E-Business

Ransomware: ESET Alerts Schools, Offers Remedy

Published

8 years ago

September 8, 2016

Kindly share this post

It can often feel like every day brings news stories about ransomware attacks on businesses, particularly at hospitals and schools.

While the life-or-death nature of hospital data might force some healthcare organizations to accede to criminals’ demands in hopes of restoring access to that data as quickly as possible, some schools are also falling prey to these demands.

Paying criminals is never a good idea, even when it seems expedient. Ransomware authors are under no obligation to actually give you what you pay for, and there have been plenty of cases where either the decryption key did not work or the ransom note never even appeared.

Suffice it to say that cybercriminals are not generally renowned for their excellent software testing or devotion to quality customer service.

There are plenty of things that you can do now that will help you avoid a school ransomware problem entirely, and there are even a few things you can do that might help repair the damage so you don’t have to fork over ransom money.

What Makes Schools Unique?
In a way, schools are like small cities: they often have healthcare clinics, stores, restaurants, sometimes even banks, plus they have accountants, administrators, etc.

They have various types of company and personal financial data, healthcare information, student and staff records – all of which are very sensitive and thus very lucrative to criminals.

Ransomware is a special situation within malware, where data are not necessarily exfiltrated from a victim’s system (as with other kinds of modern malware). Instead, access to that data is interrupted. If you’ve ever had to deal with the disquiet of a student or teacher under deadline, you know that while timely access may be less a matter of life and death than in a hospital, it’s still absolutely crucial in a school.

And while hospitals are fairly limited as to which devices are approved to enter the network, schools generally encourage their users to bring their own devices.

This brings a higher level of challenge, as an untold number of unmanaged machines are connecting to the network each day.

What can you do about it school ransomware
Let’s start with the things you can do in advance to help prevent malware from getting on your system in the first place, and to minimize damage if it does happen.

Back Up Your Data
The single most important thing you can do to prepare for emergencies, including being affected by ransomware, is having a regularly updated and secured backup. Many ransomware variants will encrypt files on drives that are mapped.

This includes any external drives such as a USB thumb drive, as well as any network or cloud file stores to which you have assigned a drive letter. So your backup needs to be on an external drive or backup service, one that is not assigned a drive letter, and that is disconnected from your systems and network when not in use.

Keep Your Software Up To Date
Malware authors frequently rely on people running outdated software with known vulnerabilities, which they can exploit to get onto your system unobserved. It can significantly decrease the potential for malware infection if you make a practice of updating your software often.

Enable automatic updates if you can, update through the software’s internal update process, or go directly to the software vendor’s website. Malware authors sometimes disguise their creations as software update notifications, so by going to known to be good software repositories you can increase the odds of getting clean, vetted updates.

On Windows, you may wish to double-check that old – and potentially vulnerable – versions of the software are removed, by looking in Add/Remove Software within the Control Panel.

Use A Reputable Security Suite
It is always a good idea to have both anti-malware software and a software firewall to help you identify threats or suspicious behavior. Malware authors frequently update their creations to try and avoid detection, so it is important to have both layers of protection.

If you run across a ransomware variant that is so new that it gets past anti-malware software, it might still be caught by a firewall when it attempts to connect with its Command and Control (C&C) Server to receive instructions for encrypting your files.

Use the Principle of Least Privilege
The Principle of Least Privilege says that no users or systems should have more access than is necessary to complete tasks that are legitimately within the scope of their work.

As a general rule, most users should not have administrative rights on their machines, and should be limited in their ability to access resources outside of their own purview.

Students should have different access levels than teachers, who should have different access than administrators. Personal devices brought from home should also be treated differently from machines that always remain within the school network. If appropriate barriers are in place, you can slow or halt the spread of malware.

Educate Your Users
While accidents do happen, it is important for all of your users to understand what acceptable use of school resources entails. This is something that should not just be done once at the beginning of the year and forgotten by the time midterms come around. It should be an exercise that is revisited frequently.

Posters or other educational materials can be displayed prominently, wherever public computers or internet connections are available. It is also imperative to encourage your users to let you know when an accident has occurred, so that damage can be limited by quick corrective action.

Rewarding safer security behaviour, including pointing out problems, can help you to foster an encouraging environment.

The next few tips are to help you deal with the methods that current ransomware variants have been using – these tips may not help in every case, but they are inexpensive and minimally intrusive ways to cut off access routes used by a variety of malware families.

