Speaker 1: Get in text with technology with tech Stuff from how
Speaker 1: stuff works dot com. Hey there, and welcome to tech Stuff.
Speaker 1: I'm your host, senior writer John in Strickland right for
Speaker 1: how stuff works dot com. It's a groovy website. You've
Speaker 1: never been there. You should go check it out. You've
Speaker 1: been listening to tech stuff all this time and didn't
Speaker 1: know there was website. Work on your listening skills. I
Speaker 1: love you how stuff works dot Com. Check it out.
Speaker 1: So today I thought take a look at a tech
Speaker 1: story that happened not too long ago as the recording
Speaker 1: of this podcast. I'm recording it on ma It is
Speaker 1: publishing much later than that, but not too long ago
Speaker 1: from today. A virus emerge that really caused a lot
Speaker 1: of headaches, particularly in the UK and a lot of
Speaker 1: other countries. Not so much in the United States, but
Speaker 1: a lot of other ones. And it's called Wanna Cry.
Speaker 1: It's the Wanna Cry ran somewhere virus. It really became
Speaker 1: big news starting on May twelve, sen That's where when
Speaker 1: it went viral for the first time and spread the
Speaker 1: thousands of machines. Uh. The account goes anywhere between two
Speaker 1: hundred thousand and four hundred thousand computers, depending upon what
Speaker 1: authority you're looking at. I want to cry was exploiting
Speaker 1: a vulnerability in a protocol used by the Windows operating system.
Speaker 1: But I'll explain all of that a little bit later. First,
Speaker 1: let's talk about what ransomware is and where it came from. So,
Speaker 1: to put it simply, ransomware is a subset of malware,
Speaker 1: and malware stands for malicious software. Um. You might also
Speaker 1: hear it described as a computer virus. That's largely because
Speaker 1: in the early days of personal computers there are really
Speaker 1: only two major types of malware, and those were viruses
Speaker 1: and worms. Uh, and so we've often used computer viruses
Speaker 1: shorthand for malware. But there are a lot and lots
Speaker 1: of different kinds of malware out there, and so using
Speaker 1: a term like virus is not as specific as most
Speaker 1: people would prefer. But what the heck is a virus
Speaker 1: and what the heck is a worm? Well, a virus
Speaker 1: is some malicious code that a programmer designs that inserts
Speaker 1: itself into another program. They're typically part of some sort
Speaker 1: of executable file, so e x E in the Windows
Speaker 1: operating System world or DOSS. Even the virus does not
Speaker 1: activate until the computer runs the respective file. So you
Speaker 1: can have a computer that has a virus on it,
Speaker 1: but the virus is inactive. It is dormant because you
Speaker 1: have not yet run that file, and as long as
Speaker 1: you don't run that file, the virus will remain dormant.
Speaker 1: It will be inert. But once you run the file,
Speaker 1: it activates the virus and it ends up replicating itself.
Speaker 1: Sometimes it will use other programs to spread itself to
Speaker 1: other machines. In the old days, before you had networked computers,
Speaker 1: it would essentially replicate itself over and over again in
Speaker 1: order to overwrite everything on the computer and essentially jam
Speaker 1: everything up. You couldn't end up saving anything to the computer.
Speaker 1: Everything would be overwritten by this virus, essentially rendered your
Speaker 1: computer useless. Uh. It's pretty nasty stuff. The worm, on
Speaker 1: the other hand, is a self propagating piece of code
Speaker 1: that does not rely on another file, and typically the
Speaker 1: programmer depends upon some sort of trick like social engineering
Speaker 1: to get people to execute the worm and start that
Speaker 1: self propagation process. Now, both viruses and worms are part
Speaker 1: of a larger classification of malware, and ransomware is a
Speaker 1: specific type of malware that as the name suggests holds
Speaker 1: a victim's computer for ransom. It doesn't break into their
Speaker 1: house and steal it and then put a gun to
Speaker 1: the monitor and say pay up or it gets it.
