®:

“The problem is that they are richy mc rich pants now because everyone paid up, and even if people secure mail really well they can sometimes now afford to buy 0days or really good black hats.”

As the attackers’ resources (money and expertise) increase the cost of defending against them increases even faster. The rich in Mexico have to pay their guards more than the kidnappers are able to pay them to look the other way. We are already at the point where a very large number of potential targets cannot afford (money and/or personnel) the security measures necessary to stop the initial intrusions.

Rather than trying to stop the initial penetration, another tactic might be to stop the spread through the network. If you can keep the problem down to a couple of computers with no sensitive information on them, then the remove and restore process becomes reasonable again, and sensitive information can be protected by encryption at rest (with encryption keys stored off the network). One way to do this is to completely rethink the concept of corporate networks and enforce radical (workgroup level) network segmentation with strong security controls for the minimum necessary movement between segments. This would require extensive system redesigns and a change in many corporate mindsets. A less radical level of network segmentation may be providing benefits, but if it does not allow for removal and restore as a workable ransomware response, it will not provide adequate ransomware protection.

Go After the Money

In the United States, kidnapping is not nearly as prevalent as it is in countries like Mexico. That is because law enforcement (particularly the FBI) has become very effective at investigating, arresting and prosecuting these crimes. And they have principally focused on making it difficult to collect the ransom payment by following the money. There are a couple of problems that make that difficult with respect to ransomware.

The first problem is following the money. Ransomware was not really practical until the advent of cryptocurrencies. That provided for an effectively untraceable method of paying the ransom. As with anything manmade, the anonymity of the transactions has decreased with the advent of blockchain explorers and technology like Coinpath®.

The major difference between kidnappers and ransomwarers (new word?) is that kidnappers have to have a local presence to put their hands on their victims. Ransomwarers can be anywhere in the world. This makes it more difficult to track the attackers. More importantly, in many instances it makes their arrest and prosecution practically impossible.

Tracking the Software

Another path to countering ransomware is tracking the software used to enter, transit and encrypt the systems to be ransomed. Federal intelligence agencies are getting better and better at tracking cyberattacks. Unfortunately, those agencies are not used to track criminal attacks. Law enforcement agencies do not have the same level of cyber tracking capabilities found in the intelligence agencies.

Doing Something

Okay, with all of that, what can Congress do? One suggested remedy has been for Congress to make it illegal to pay a ransomware demand. The thinking is that if the crooks cannot make any money with their attacks, they will not waste their time executing those attacks. A couple of problems with that. First, if affected entities do not report the attack, there is no way for the government to know whether or not they paid a ransom. Operations that figure the cost or recovering their networks in the classic method will be more that the ransom plus government fine will almost certainly pay the ransom and try to prevent the government from knowing that they were attacked.

Another approach being bandied about in the nation’s capital is to provide money to State, local and Tribal governments to help them increase the security on their systems to be able to avoid potential attacks. I certainly do not want stand in the way of that funding, but throwing money at the problem will only allow the politicians to look like they are doing something; see my comments above under security measures.

Another money throwing approach is to increase funding in DOJ (mainly the FBI as the action agency) to allow them to increase their capability to go identify the attackers behind the ransomware attacks. This will certainly help, but it will do little to stop the attackers unless the DOJ is provided with more effective tools that indicting cyber-criminals from Russia, China or North Korea that are unlikely to ever appear in a jurisdiction where they can be brought to trial in the United States.

My Suggestion

Here is a radical idea. Congress can define a ransomware attack on critical infrastructure as an attack on the sovereignty of the United States. They would have to tighten up the definition of ‘critical infrastructure’, but this would allow the President to use the intelligence infrastructure and cyber forces of the US military to ‘go after’ the perpetrators of ransomware. They would primarily be looking to empty bit coin wallets, obtain decryption keys and ‘destroying’ stolen files being used to extort ransomware payments. If they could obtain actionable information that could allow the perpetrators to be arrested and extradited to the United States, great, but disrupting the ability of the attackers to enjoy the fruits of their ‘labor’ would go a long way to reducing the level of ransomware.