Disable Macros in Microsoft Office Files
Most people may not be aware that Microsoft Office Files are like a file system within a file system, which includes the ability to use a powerful scripting language to automate almost any action you could perform with a full executable file. By disabling macros in Office files, you deactivate the use of this scripting language.

Show Hidden File-Extensions
One popular method malware uses to appear innocent, is to name files with double extensions, such as “.PDF.EXE”.

This takes advantage of default behaviour within Windows and OS X of hiding known file-extensions, Malware takes advantage of this behaviour to make a file appear to be one that would commonly be exchanged. If you enable the ability to see the full file-extension, it can be easier to spot suspicious file types.

Filter EXEs in email
If your gateway mail scanner has the ability to filter files by extension, you may wish to deny emails that arrive with “.EXE” files, or to deny emails sent with files that have two file extensions, the last one being executable (For example, “Filename.PDF.EXE”). If you do legitimately need to exchange executable files within your environment and are denying emails with “.EXE” files, you can send them within ZIP files or via cloud services. Sending in ZIP files can also give you an extra layer of assurance, as it allows you to choose an official, universal password for use within the company, which can help you identify unofficial files.

Disable files running from AppData/ LocalAppData folders
You can create rules within Windows or with Intrusion Prevention Software, to disallow unique behaviour often used by ransomware, which is to run its executable from the App Data or Local App Data folders. If you have legitimate software that you know is set to run from the App Data area (note that this is fairly unusual behaviour, and most legitimate software will allow you to choose another install location), you will need to add an exclusion from this rule.

Disable RDP
Ransomware malware sometimes accesses machines using Remote Desktop Protocol (RDP), which is a Windows utility that allows others to access your desktop remotely. If you do not need use of RDP in your environment, you can disable it to protect your machines. For instructions on how to do so, visit the appropriate Microsoft Knowledge Base article below:

Windows XP; Windows Vista; Windows 7; Windows 8; Windows 10
If you find yourself in a position where you have already run a ransomware executable without having taken any of the previous precautions, your options are more limited. There are a few things you can still do that might help mitigate the damage:

Check to see if a decryptor is available
Sometimes malware authors make mistakes and decryptors can be created. Other times, malware authors feel remorse for their actions or stop development on a particular ransomware family, and then release a decryption key. It’s worth a quick internet search to see if the solution to your problem is available for free, from a reputable source.

Disconnect from WiFi or unplug from the network immediately
If you run a file that you suspect may be ransomware, but you have not yet seen the characteristic ransomware screen, if you act very quickly you might be able to stop communication with the C&C server before it finishes encrypting your files. If you disconnect yourself from the network immediately you might decrease the number of files that it can encrypt.

Use System Restore to get back to a known-clean state
If you have System Restore enabled on your Windows machine, you might be able to take your system back to a known-clean state. Many ransomware variants will prevent this from succeeding, but it doesn’t hurt to try.

Set the BIOS clock back
Some ransomware variants have a payment timer that increases the price for your decryption key after a set time. You may be able to give yourself additional time by setting the BIOS clock back to a time before the deadline window is up.

Criminals know that the data under the care of schools are very valuable to students and staff, and this makes them a potentially lucrative target. And once a target has been identified as vulnerable, the odds increase that criminals will return to attack them again (especially with school ransomware). By taking the time to prepare before an emergency happens, you can minimize the risk of losing access to your data or of having to pay criminals to regain it.

Lysa Meyers is ESET security researcher

Kindly share this post

E-Business

FG to Fnalise National Intellectual Property Policy Soon– NCC Boss

Published

10 hours ago

April 27, 2024

Comms Week

Kindly share this post

Dr John Asein, director-general, Nigerian Copyright Commission (NCC), has said that the federal government is taking steps to finalise its National Intellectual Property (IP) Policy and Strategy for the country.

Asein disclosed this on Friday while commemorating the 2024 World Intellectual Property Day with the theme “IP and the SDGs: Building Our Common Future with Innovation and Creativity’’ in Abuja.

The that the Day is observed every April 26 to celebrate the importance of intellectual property (IP) rights to encourage innovation and creativity.

The director-general was represented by Mr Emeka Ogbonna, director of Legal.

NCC boss said the policy would serve as a blueprint for a more efficient modern and responsive legal and administrative framework for the country to leverage on its creative and innovative potential.