Speaker 1: Otherwise you would just need a particular set of skills
Speaker 1: to go after those folks, as we learned in the
Speaker 1: documentary Taken. Typically, malware that as ransomware will do one
Speaker 1: of two things. The most common version on desktop machines
Speaker 1: and laptops is that it will encrypt the victims computer,
Speaker 1: so that means it will encode your computer so that
Speaker 1: none of your files will be readable or even you know,
Speaker 1: you won't even be able to locate them because they're
Speaker 1: all renamed. Under this nonsense encryption approach, that can end
Speaker 1: up causing your computer to be useless or at least
Speaker 1: give make it your information inaccessible. The goal is to
Speaker 1: get the victim to fork over some cash and in return,
Speaker 1: the hackers will decrypt the computer. They'll give whatever the
Speaker 1: password is or the methodology to decrypt all the information
Speaker 1: and turn it back to the way it was before
Speaker 1: it was attacked. Now, uh, there's the second variant of
Speaker 1: ransomware that doesn't encrypt a computer. Instead, what it does
Speaker 1: is locks people out of a device. This is the
Speaker 1: locker version of in somewhere. It's most frequently seen in
Speaker 1: Android based devices, so mostly mobile sets like handsets, tablets,
Speaker 1: that kind of thing. And essentially hackers full of victim
Speaker 1: into downloading and installing a malicious app, and then the
Speaker 1: app will then activate this software that locks the victim
Speaker 1: off from accessing their device. They won't be able to
Speaker 1: use it, essentially bricks it until you are to pay
Speaker 1: up a ransom. You might get like a little screen
Speaker 1: that demons that shows you, you know, until you pay
Speaker 1: x amount to why you won't have access to this device.
Speaker 1: So you are told that you have to pay the
Speaker 1: hackers in order to regain access to your device. And
Speaker 1: in either case, ransomware is not pretty. Now. This is
Speaker 1: similar to, but distinct from, another scheme that some hackers
Speaker 1: employ over the last few years, which is blackmail. Hacker
Speaker 1: groups like rex Mundy have targeted large corporations with a
Speaker 1: goal of infiltrating their systems and dealing as much data
Speaker 1: as possible, including customer data. That's one of the big targets.
Speaker 1: So having that customer data is a very powerful tool.
Speaker 1: Companies do not want their customers to lose confidence in them.
Speaker 1: So if a hacker group is able to get hold
Speaker 1: of a huge amount of customer information from a company
Speaker 1: and then say, hey, if you don't pay up, we're
Speaker 1: going to release this information or we're gonna sell it off. Uh,
Speaker 1: it's bad news and it's very hard to recover as
Speaker 1: a company if you've suffered that kind of data breach.
Speaker 1: So it's similar to blackmail, but not exactly the same
Speaker 1: because with ransomware, the hackers might not even be interested
Speaker 1: at all in what's on the computer systems they target.
Speaker 1: They don't care if there's customer information or if it's
Speaker 1: internal systems that that doesn't matter. What they want to
Speaker 1: do is affect as many critical computers as they possibly
Speaker 1: can with ransomware, because if it's a critical device, if
Speaker 1: it's something that's very important for the operations of a
Speaker 1: larger organization or company, then that puts a huge amount
Speaker 1: of pressure on the company to pay up the ransom
Speaker 1: so they can get access to that critical hardware. Again, um,
Speaker 1: that's the whole point of ransomware. They don't they don't
Speaker 1: care if it's you know, what the nature of the
Speaker 1: stuff is, as long as it's important because they're not
Speaker 1: after the data itself there after money. They just want
Speaker 1: to lock down those computers as much as they can
Speaker 1: and then convince people to pay them so that they
Speaker 1: can unlock them. Now, the first recorded instance of ransomware
Speaker 1: was called the AIDS trojan and it was designed by
Speaker 1: Joseph L. Pop p O p P. That particular attack
Speaker 1: falls under the category of the trojan horse, which is
Speaker 1: of course named after the legendary gift to the city
Speaker 1: of Troy that secretly housed invading soldiers that were from Greece.
Speaker 1: A trojan horse is malware that that looks like a
Speaker 1: regular program. It fools someone into thinking they're using some
Speaker 1: benign piece of software, but in reality they're essentially handing
Speaker 1: over some critical part of their computer systems to the
Speaker 1: whims of a hacker. So a lot of trojan horse
Speaker 1: programs these days are programs that look like they're innocent.
Speaker 1: You run them, and then it allows a hacker to
Speaker 1: get a back end, like a back door entry into
Speaker 1: your computer, usually administrative level control, and from there they
Speaker 1: can do lots of different things. They can lock you
Speaker 1: out of a system, They can allow you to continue
Speaker 1: using a system so that you don't know that they're
Speaker 1: even there. They can spy on what you're doing. They
Speaker 1: can even redirect your computer to send traffic to a
Speaker 1: target machine as part of the distributed denial of service attacks.
