Industry must unite to protect against the increasing threat of ransomware

Anti-virus companies may soon find themselves powerless against hackers as Ransomware evolves into an even greater threat.

The use of asymmetric encryption in malicious programs dubbed ransomware to take over user data may continue to grow beyond the capability of current cryptography, according to a study by security expert Kaspersky Labs.

Ransomware is a type of malware used to encrypt data and hold it ransom for recovery. This type of threat, also know as blackmailing viruses due to their nature, has been around for a number of years. But in 2006, they reached a new level of sophistication in the form of Gpcode.ac, which took advantage of the RSA algorithm to create a 56 bit key.

This first attack was relatively easy for anti-virus companies to crack, so in June a new strain of the virus appeared where a 260 bit key was used. This was soon followed by 330 bit and 660 bit versions. These attacks were dealt with quite speedily by the anti-virus vendors, which has resulted in hackers stepping up their game again.

"In spite of the fact that we were able to decrypt 330 and 660 bit keys within a reasonably short space of time, keys of this length are already pushing the boundaries of modern cryptography. If RSA (or any other similar algorithm which uses a public key) were to be appropriately implemented in a new creation, antivirus companies might find themselves powerless, even if maximum computing power were to be applied to decrypting the key," said author of the report, Alexander Gostev, a senior virus analyst at Kaspersky Lab.

Gostev advised the commercial and technology industries to take a unified stance of prevention rather than cure against such malice. Organisations, he said, should back up everything on a regular basis, and antivirus companies should make it impossible for those will ill intent to encrypt data.

"Sadly, the authors of Gpcode, Cryzip, and Krotten are still at liberty. Great efforts are being made to apprehend them," he continued.

"However, even if they are arrested, there's nothing to prevent other malicious users from implementing such techniques in order to make money. Because of this, ransomware will undoubtedly remain a major headache for the antivirus industry, at least in the near future."

The report, entitled 'Malware Evolution: April - June 2006', also looked at the multiple vulnerabilities that have occurred in Microsoft Office and the polymorphic scripts used in malicious programs that resets the code to evade signature-based virus detection.

Email to a friend

Print this page

Social Bookmark this article: What is this?

Digg

Delicious

Reddit

StumbleUpon

Slashdot

Google

Facebook