He said that the day underscored the power of innovation and creativity in achieving the Sustainable Development Goals (SDGs) and shaping a sustainable and inclusive future for humanity.

According to him, the SDGs represent a universal call to action to end poverty, protect the planet, and ensure prosperity for all by the year 2030.

“IP rights play a pivotal role in fostering innovation, creativity, and technological advancements. They provide the framework that encourages men and women to develop new solutions that address global challenges.

“It is the lynchpin for incentivising the use of creative and innovative ideas to solve many of the challenges that confront humanity.

“This year’s World IP Day reminds us that intellectual property can be a powerful tool for social, economic, and environmental development.

“It encourages individuals, businesses, and governments to leverage IP rights to drive innovation, create jobs, and build resilient communities.

“By aligning our intellectual property policies and strategies with the objectives of the SDGs, we can accelerate their achievement,’’ NCC boss said.

He said in the spirit of the “Renewed Hope Agenda’’ of the present administration, government had also shown appreciable commitment to the creative industry as a major sector of the economy.

“As one of the agencies responsible for the wholesome development of the creative sector, the Nigerian Copyright Commission will continue to provide the needed institutional, legal and administrative support for the protection, promotion, regulation and enforcement of copyright.

“The commission will pay particular attention to using the copyright system to advance Goal 1 (No poverty); Goal 4 (Quality education); Goal 5 (Gender equality).

“And Goal 8 (Decent and economic growth); Goal 9 (Industry, innovation and infrastructure) and Goal 17 (Partnerships to achieve the goals).

“We are aware that the goals would have to be adapted to fit the peculiar needs of intellectual property which is an intangible asset.’ ’he added.

The director-general, who said that the commission focused on the 17 SDGs to address emerging challenges, called on authors, innovators, users, IP experts and other stakeholders to reflect on the vulnerability of the nation’s fragile knowledge and creative ecosystem.

Kindly share this post

E-Business

NITDA, ICF Train 100 Schoolgirls in ICT Skills

Published

13 hours ago

April 27, 2024

Chike Onwuegbuchi

Kindly share this post

The National Information Technology Development Agency (NITDA) and Illmi Children’s Fund (ICF) have trained 100 schoolgirls in digital and Information and Communication Technology skills training.

Mrs. Maryam Augie-Abdulmumin, ICF Executive Director, confirmed this in a statement on Thursday in Lagos.

The graduation followed the training of the schoolgirls in ICF and NITDA’s DIGITGALS 2.0 programme, a collaborative initiative aimed to equip adolescent girls in Abuja with critical digital and ICT skills.

Augie-Abdukmumin said the DIGITGALS 2.0 centred around essential digital literacy, programming fundamentals, digital marketing and communication skills, and cybersecurity awareness.

She added that the girls were equipped with the confidence to compete and excel in a globalised digital economy. The graduation was in commemoration of the 2024 International Girls in ICT Day celebration on April 25.

DIGITGALS 2.0 is in its second phase and empowered 100 senior secondary school girls selected from five government schools in the Federal Capital Territory.

The girls aged between 15 and 18 years were equipped with the knowledge and tools needed to thrive in the digital world and address the growing demand for ICT skills in the 21st century.

Augie-Abdulmumin reiterated the importance of bridging the digital gap in the country starting with the girl-child.

“This graduation ceremony on International Day of Girls in ICT is a powerful symbol of our commitment to closing the digital gender gap.

This programme made possible through our partnership with NITDA, and signifies a crucial step towards bridging the digital gender gap.

It also fostering a future where women are active leaders in the tech industry. This is also an opportunity for these girls to take charge of their own future,”.

Mr Kashifu Abdullahi, the Director-General of NITDA, commended the collaborative efforts of ICF in making the DIGITGALS 2.0 a reality.

According to him, building a diverse and inclusive digital workforce is critical for Nigeria’s success.

“We are proud to collaborate with ICF on DIGITGALS 2.0 to empower these young women to become active participants in the tech industry. This programme showcases the importance of collaborative efforts in bridging the digital gender gap.

These girls have been equipped with essential digital skills, and ICF and NITDA are confident they will become active contributors to Nigeria’s thriving tech landscape,”.

ICF is a non-profit organisation dedicated to improving the lives of children, from underprivileged backgrounds, through education, healthcare, technology and entrepreneurship initiatives.