Speaker 1: So this is a very common ploy that hackers will
Speaker 1: use in order to build bot nets or computer armies. Now,
Speaker 1: the AIDS trojan virus predates the World Wide Web, so
Speaker 1: this was not a virus that was spread over email.
Speaker 1: It wasn't spread over a compromised website. It was distributed
Speaker 1: actually on floppy disks, good old floppy disks, and they
Speaker 1: were sent over the postal service. Most of the recipients
Speaker 1: were from other parts of the world, not the United States.
Speaker 1: Here in the US, we really didn't have an issue
Speaker 1: with the AIDS trojan virus directly. These were the targeted
Speaker 1: systems were mostly in other places in the world, like Europe,
Speaker 1: in Africa, in uh Asia, that kind of thing. So
Speaker 1: the target for this attack happened to be companies and
Speaker 1: agencies that were either in education or healthcare, and they
Speaker 1: were concerned with educating people about the AIDS virus. The
Speaker 1: disc was posing as educational software that was to teach
Speaker 1: you about the AIDS virus. So it's pretty insidious that
Speaker 1: it was. It took on this form. The software on
Speaker 1: the disc included an actual survey that would tell the
Speaker 1: taker what their odds were of contracting the AIDS virus
Speaker 1: based off their responses. So, for example, it might ask
Speaker 1: if you take intrivinous drugs and if so, do you
Speaker 1: share needles? That sort of thing, and as you would
Speaker 1: answer it, it would give you the odds of you
Speaker 1: contracting the AIDS fires. So on the surface, it seemed
Speaker 1: like actual educational software. What you didn't realize as you
Speaker 1: ran this software on your computer is that in the
Speaker 1: background code was running so that it would infect the computer,
Speaker 1: and after a predetermined number of reboots to the system,
Speaker 1: the software would encrypt all of your files. So, in
Speaker 1: other words, it would set up as kind of a
Speaker 1: doomsday clock, except instead of time, it was in reboots.
Speaker 1: So every time you shut down your system and turned
Speaker 1: it on, you were one step closer to activating this worm,
Speaker 1: and eventually you would hit that threshold old and the
Speaker 1: next time you turned on your computer, all of your
Speaker 1: files would get encrypted by this by this malware. The
Speaker 1: only thing you would see when you would reboot that
Speaker 1: system that last time would be a message that says
Speaker 1: turn on a printer. So essentially you'd have to have
Speaker 1: a printer connected to the affected computer and when you
Speaker 1: turned it on, it would send a print command to
Speaker 1: the printer and print on a sheet of paper with
Speaker 1: the instructions to pay the ransom, which is kind of interesting,
Speaker 1: a little primitive, but obviously you didn't have bitcoin or
Speaker 1: anything like that back in those days, so the ransom
Speaker 1: note would print out once the computer was activated or
Speaker 1: connected to an activated printer. The note directed victims to
Speaker 1: send one eighty nine dollars to a post office box
Speaker 1: located in Panama. After doing so, uh Pop, who of
Speaker 1: course was not identifying himself as the perpetrator, promised that
Speaker 1: he would send the decryption program to unlock the contents
Speaker 1: of the victim's computers. In the UK, where the virus
Speaker 1: was first reported, some medical institutions began to delete data
Speaker 1: rather than pay the ransom. They were worried that their
Speaker 1: systems have been totally compromised and that a hacker had
Speaker 1: access to all of that data, so as a result,
Speaker 1: they started the leading stuff, and in fact other parts
Speaker 1: of the world were following a similar strategy. The Independent
Speaker 1: reported that there was one organization in Italy that lost
Speaker 1: a decade's worth of AIDS research as a result of this,
Speaker 1: because there was a panic that uh, the compromised data
Speaker 1: could be otherwise changed or altered, UH, which I guess
Speaker 1: is repetitive or redundant, but at any rate that they
Speaker 1: were worried that this vulnerability was worse than what they
Speaker 1: were already seeing. So there were people who who lost
Speaker 1: years and years of work as a result of this
Speaker 1: ransomware attack. Now I mentioned earlier, we know who made
Speaker 1: this virus. So knowing who made it, what exactly happened?
