Ransomware in Room looks like bad luck

meppel - That the House Tuesday is infected with ransomware, seems due to bad luck. An employee has somehow opened an infected attachment, and the systems were locked. At first glance it is not a targeted attack from someone who wanted to take the Dutch politics. That impression has IT security officer and researcher Loran Kloeze.

In an internal mail let the House know that some companies have been attacked. It is not known which companies are. 'The perpetrators will send hundreds of thousands of emails at once. They cost a few hundred euros. On average, forty to fifty casualties stupid enough to pay the demanded ransom of several hundred euros. It therefore remains positive for the senders, 'said Kloeze.

The offenders are very difficult to detect. They can work from Internet cafes, hack into WiFi hotspots from others and use anonymous TOR networks. Their servers are in countries where the authorities intervene little and they themselves may be on the other side of the world. 'If you look hard you try, you can make yourself so anonymous that you are almost untraceable. '

The great danger is that cyber spies with parliaments of other countries trying to penetrate to steal secret information. According Kloeze it is technically possible for a ransomware attack is a feint with which the perpetrators try to smuggle unseen spyware. 'But as a company security officer Fox-IT in the Netherlands will also consider and the code of ransomware can completely pull apart. What is he doing? What files he scrambles? With the servers it connects? It is possible to hang other (spy) software to the ransomware, but it is also possible to find out. '

The weakest links are not the systems or the scanners, but the people who work with it, opening attachments. And that should be well informed about the dangers, says Kloeze. 'The one in the House who opened the attachment, is to blame, but the question is what you would expect from a normal user. You can call it a business risk, but if employees are not informed properly, the infection is a symptom. '