Connect with us

News

Paying Ransom Fuels Cost of Recovering from a Ransomware Attack, Sophos Warns

Published

on

Kindly share this post

Sophos, a global leader in next-generation cybersecurity, has announced the findings of its global survey, The State of Ransomware 2020, which reveals that paying cybercriminals to restore data encrypted during a ransomware attack is not an easy and inexpensive path to recovery.

 

In fact, the total cost of recovery almost doubles when organizations pay a ransom. The survey polled 5,000 IT decision makers in organizations in 26 countries across six continents, including Europe, the Americas, Asia-Pacific and central Asia, the Middle East, and Africa.

 

More than half (51%) of organizations had experienced a significant ransomware attack in the previous 12 months, compared to 54% in 2017. In Nigeria, 53% of the organizations surveyed mentioned a ransomware attack in the last one year.

 

Globally Data was encrypted in nearly three quarters (73%) of attacks that successfully breached an organization, while in Nigeria, it was 74%. The average cost of addressing the impact of such an attack, including business downtime, lost orders, operational costs, and more, but not including the ransom, was more than $730,000.

 

This average cost rose to $1.4 million, almost twice as much, when organizations paid the ransom. More than one quarter (27%) of organizations hit by ransomware admitted paying the ransom. The survey also revealed 38% of the organizations that were attacked in Nigeria admitted to paying the ransom.

 

Chester Wisniewski, principal research scientist, Sophos, said “Organizations may feel intense pressure to pay the ransom to avoid damaging downtime.

“On the face of it, paying the ransom appears to be an effective way of getting data restored, but this is illusory.

 

“Sophos’ findings show that paying the ransom makes little difference to the recovery burden in terms of time and cost.

 

“This could be because it is unlikely that a single magical decryption key is all that’s needed to recover. Often, the attackers may share several keys and using them to restore data may be a complex and time-consuming affair.”

 

More than half (56%) the IT managers surveyed were able to recover their data from backups without paying the ransom compared to 44% in the Nigeria.

 

Globally in a very small minority of cases (1%), paying the ransom did not lead to the recovery of data while in Nigeria it was in 10% of cases.

 

This figure rose to 5% for public sector organizations. In fact, 13% of the public sector organizations surveyed never managed to restore their encrypted data, compared to 6% overall.

 

However, contrary to popular belief, the public sector was least affected by ransomware, with just 45% of the organizations surveyed in this category saying they were hit by a significant attack in the previous year.

 

At a global level, media, leisure and entertainment businesses in the private sector were most affected by ransomware, with 60% of respondents reporting attacks.

 

Attackers increase pressure to pay

 

SophosLabs researchers have published a new report, Maze Ransomware: Extorting Victims for 1 Year and Counting, which looks at the tools, techniques and procedures used by this advanced threat that combines data encryption with information theft and the threat of exposure.

 

This approach, which Sophos researchers have also observed being adopted by other ransomware families, like LockBit, is designed to increase pressure on the victim to pay the ransom. The new Sophos report will help security professionals better understand and anticipate the evolving behaviors of ransomware attackers and protect their organizations.

 

“An effective backup system that enables organizations to restore encrypted data without paying the attackers is business critical, but there are other important elements to consider if a company is to be truly resilient to ransomware,” added Wisniewski. “Advanced adversaries like the operators behind the Maze ransomware don’t just encrypt files, they steal data for possible exposure or extortion purposes. We’ve recently reported on LockBit using this tactic.

 

“Some attackers also attempt to delete or otherwise sabotage backups to make it harder for victims to recover data and increase pressure on them to pay. The way to address these malicious maneuvers is to keep backups offline, and use effective, multi-layered security solutions that detect and block attacks at different stages.”


Kindly share this post

Ugo Onwuaso is an ICT enthusiast. He believes technology should be used for general good. He holds a Master of Public Administration (MPA) degree from the Lagos state University. Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

News

EFCC to Arraign Emefiele for Allegedly Printing N684.5m Notes with N18.96Bn Wednesday

Published

on

Kindly share this post

Economic and Financial Crimes Commission (EFCC) will arraign Godwin Emefiele, former governor of the Central Bank of Nigeria (CBN) on Wednesday for allegedly approving the printing of N684.5m at the rate of N18.96bn.