Speaker 1: How did this story unfold? It's a bit strange, to
Speaker 1: be honest. So let's give you some background on the
Speaker 1: man who had programmed the virus in the first place.
Speaker 1: Joseph L. Pop had graduated with a PhD from Harvard University,
Speaker 1: and he was in the field of evolutionary biologies, not
Speaker 1: in the field that you would immediately associate with someone
Speaker 1: who's programming the world's first ransomware virus. UH. He was
Speaker 1: actually not an enemy to AIDS research. That was his field.
Speaker 1: He was consulting with the World Health Organization in the
Speaker 1: area of AIDS research over in Kenya, so why would
Speaker 1: he design a computer program that locked away computers used
Speaker 1: by people who were trying to research AIDS and provide
Speaker 1: education for at risk populations. Well, that depends upon whose
Speaker 1: story you believe. So story number one came from Pop's lawyer,
Speaker 1: who said that Pop's plan was to shake things up.
Speaker 1: He wanted to change the the whole model of how
Speaker 1: AIDS research was going about. He thought it was two regimented,
Speaker 1: he thought it was off base. According to the lawyer,
Speaker 1: uh and that Pop's plan was to use the ransom
Speaker 1: money that he would get from people paying this d
Speaker 1: dollars a pop to fund alternative AIDS education programs. So
Speaker 1: you could argue that if this is actually the case,
Speaker 1: this was a protest against the establishment and their approach
Speaker 1: to AIDS research. So you would think of Pop as
Speaker 1: some sort of crypto activist or crypto anarchist. But the
Speaker 1: judge in the case actually disagreed with this and said
Speaker 1: that Pop just wasn't even fit to stand trial, and
Speaker 1: this was because his behavior had become something pretty strange
Speaker 1: and erratic. He was the reason he was caught in
Speaker 1: the first place. I mean, he could have just gotten
Speaker 1: away from Europe and and no one would have ever
Speaker 1: known it was him. The reason he was caught was
Speaker 1: that he was in an airport in Amsterdam and he
Speaker 1: wrote the sentence doctor Pop has been poisoned, which I
Speaker 1: think would make a great title for an album, but
Speaker 1: he wrote it on another passenger suitcase. It's pretty strange already.
Speaker 1: Apparently he had been um acting somewhat unusually as the
Speaker 1: stress was getting to him about trying to get out
Speaker 1: of Europe while this story about the AIDS trojan virus
Speaker 1: was making headlines over there, so he was feeling a
Speaker 1: lot of pressure, and according to some stories, at least
Speaker 1: he cracked well. The authorities saw that he was writing
Speaker 1: stuff on other people's suitcases and took him aside for questioning,
Speaker 1: and they searched his baggage, and when they did, they
Speaker 1: found evidence that he was the one behind manufacturing and
Speaker 1: distributing all those discs that had the malware on them. So,
Speaker 1: while he was waiting for trial in the UK, his
Speaker 1: behavior grew increasingly strange, and eventually Judge Jeffrey Rivlin dismissed
Speaker 1: the case because he said that Pop was unfit to
Speaker 1: stand trial. Pop was released and essentially got off scott free.
Speaker 1: He eventually would open up a butterfly conservatory in upstate
Speaker 1: New York. So you can go see Joseph L. Pop's
Speaker 1: butterfly Conservatory and see the the conservatory built by a
Speaker 1: guy who built the first ransomware in the world, which
Speaker 1: is a little unusual. There is another theory about what
Speaker 1: pops motivations were that have nothing to do with crypto
Speaker 1: anarchist tendencies or erratic behavior. It's not nearly as grand
Speaker 1: an act as all that, it's not as strange as
Speaker 1: all that. The theory states that Pop was actually just
Speaker 1: seeking revenge. He had been passed over for a position
Speaker 1: with the World Health Organization, so some theories say he
Speaker 1: got very upset that he wasn't picked for this job,
Speaker 1: and as a result, he designed and then unleashed the
Speaker 1: software targeting organizations that he felt he should have been
Speaker 1: taking a larger role in, but because he got passed over,
Speaker 1: he didn't have that opportunity. And he even had a
Speaker 1: digital diary that contained evidence that he had been planning
Speaker 1: this attack for more than a year and a half,
Speaker 1: so it was a premeditated act, not something that was
Speaker 1: done spontaneously, at least according to that digital diary. Ah. So,
Speaker 1: there are some people who say that he was just
Speaker 1: bitter about not getting that job, and that was the
Speaker 1: motivation he had for building the first ransomware. But whatever
Speaker 1: the reason, he didn't serve any time for his crime.