NITDA is a public service institution established in 2007. It functions as the ICT policy implementing arm of Nigeria’s Federal Ministry of Communication and Digital Economy.

Kindly share this post

E-Business

Confronting the Google Monolith: Survival Strategies for Online Businesses

Published

2 days ago

April 25, 2024

Comms Week

Kindly share this post

By Reuben Kalu.

In the vast expanse of the digital realm, Google looms large, an omnipresent force shaping the way we navigate, search, and conduct business online.

From its humble beginnings as a search engine to its current status as a multifaceted tech behemoth, Google has entrenched itself deeply into the fabric of the internet.

Its influence is undeniable, its reach unparalleled, and its ubiquity seemingly inescapable. But can you truly run an online business without Google?

The answer, in today’s digital landscape, is a resounding no. You have no choice.

Google’s dominance extends across multiple facets of the online world, making it virtually impossible for businesses to thrive without engaging with its ecosystem.

From search engine optimization (SEO) to online advertising, email services to analytics, Google’s suite of products and services permeates every aspect of the online business landscape.

Attempting to operate without Google is akin to swimming against a relentless tide, fighting an uphill battle fraught with obstacles and limitations.

At the heart of Google’s influence lies its search engine, the gateway through which billions of internet users navigate the vast expanse of online content. .

Google’s search algorithms wield immense power, determining which websites rank prominently in search results and which languish in obscurity.

For businesses seeking to attract organic traffic and expand their online presence, optimizing for Google’s search algorithms is not merely advisable—it’s imperative.

But Google’s influence extends far beyond search. Consider Google Ads, the company’s advertising platform that enables businesses to reach targeted audiences through paid search, display, and video advertising.

With billions of searches conducted on Google each day, Google Ads provides unparalleled reach and visibility, allowing businesses to target potential customers with pinpoint accuracy.

Attempting to compete in the online advertising arena without leveraging Google Ads is akin to entering a battle unarmed—a futile endeavor destined for failure.

Moreover, Google’s suite of productivity tools, including Gmail, Google Drive, and Google Workspace, has become indispensable for businesses seeking to streamline their operations and enhance collaboration.

With seamless integration across devices and platforms, Google’s productivity tools offer unparalleled convenience and efficiency, empowering businesses to work smarter, not harder.

Attempting to eschew Google’s productivity suite in favor of alternative solutions is not only impractical but also unwise, depriving businesses of the tools they need to succeed in today’s fast-paced digital landscape.

Furthermore, Google Analytics stands as the gold standard for web analytics, providing businesses with invaluable insights into their online performance and audience behavior.

From tracking website traffic and user engagement to analyzing conversion metrics and customer demographics, Google Analytics offers a comprehensive toolkit for optimizing online marketing strategies and driving business growth.

Attempting to gauge online performance without leveraging Google Analytics is akin to flying blind, devoid of the critical data needed to make informed decisions and drive meaningful results.

But perhaps the most formidable aspect of Google’s influence lies in its role as a gatekeeper of information and access.

With billions of users relying on Google’s platforms and services each day, the company wields immense control over the flow of online traffic and the dissemination of information.

For businesses seeking to connect with customers and expand their reach, Google’s dominance presents both a tremendous opportunity and a formidable challenge.

Attempting to circumvent Google’s influence and establish an online presence independent of its ecosystem is a Herculean task, fraught with uncertainty and risk.

In essence, attempting to run an online business without engaging with Google is akin to swimming against a relentless tide, fighting an uphill battle fraught with obstacles and limitations.

While alternative platforms and solutions exist, none possess the ubiquity, reach, and influence of Google’s ecosystem.

To thrive in today’s digital landscape, businesses must embrace Google’s dominance and leverage its suite of products and services to their advantage. You have no choice.

In conclusion, Google’s pervasive influence permeates every aspect of the online business landscape, making it virtually impossible to escape its grasp.

From search engine optimization to online advertising, productivity tools to web analytics, Google’s ecosystem encompasses a vast array of products and services that have become indispensable for businesses seeking to succeed in the digital age.

While alternative solutions may exist, none possess the ubiquity, reach, and influence of Google’s ecosystem.

To thrive in today’s digital landscape, businesses must embrace Google’s dominance and leverage its suite of products and services to their advantage.

You have no choice.

Kindly share this post