Ransom Ware

From TCF Wiki
Jump to: navigation, search


Ransom Ware

Ransom ware comprises a class of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator of the malware in order for the restriction to be removed. Some forms of ransom ware encrypt files on the system's hard drive (cryptoviral extortion), while some may simply lock the system and display messages intended to coax the user into paying.

Ransom ware typically propagates like a conventional computer worm, entering a system through, for example, a downloaded file or a vulnerability in a network service, see RAT & Bot Spreading . The program will then run a payload: such as one that will begin to encrypt personal files on the hard drive. More sophisticated ransom ware may hybrid-encrypt the victim's plain text with a random symmetric key and a fixed public key. The malware author is the only party that knows the needed private decryption key. Some ransom ware payloads do not use encryption. In these cases, the payload is simply an application designed to effectively restrict interaction with the system, typically by overriding explorer.exe in the Windows registry as the default shell.

or even modifying the master boot record and/or partition table, not allowing the operating system to start at all until it is repaired. Ransom ware payloads, especially ones which do not encrypt files, utilize elements of scare ware to coax the user into paying for its removal. The payload may, for example, display notices purportedly issued by companies or law enforcement agencies which falsely claim that the user's system had been used for illegal activities, or contains illegal content such as pornography and unlawfully obtained software. Some ransom ware payloads imitate Windows XP's product activation notices, falsely claiming that their computer's Windows installation is counterfeit or requires re-activation.

In any case, the ransom ware will attempt to extort money from the system's user by forcing them to purchase either a program to decrypt the files it had encrypted, or an unlock code which will remove the locks it had applied. These payments are often delivered using either a wire transfer, premium-rate text messages,or through an online payment voucher service such as Ukash,Paysafecard and MoneyPak reload.

Ransom Ware can be especially good for bot herders. This is because a bot herder can download the ransom ware on to the infected computer with out the knowledge of the user. Ransom ware that encrypts specific files are worth purchasing. These types of ransom ware target business people and networks because these people always pay. There company data is encrypted and if they do not pay then they can not access it and will lose the data forever. Most of the times ransom ware operators make the victim continue pay until they stop paying for maximum profits.

Bot herders can also turn there bot into a type of ransom ware. All the bot herder has to do is turn on the victims webcam and record the victim doing embarrassing things. Most of the time it is the "self Pleasures" part that makes the most money. The bot herder captures the victim during " self pleasures" and e-mails the video to them stating that if they do not pay 10 btc then they are going to post it on their Facebook page or on YouTube. Reluctantly the victim pays for fear of public embarrassment.

--True wealth comes from knowledge, and true knowledge comes from research, the wages of fraud is equivalent to money by the power of 10 20:30, 23 October 2013 (EDT)