Speaker 1: And his encryption scheme was relatively simple to reverse. It
Speaker 1: was symmetric encryption, and it wasn't particularly robust, so after
Speaker 1: some time, experts were able to figure out how to
Speaker 1: reverse engineer it, essentially using brute force to decrypt the
Speaker 1: affected computers. So uh, it really wasn't as bad as
Speaker 1: it could have been, or as it later would turn
Speaker 1: to be, as future ransomware hackers would create more robust
Speaker 1: means of of putting your data off limits. So one
Speaker 1: thing that Pop also set into motion was this tendency
Speaker 1: for hackers who have developed ransomware to target healthcare organizations,
Speaker 1: whether it's hospitals or organizations that are related to healthcare,
Speaker 1: that's a prime target for ransomware. And the reason is
Speaker 1: the information inside those computers is critical, literally critical to
Speaker 1: the lives of human beings. So by targeting these very
Speaker 1: critical systems that have a high sense of of urgency
Speaker 1: about the data that they contain, the hackers are maximizing
Speaker 1: the chance that people will give in and pay their demands.
Speaker 1: So two different trends that he started. He started the
Speaker 1: ransomware trend and he started the targeting healthcare trend, both
Speaker 1: of which are pretty odious, I would say, But yeah,
Speaker 1: the more valuable and urgent the information is, the more
Speaker 1: likely you are to pay up when something gets locked away.
Speaker 1: Now we'll talk more about early ransomware in just a minute,
Speaker 1: but before we jump into that, let's take a quick
Speaker 1: break to thank our sponsor. So early ransomware attackers would
Speaker 1: originally they were building their own encryption codes to convert
Speaker 1: files into seemingly meaningless gibberish. So what's going on with
Speaker 1: encryption in the first place? What does that actually mean?
Speaker 1: I used the term a lot. You've probably heard it
Speaker 1: a lot, and some of you are probably very familiar
Speaker 1: with the whole concept of encryption. But in case you
Speaker 1: are not, and you're wondering, what does that even mean?
Speaker 1: I mean, I get that it turning my files into
Speaker 1: stuff that I can't read, but what is actually happening?
Speaker 1: I thought I would give a very very basic explanation
Speaker 1: of what encryption is. Now, keep in mind, this is
Speaker 1: at its most basic level encryption involves using a key
Speaker 1: to encode data in a way that makes it meaningless
Speaker 1: to an outside observer who does not also possess that key.
Speaker 1: So this is just making codes essentially, It's what it
Speaker 1: boils down to. It's just using a very advanced algorithm
Speaker 1: in order to do it, and using a huge number
Speaker 1: of potential of variations on that so that you make
Speaker 1: it very very difficult for people to reverse engineer the
Speaker 1: strategy you use to encrypt the information, thus making it safe. Uh,
Speaker 1: if you use a very simple set of rules, then
Speaker 1: obviously your data isn't that safe. All it takes is
Speaker 1: someone to notice what the rules are and then they
Speaker 1: can reverse it that way. So if you've ever used
Speaker 1: a substitut tuition cipher, you're you've experimented with an extremely
Speaker 1: simple version of encryption. So you might decide with a
Speaker 1: buddy that you're going to shift all the meaning of
Speaker 1: letters one over from their actual place on the alphabet,
Speaker 1: so that when you write your to a message encode
Speaker 1: to your buddy, a B is an A, and a
Speaker 1: C is a B, and so on and so forth.
