Did You Know Early Ransomware Spread via Floppy Disk?

Ransomware might be a relatively new player in the battle for the Internet, but its short history shouldn’t belittle the damage that it can do to both businesses and users of personal computers. Perhaps you’ve had the misfortune to encounter it for yourself, and your files were locked down because of it. Regardless, ransomware is now a prevalent part of the online crime scene, and people are using it to extort money from innocent users, making it a considerable threat.

Initial Development
Ransomware might be used with malicious intent, but it wasn’t always meant to be used this way. In 1986, two Pakistani brothers, Basit and Amjad Alvi, built a piece of software that instructed users to call a phone number if they encountered a warning message. The goal was to use this program to identify piracy and protect the brothers’ assets, but with anything even remotely useful and helpful to society, someone out there managed to find a way to turn it against the masses and make a profit off of it.

Early Ransomware
The code created by the Alvi brothers was soon modified to lock down files, creating what’s known today as the PC Cyborg/AIDS virus, which was delivered on a floppy disk labeled “AIDS Information Introductory Diskette.” When it’s installed on the system, it restricts and hides files on the computer’s hard drive. The threat would then demand that the user pay $189 to a P.O. box in Panama in order to “renew their software license.”

The Return of Ransomware
Nearly two decades later, ransomware returned with a vengeance. In 2006, a trojan horse called GPCoder (also known as PGPCoder) was developed to encrypt files with common extensions (.doc, .html, .jpg, .xls, .zip, .rar, etc). They then extorted money out of the user by dropping a simple text file into each folder stating that the user had to pay in order to receive instructions on how to decrypt the files.

At around the same time, the software started to evolve and create new strains that would resemble the sophisticated attacks we see today. The type of encryption grew more powerful, which made it easier for hackers to use without placing themselves at much risk. The result is natural: more frequent ransomware attacks, which led to easy profits for hackers.

Contemporary Ransomware
In 2013, the world saw the debut of what’s considered the beginning of a contemporary ransomware takeover: CryptoLocker. CryptoLocker is delivered through infected email attachments that appear to come from legitimate sources. The ransomware itself is embedded in the email in the form of a .zip file that may be disguised as a .pdf file. Once the user unpackages the files, the ransomware is installed and adds a security key to the user’s registry. This allows the hacker to hijack the user profile and lock down the files on the system.

There are several known variants of CryptoLocker, many of which work the same way and produce the same results. One in particular, CryptoWall, is known to spread across infrastructures and infect multiple endpoints, making it exceptionally dangerous. Despite security companies’ best efforts to protect against ransomware, it has grown very popular and difficult to control once it’s been installed on a user’s PC.

In terms of your organization’s IT, there are several ways that you can protect your business’s assets. One of the best ways you can do so is by implementing a spam-blocking solution that keeps threatening messages out of your inbox in the first place. Additionally, it’s important to mitigate your losses in the event of a ransomware infection by keeping your data backed up and stored off-site--you know, just in case. If you get infected with ransomware, this is often the only way to recover your data without paying the fine.

To learn more about ransomware and what Computerware can do to keep your business safe, reach out to us at (703) 821-8200.