Ransomware is a malicious application designed to extort money from its victims. It holds your data hostage until you pay a ransom. But like so many others, I was unaware of what it was until I fell victim to it.
I downloaded and installed a free version of Internet Download Manager from a fishy site (a stupid move, I know) and bam! All my files were taken hostage. So, what exactly happened to my computer? I’ve written this article to explain what ransomware does to the endpoint device—and how to protect and recover from a ransomware attack.
What Does Ransomware Do to an Endpoint Device?
When ransomware enters your device, it encrypts data. It uses a secret key to change your data from readable plaintext to unreadable format. Think of it like locking your important documents in a safe with a complex combination. But, this time, it’s not you who locks it up—it’s the cybercriminal.
So, your documents are inaccessible, and you don’t know how to get them from the safe. After ransomware finishes encrypting your files, you get a message demanding payment for the decryption key. This malicious software uses encryption algorithms such as public-private keys. The public key encrypts, and the private key decrypts.
The public key is used to encrypt individual files in the endpoint device. This public key is usually embedded within the ransomware itself.
The private key decrypts the data. Attackers do not embed this key in the ransomware or store it on the infected device, making it hard for cyber security to find.
Now, let’s break down what ransomware does to the endpoint device step by step.
Infection
Ransomware doesn’t magically appear on your device. Infection is the first step, where malware gains access to your device. The entry points for the malware are usually phishing emails, malicious websites (which was the case for me), infected external devices, and remote desktop protocol attacks. After gaining access, the ransomware wants to stay put.
It might hide itself, disable security software, or modify system settings to ensure it remains active and undetected. It gathers information about your system and files before starting the encryption process. This helps it target specific data and personalize the ransom message.
It tries to spread across the network, infecting other connected devices. Your data isn’t necessarily lost at this point but has become vulnerable. Security software with real-time protection can help detect and block ransomware during the infection stage.
Encryption
This is the heart of a ransomware attack. It’s where the malware bares its teeth, locking your data away and leaving you with a chilling ransom demand. The malware has two options: selectively encrypt specific files based on their perceived value, such as documents, photos, and financial records, or encrypt everything. In my case, it was the documents only.
The malware uses robust encryption algorithms such as AES, RSA, and ChaCha20. This makes it virtually impossible to decrypt without the key. Each file receives a unique key, often derived from the master key generated during infection. At this stage, you are entirely locked out of your essential files. The private key now becomes the lifeblood of your data.
Ransom Demand
The ransom demand stage is the culmination of a ransomware attack. The attackers now lay out their terms for releasing your data. A pop-up message or ransom note appears on your screen. It usually comes with a chilling tone and urgent language.
It states that your files are encrypted and inaccessible. The message demands a ransom payment for the decryption key, typically in cryptocurrency like Bitcoin. You’re given details on how to send the ransom and the cryptocurrency address.
You are warned of permanent data loss, increased ransom, and exposure if you don’t pay. The pop-up aims to evoke fear and panic. They even put payment deadlines to pile more pressure. Sometimes, attackers provide a small sample of decrypted files to demonstrate their ability to decrypt everything.
How to Protect Your Device From Ransomware Attack
If you’re thinking about paying off the attackers, remember the famous quote, “We do not negotiate with terrorists.”
Because even if you pay the ransom after the attack, there’s no guarantee of data recovery. These are criminals, and there is no guarantee of keeping their word. Also, paying off the ransom encourages these attacks even more. So, the best thing is to employ the following preventive measures.
- Be informed: Security begins with you. You need to know the current trends in cyber security. As the attackers advance the malware, you must know what to look for.
- Use secure networks: Secure your wireless network with strong WPA2 or WPA3 encryption and a complex password. Avoid using public Wi-Fi.
- Surf safely: Be careful about the links you click and attachments you download. Don’t open emails from unknown senders. Be wary of suspicious attachments and links. Download software from trusted sources and official app stores.
- Create a data backup: Regularly create copies of your files and store them separately from your main system. When ransomware strikes and encrypts your files, restore from the backup.
- Keep the backup secure: Attackers know backups are a lifeline for victims and might try to encrypt or delete them as well. Keep at least one backup copy offline on a device disconnected from the internet, like an external hard drive. You can also store the backup in cloud storage with strong security features like encryption and multi-factor authentication.
- Use updated anti-malware software: Updated anti-malware software with real-time protection can detect and block ransomware. This prevents encryption of files from happening in the first place. As a piece of advice, don’t be quick to flag anti-malware software detections as harmless.
How to Recover From a Ransomware Attack
If your device is attacked, relax. It’s not the end of the world. I survived a ransomware attack with minimal damage, and so can you. I consulted cybersecurity experts on how to recover from ransomware attacks, and these were their recommendations.
- Immediately disconnect the infected device from the network to prevent further spread.
- If you have a recent, uninfected backup, restore the data.
- Try to decrypt the files using free decryption tools.
- Notify authorities to help track and fight cybercrime.
- As a last resort, move on. If no solution is working, cut your losses and start afresh. Format your device. If it’s a computer, reinstall the operating system.
Final Thoughts
Ransomware doesn’t affect the hardware of the endpoint device. It infects the device and encrypts data. This makes files and documents inaccessible. The attackers then demand a ransom to help you decrypt the data. As a preventive measure, keep a backup and have up-to-date anti-malware software.