Speaker 1: That's a very simple one shift substitution cipher. When you
Speaker 1: receive a message, you use that key, which in this
Speaker 1: case is just that very simple rule to decode the message,
Speaker 1: and then you read it, and then later that night
Speaker 1: you'll probably TP someone's home, because that's the kind of
Speaker 1: thing we allows the kids used to do before there
Speaker 1: was an Internet and Nintendo switches and whatnot. Obviously, computers
Speaker 1: are using much more robust encryption techniques than a simple
Speaker 1: substitution cipher. The goal is to create a method of
Speaker 1: encryption that is so sophisticated that it would take someone
Speaker 1: years or even decades before they could decrypt the information
Speaker 1: without the use of a key in others, to use
Speaker 1: brute force. Brute force is essentially when you just tele computer,
Speaker 1: I want you to work through every variation of this
Speaker 1: particular approach until you find the one that works. And
Speaker 1: the more approaches there are, the longer that will take
Speaker 1: a computer to accomplish. So your goal is to make
Speaker 1: the encryption process difficult enough so that a computer doesn't
Speaker 1: have any hope of solving it by brute force in
Speaker 1: any reasonable amount of time. The earliest forms of computer
Speaker 1: encryption used a fifty six bit key. Now remember a
Speaker 1: bit is a single unit of information. It is either
Speaker 1: a zero or a one. So if you have fifty
Speaker 1: six bits, how many different combinations will that get you.
Speaker 1: The answer is it's around seventy quadrillion possible combinations. That
Speaker 1: sounds like a lot, seventy quadrillion, but as it turns out,
Speaker 1: modern computers can brute for us that fairly quickly, quickly
Speaker 1: being a relative term. But it's not impossible to use
Speaker 1: brute force and break that kind of encryption, so it's
Speaker 1: not safe. So today you would use a much higher
Speaker 1: uh bit for your encryption, like two fifty six bit encryption,
Speaker 1: which gives you way more potential combinations, exponentially more combinations.
Speaker 1: So to decrypt without brute force, if you're not going
Speaker 1: to try and just force all those different variations through,
Speaker 1: you need that key. The key is like a secret
Speaker 1: dacoder ring. So if you get hit with ransomware, what
Speaker 1: the hackers are actually offering you is the decryption key.
Speaker 1: In exchange for money you pay them, they give you
Speaker 1: the secret super secret dacoder rings, so you can decode
Speaker 1: all that stuff that's on your computer and you can
Speaker 1: use it again. These days, the money is typically demanded
Speaker 1: in the form of digital currency like bitcoin, or in
Speaker 1: prepaid cards like money Pack, which, by the way, and
Speaker 1: one of the stories I was reading was misspelled with
Speaker 1: a typo calling it monkey pack, and I wish it
Speaker 1: was monkey Pack, but monkey Pack is a brand of backpacks.
Speaker 1: It is not a method of cash transfer, unless you
Speaker 1: were to stuff a monkey pack filled with money and
Speaker 1: then hand it to someone, then technically it is cash transfer.
Speaker 1: But I'm pretty sure that the the author of the
Speaker 1: article meant money Pack. More's the pity. So using Bitcoin
Speaker 1: or these prepaid options it allows hackers to maintain their anonymity,
Speaker 1: as opposed to giving you an address, like a physical
Speaker 1: address to send money to, which you know you could
Speaker 1: just hand over to authorities who would then stake it
Speaker 1: out and try and catch the people who are responsible.
Speaker 1: Using the digital approach, it's a lot harder to do that.
Speaker 1: Since ransomware has become a more popular method to attack computers,
Speaker 1: and it really took off once the World Wide Web
Speaker 1: matured and upon the launch of the smartphone industry as well.
Speaker 1: The Internet Crime Complaint Center or I SEE three says
Speaker 1: that between two thousand five and two thousand sixteen they
Speaker 1: received reports of more than seven thousand, six hundred ransomware attacks,
Speaker 1: and by comparison, the i C three says it received
Speaker 1: more than six thousand reports of data breaches, so ransomware
Speaker 1: actually outnumbers data breaches the information you tend to see
Speaker 1: in the US, at least, you see these big stories
Speaker 1: about companies that had their systems compromised and people stole
Speaker 1: a lot of information. That's a data breach. The big
Speaker 1: Sony data breach from a few years ago is a
Speaker 1: great example. Um not that it's great, but it serves
Speaker 1: as a great example. Ransomware actually happens way more frequently
Speaker 1: than those big data breaches because again, you don't have
Speaker 1: to care about what information is in the system. You
Speaker 1: just want to make it unreachable. So all you have
Speaker 1: to do is fool someone into executing some malicious code,
Speaker 1: and depending upon the nature of the malware, you might
Speaker 1: be able to infect an entire system just through one
Speaker 1: point of entry. You don't have to try and navigate
Speaker 1: a complex and potentially very secure system of computers in
Speaker 1: order to look for specific information, because again you don't
Speaker 1: care what the information is, You just want them to
Speaker 1: have no access to it. Now, in the mid two thousands,
Speaker 1: there are a lot of different types of malware in
Speaker 1: the ransomware category that debuted that included stuff like gp code, Archivas, Crotton,
Speaker 1: cry Zip, may Archive, and troj Dot ransom dot A
Speaker 1: and these were using tougher algorithms that were harder to crack.
