This document discusses ransomware, providing a history and overview. It describes how ransomware has evolved from locking screen ransomware in the 1980s-2012 to cryptoransomware today. The document notes that cryptoransomware makes more money for criminals. It also discusses whether you need to pay a ransom, explaining how the encryption process works. Finally, it provides 6 quick tips to help protect against ransomware, such as backing up files regularly and keeping backups off-site, limiting login privileges, and patching systems early and often.

1. Click to edit Master title style
HOW TO RECOVER FROM
RANSOMWARE
WITHOUT PAYING...
Paul Ducklin

2. HOW TO RECOVER FROM
RANSOMWARE
WITHOUT PAYING...

3. TO PAY,
OR NOT TO PAY,
THAT IS THE QUESTION

4. Paul Ducklin
Senior Technologist
Who am I?
duck@sophos.com
@duckblog

5. https://nakedsecurity.sophos.com/
What do I do?

6. Ransomware

7. Ransomware
Malicious software
that locks you out
and demands money
to let you back in
“
”

8. Ransomware
Where we are.
How we got here.
What to do? (6 quick tips.)
1
2
3

9. History of ransomware
2016 - LOCKY

10. History of ransomware
2016 - LOCKY

11. History of ransomware
1989/1990 - AIDS INFORMATION TROJAN

12. History of ransomware
2012 - REVETON

13. History of ransomware
The main crooks got busted.✔
Lockscreen ransomware died out fairly suddenly.

14. History of ransomware
You could recover without paying.✔
Lockscreen ransomware died out fairly suddenly.

15. History of ransomware
Cryptoransomware makes more $£€✘
Lockscreen ransomware died out fairly suddenly.

16. History of ransomware
2013 - CRYPTOLOCKER

17. History of ransomware
2014 - CRYPTOWALL

18. History of ransomware
2015 - TESLACRYPT

19. History of ransomware
2016 - LOCKY

20. History of ransomware
2016 - THE YEAR THEY ALL HAD A GO!

21. History of ransomware

22. Ransomware today

24. Ransomware today

25. (Dutch and German examples from http://www.fraudhelpdesk.org/)

26. Ransomware today

27. Ransomware today

28. Ransomware today
QUICK
TIP

29. Ransomware today

30. Ransomware today

31. (Aside) Do you have to pay?

32. (Aside) Do you have to pay?
YOUR FILE CONTENT
IN CLEARTEXT FORM
RSA-2048
PUBLIC KEY
AES-128
KEY

33. RSA-2048
PUBLIC KEY
AES-128
KEY
(Aside) Do you have to pay?
YOUR FILE CONTENT
IN CLEARTEXT FORM

34. WYLX AGRH INLLQA
YM 9$WWQLKA WPOS
RSA-2048
PUBLIC KEY
AES-128
KEY
(Aside) Do you have to pay?
YOUR FILE CONTENT
IN CLEARTEXT FORM

35. WYLX AGRH INLLQA
YM 9$WWQLKA WPOS
YOUR FILE CONTENT
IN CLEARTEXT FORM
(Aside) Do you have to pay?
RSA-2048
PUBLIC KEY
AES-128
KEY

36. WYLX AGRH INLLQA
YM 9$WWQLKA WPOS
YOUR FILE CONTENT
IN CLEARTEXT FORM
AES-128
M@Q
(Aside) Do you have to pay?
RSA-2048
PUBLIC KEY
AES-128
KEY

37. WYLX AGRH INLLQA
YM 9$WWQLKA WPOS
YOUR FILE CONTENT
IN CLEARTEXT FORM
AES-128
M@Q
RSA-2048
PUBLIC KEY
AES-128
KEY
Only in memory
(Aside) Do you have to pay?

38. WYLX AGRH INLLQA
YM 9$WWQLKA WPOS
AES-128
M@Q
RSA-2048
PUBLIC KEY
(Aside) Do you have to pay?

39. WYLX AGRH INLLQA
YM 9$WWQLKA WPOS
AES-128
M@Q
RSA-2048
PUBLIC KEY
(Aside) Do you have to pay?
Won't unlock

40. WYLX AGRH INLLQA
YM 9$WWQLKA WPOS
AES-128
M@Q
RSA-2048
PRIV KEY
(Aside) Do you have to pay?
Crooks have this
WYLX AGRH INLLQA
YM 9$WWQLKA WPOS
AES-128
M@Q
RSA-2048
PUBLIC KEY
Won't unlock

41. WYLX AGRH INLLQA
YM 9$WWQLKA WPOS
RSA-2048
PRIV KEY
(Aside) Do you have to pay?
So they can sell
you back the key
WYLX AGRH INLLQA
YM 9$WWQLKA WPOS
AES-128
M@Q
RSA-2048
PUBLIC KEY
Won't unlock
AES-128
KEY

42. (Aside) Do you have to pay?
ALAS, MY LIEGE,
UNLESS THINE FOE
MIS-STEP WITHAL,
THOU NEED'ST PAY

43. What to do?

44. What to do?
Backup regularly and keep a copy off-site.1

45. What to do?
Backup regularly and keep a copy off-site.
Don't enable macros in emailed docs.
1
2

46. What to do?
Backup regularly and keep a copy off-site.
Don't enable macros in emailed docs.
Tell Windows to show file extensions.3
1
2

47. What to do?
Backup regularly and keep a copy off-site.
Don't enable macros in emailed docs.
Tell Windows to show file extensions.
Don't open script or shortcut files sent by email.
3
1
2
4

48. What to do?
Backup regularly and keep a copy off-site.
Don't enable macros in emailed docs.
Tell Windows to show file extensions.
Don't open script or shortcut files sent by email.
Limit your login power to what you need.
3
1
2
4
5

49. What to do?
Backup regularly and keep a copy off-site.
Don't enable macros in emailed docs.
Tell Windows to show file extensions.
Don't open script or shortcut files sent by email.
Limit your login power to what you need.
Patch early, patch often.
3
1
2
4
5
6

50. ASK US HOW...