EFCC to Arraign Emefiele for Allegedly Printing N684.5m Notes with N18.96Bn Wednesday

The arraignment was originally scheduled for April 30, 2024, but was rescheduled following the agreement of the court and the parties.

In the four-count charge filed against him, the EFCC alleged that Emefiele disobeyed the direction of law with intent to cause injury to the public during his implementation of the naira swap policy of the administration of former President Muhammadu Buhari.

The anti-graft agency also accused Emefiele of unlawfully approving the withdrawal of N124.8 billion from the Consolidated Revenue Fund of the Federation.

The former CBN governor will be arraigned on these counts before Justice Maryann Anenih of the FCT High Court, Abuja.

This arraignment will bring to three the number of charges pending against the former CBN governor.

On Nov. 17, 2023, Emefiele was arraigned before Justice Hamza Muazu on a six-count charge of procurement fraud to which he pleaded not guilty.

He was also accused of abusing his office by approving a contract for the acquisition of 43 vehicles totalling N1.2 billion from 2018 to 2020.

On April 8, 2024, the EFCC also arraigned the former banker alongside one Henry Omoile before Justice Rahman Oshodi of the Special Offences Court sitting in Ikeja, Lagos for an alleged $4.5bn and N2.8bn fraud.

He’s also pleaded not guilty to the charge.

The new charge, dated April 2, 2024, was filed by the EFFC prosecutor Rotimi Oyedepo (SAN) alongside eight other lawyers acting on behalf of the Attorney General of the Federation.

Counts one to four of the charge, reads,  “STATEMENT OF OFFENCE: Public Servant disobeying direction of law with intent to cause injury to the public contrary to and punishable under Section 123 of the Penal Code Law, Cap. 89 Laws of the Federation, 1990.

“PARTICULARS OF THE OFFENCE: That you GODWIN IFEANYI EMEFIELE between the 19th day of October 2022 and 5th March 2023 in Abuja, knowingly disobeyed the direction of Section 19 of the CBN Act, 2007, by approving the printing of N375,520,000.00 pieces of colour swapped N1, 000, at the total cost of N11,052, 068,062 without the recommendation of the Board of Central Bank and the strict approval of the President, Federal Republic of Nigeria which conduct of yours caused injury to the public and you thereby committed an offence.”

COUNT 2: “That you, GODWIN IFEANYI EMEFIELE, between the 19th of October 2022 and 5th March 2023 in Abuja, knowingly disobeyed the direction of Section 19 of the Central Bank of Nigeria Act, 2007, by approving the printing of 172,000,000 pieces of colour swapped N500 (Five Hundred Naira) Notes, at the total cost of N4, 471,066,040 without the recommendation of the Board of Central Bank and the strict approval of the President, Federal Republic of Nigeria which conduct of yours caused injury to the public and you thereby committed an offence.

COUNT 3: “That you GODWIN IFEANYI EMEFIELE between the 19th day of October 2022 and 5th March 2023 in Abuja, knowingly disobeyed the direction of Section 19 of the CBN Act, 2007, by approving the printing of 137,070,000 pieces of colour swapped N200 (Two Hundred Naira) Note, at the total cost of N3, 441, 005, 280 without the recommendation of the Board of Central Bank and the strict approval of the President, Federal Republic of Nigeria which conduct of yours caused injury to the public and you thereby committed an offence.”

COUNT 4: “That you, GODWIN IFEANYI EMEFIELE, on or about the 7th day of October 2020, in Abuja, within the jurisdiction of this Honorable Court, knowingly disobeyed the direction of Section 80 of the Constitution of the Federal Republic of Nigeria, 1999 (As Amended), by approving the withdrawal of the total sum of N124, 860, 227, 865.16 from the Consolidated Revenue Fund of the Federation in a manner not prescribed by the National Assembly, which conduct of yours caused injury to the public and you thereby committed an offence.”

 


Kindly share this post
Continue Reading

News

KPMG Says Higher Taxes Don’t Necessarily Lead to Sustainable Growth

Published

on

Kindly share this post

KPMG, a global tax and advisory firm, has said that “no country can tax its way to prosperity,” adding that there is empirical evidence to prove that higher taxes do not lead to sustainable growth.

KPMG Says Higher Taxes Don’t Necessarily Lead to Sustainable Growth

KPMG criticised the actions of the Central Bank of Nigeria (CBN) regarding its move to implement a cybersecurity levy.

It noted that the timing of the implementation of the section of the Act is wrong considering the prevailing economic conditions in the country.

