To pay or not to pay: the dilemma of ransomware

28

September

2021

No ratings yet.

Ransomware has exploded in the last few years. That is because it has become a very lucrative business for criminals. The premise is as follows: you break into a company’s IT system, steal or lock sensitive data from the system, contact the company with a ransom demand to unlock the files or avoid them being made public.

A few well-documented cases are when CD Project Red’s source code for its most popular games were made public, when TSMC had to shut down its facilities in August 2018, and when the Colonial Pipeline in the U.S. was taken down.

The dilemma that companies face when being targeted by ransomware attacks is whether to pay or whether to ignore the demand. Companies will suffer from reputation damage when it becomes public that the company is being blackmailed. Therefore, companies are inclined to pay out to the criminals before the criminals make public that they have access to a company’s files. However, in the end the ransomware attack will nearly always reach the news. The criminals demand huge amounts of money that would surely show up in the annual reports. For example, Colonial Pipeline paid $4.4 million to the hackers in May of this year. Large multinationals will have no financial difficulty with paying these amounts of money.

Would there still be a reason for them to not pay? Definitely! First of all, the criminals could always still make your data public, even after you paid. Secondly, it is about setting a precedent; for your company and companies in general. It has been proven that companies that pay out on ransomware attacks have an 80% chance of suffering another attack again. Next to that, if no company would pay to hackers, there would be no incentive for ransomware attacks to happen. As a result, the U.S. Department of the Treasury has issued a statement that makes many forms of paying ransom to criminals illegal. Next to that, the department is cracking down on cryptocurrency exchanges that aid in the ransomware payments.

It will be interesting to see whether the whole business world can come to an agreement where no one pays criminals ransom, and that way reduce the number of ransomware attacks.

Links:
https://arstechnica.com/gadgets/2021/06/cd-projekt-red-says-its-data-is-likely-circulating-online-after-ransom-attack/
https://thehackernews.com/2018/08/tsmc-wannacry-ransomware-attack.html
https://www.bloomberg.com/news/articles/2021-06-04/hackers-breached-colonial-pipeline-using-compromised-password
https://www.welivesecurity.com/2021/07/08/ransomware-pay-not-pay-legal-illegal-these-are-questions/
https://home.treasury.gov/news/press-releases/jy0364

Please rate this

Time for passwords to go

13

September

2021

No ratings yet.

Creating, remembering, and filling in passwords has become so baked into daily life that it is hard to imagine not having to fill in a string of text before being able to log in. However, as technology has advanced, is it not weird that passwords barely have? 80% of data breaches are still caused by weak and stolen passwords.

With every login now requiring a username and password, it is not hard to imagine that people make mistakes with them. As people need to remember so many different passwords, they start writing them on Post-It notes, re-using the same password for different sites, and/or using simple passwords like ‘123456’ or their birthdate. The best way to navigate all the different login details nowadays is probably through a password manager. A password manager is an application that allows you to securely store all your different login details and unlock them with a single password or a biometric identification method, like fingerprint scan. Still, there is a password here that one needs to remember and that can be retrieved by other people through shoulder surfing.

Password managers are still not common in most companies. From my experience HR often decides your login credentials and wants to be able to provide the IT department with your password in case anything goes wrong. Most accounts for third-party sites are shared throughout the company and passwords details are carelessly shared through email. Data breaches and account resets have become a very costly thing for large organizations, so why not develop a safer way to log in?

Biometrical identification methods, like fingerprint and face recognition, should become more mainstream and integrated in the services we use everyday. Most phones already use it. However, websites and programs often do not. Good integration between hardware and software is needed to offer biometric logins for all services and sites. Biometric data has some substantial advantages over traditional passwords.

  1. Biometric data is (nearly) impossible to forger. For example, fingerprint scanners test on fingerprints on 30 specific points. It is impossible for two humans to have more than 8 identical features. The very minute chance of a false positive or negative is far less significant compared to the security risks of passwords as they are used today.
  2. Biometric data is permanent. There is no risk of forgetting your fingerprint as there is with forgetting your password.
  3. Biometric data is faster. Typing in, and often retrying your passwords, takes far more time than simply using facial recognition to log in. Many people want to login fast with most of the services that they use, therefore they choose easy passwords that they also use for other accounts. Biometric data is faster and safer.

However, there are some risks that biometrical login methods face:

  1. Biometric data is permanent. If someone somehow managed to get a scan of your face, it is impossible to change it, like you can with passwords. Most identification tools are pretty good at detecting when they are being fooled and the security is constantly improving, therefore I do not suspect this to be that big of an issue.
  2. Biometric data is highly privacy-sensitive. There are some valid concerns that people have with providing an unknown service with a scan of their finger. To solve this, standards need to be developed and most of the processing needs to be done on device instead of in the cloud. It is likely that we will see a few large biometric login providers pop up that will become renowned names and people will have less of an issue with providing scans to those companies.

I think the time has come for passwords to go. There are too many risks and a good alternative that make the use of passwords outdated.

Links:

https://www.sutcliffeinsurance.co.uk/news/8-most-common-causes-of-data-breach/
https://tcrn.ch/2SnNGis
https://www.thalesgroup.com/en/markets/digital-identity-and-security/government/inspired/biometrics

Please rate this