It stated that because Nigeria faces a significant revenue challenge, the government may go to any length to mobilise the required revenue. However, it was noted that higher taxes do not lead to sustainable growth.

It highlighted that even though the cybercrime levy is not new—it has existed since 2015—the timing of its implementation is suspect, considering prevailing economic challenges.

“The timing of any reforms is essential to the success of such reforms. This underscores the current public resistance to the implementation of the levy. This is certainly not the right time to implement this levy,” it said.

It stated that various reports have indicated that the government may raise about N3 trillion annually from the levy, but the government should have made a formal presentation to the public of the cost and benefit analysis. “It is always critical that the enactment of any tax or levy be accompanied by the tax expenditure statement to provide information as to whether the benefits of such tax or levy outweigh its cost,” it said.

KPMG also questioned how the implementation of the act would drive financial inclusion in the country, given the fear that individuals and businesses would resort to other forms of transaction.

Last week, the CBN asked banks and payment service providers to begin deducting 0.5 percent from electronic transactions as a cybersecurity levy to be managed by the Office of the National Security Adviser (ONSA).

President Bola Tinubu has now urged the CBN to suspend the implementation of this levy and called for a review.


Kindly share this post
Continue Reading

News

Firm Identifies Significant Security Risks in Widely used Cinterion Modems

Published

on

Kindly share this post

Kaspersky ICS CERT researchers have detected critical vulnerabilities in Cinterion cellular modems. The discovery showcases flaws that allow a remote unauthorised attacker to execute arbitrary code, constituting a major threat to millions of industrial devices. Kaspersky experts presented details on these vulnerabilities at OffensiveCon in Berlin, on May 11.

Kaspersky ICS CERT identified severe security vulnerabilities in Cinterion cellular modems, widely deployed in millions of devices and vital to global connectivity infrastructure.

These vulnerabilities include critical flaws that permit remote code execution and unauthorised privilege escalation, posing substantial risks to integral communication networks and IoT devices foundational to industrial, healthcare, automotive, financial and telecommunications sectors.

Among the vulnerabilities detected, the most alarming is CVE-2023-47610, a heap overflow vulnerability within the modem’s SUPL message handlers. This flaw enables remote attackers to execute arbitrary code via SMS, granting them unprecedented access to the modem’s operating system.

This access also facilitates the manipulation of RAM and flash memory, increasing the potential to seize complete control over the modem’s functionalities—all without authentication or requiring physical access to the device.

Further investigations exposed significant security lapses in the handling of MIDlets, Java-based applications running on the modems.

Attackers could compromise the integrity of these applications by circumventing digital signature checks, enabling unauthorised code execution with elevated privileges.

This flaw poses significant risks not only to data confidentiality and integrity, but it also escalates the threat to broader network security and device integrity.

“The vulnerabilities we found, coupled with the widespread deployment of these devices in various sectors, highlight the potential for extensive global disruption. These disturbances range from economic and operational impacts to safety issues.

“Since the modems are typically integrated in a matryoshka-style within other solutions, with products from one vendor stacked atop those from another, compiling a list of affected end products is challenging.

“Affected vendors must undertake extensive efforts to manage risks, with mitigation often feasible only on the telecom operators’ side. We hope that our in-depth analysis will help stakeholders implement urgent security measures and establish a valuable reference point for future cybersecurity research,” says Evgeny Goncharov, head of Kaspersky ICS CERT.

To counter the threat posed by the CVE-2023-47610 vulnerability, Kaspersky recommends the only reliable solution: disabling nonessential SMS messaging capabilities and employing private APNs with strict security settings.

Regarding the other zero-day vulnerabilities registered under CVE-2023-47611 through CVE-2023-47616, Kaspersky advises enforcing rigorous digital signature verification for MIDlets, controlling physical access to devices, and conducting regular security audits and updates.

In response to these discoveries, all findings were proactively shared with the manufacturer prior to public disclosure. Cinterion modems, originally developed by Gemalto, are cornerstone components in machine-to-machine (M2M) and IoT communications, supporting a wide array of applications from industrial automation and vehicle telematics to smart metering and healthcare monitoring.

Gemalto, the initial developer, was subsequently acquired by Thales. In 2023, Telit acquired Thales’ cellular IoT products business, including the Cinterion modems.


Kindly share this post
Continue Reading

Trending