Speaker 1: Arcives was one of the first, and it used our
Speaker 1: essay encryption and demanded that users visit specific websites to
Speaker 1: make purchases and are to buy a password to remove
Speaker 1: the lock on their files. So you would get a
Speaker 1: message saying you need to go to this pharmacy's website
Speaker 1: and you need to buy x amount of drugs from
Speaker 1: this pharmacy, and after you do, we'll give you the password.
Speaker 1: Pretty aggressive marketing scheme for that pharmacy, if you were
Speaker 1: to ask me. Obviously it was a front for these hackers,
Speaker 1: but pretty nasty stuff. And more and more frequently hackers
Speaker 1: began to use off the shelf solutions as time went on.
Speaker 1: Rather than build their own encryption codes, they began to
Speaker 1: use stuff that a couple of people had developed and
Speaker 1: then had released out into the wild for others to
Speaker 1: use at their own discretion. So this did two things.
Speaker 1: It increased the sophistication of the encryption algorithms that the
Speaker 1: hackers were using, and it lowered the barrier to entrgue
Speaker 1: for hackers to the point where if you are willing
Speaker 1: to pay the money, you and get very simple hacker
Speaker 1: tool kits that are easy to run. Like they are
Speaker 1: they are made to be user friendly for the hacker
Speaker 1: UM and you don't have to know how they work.
Speaker 1: You just have to use them. It's like using any
Speaker 1: other program on a computer. You don't have to know
Speaker 1: how it works in order for it to work. And
Speaker 1: that makes it much more dangerous because it suddenly makes
Speaker 1: ransomware a more viable option for a larger group of
Speaker 1: people and thus put more computers at risk. It's a
Speaker 1: pretty ugly cycle. So you also saw websites began to
Speaker 1: get compromised and that became an issue too. UM and
Speaker 1: you also started to see malware that would copy notifications
Speaker 1: from trusted sources to fool people into installing malicious software.
Speaker 1: So you've probably encountered something like this in the past.
Speaker 1: You may have gone to a website that was not secure,
Speaker 1: it was maybe a compromised website, and you might get
Speaker 1: a pop up window that says, hey, you need to
Speaker 1: update your flash, so that you can watch this content,
Speaker 1: or you might get a notification saying, hey, the FBI
Speaker 1: is looking at you right now, so you need to
Speaker 1: follow this this link. But in in general, these are
Speaker 1: not legitimate things. These are actually phishing attempts to try
Speaker 1: and get you to click on stuff to download and
Speaker 1: install the malware so that you compromise your own computer.
Speaker 1: So don't do that, and don't go to that website anymore.
Speaker 1: It's been compromised. It is not a nice place for
Speaker 1: you to go visit. Go outside, get some fresh air,
Speaker 1: or if it's on your phone, turn your phone off.
Speaker 1: You know, just be careful. Over time, the demands from
Speaker 1: hackers have increased as well as the sophistication of the
Speaker 1: hacking program. In the mid two thousand's, the typical demand
Speaker 1: for payment is hovering somewhere around three hundred dollars, typically
Speaker 1: between two hundred and four hundred bucks. And this is
Speaker 1: where the economies of scale come into place. A three
Speaker 1: hundred dollars in the grand scheme of things is not
Speaker 1: that much money. Now, it's not cheap. Three dollars is significant.
Speaker 1: I mean, I'm not gonna just drop three hundred bucks
Speaker 1: and walk away without a care. In the world. That's
Speaker 1: it's a significant amount of money, but it's not an
Speaker 1: enormous ransom. It's not like the sort of stuff you
Speaker 1: see in movies where a character gets kidnapped and then
Speaker 1: the the kidnappers demand a million dollars in ransom money.
Speaker 1: It's three hundred bucks. However, you also have to remember
Speaker 1: that ransomware typically if it's being really successful, is infecting
Speaker 1: hundreds or thousands of computers at three hundred bucks of pop.
Speaker 1: Assuming that people are playing ball, that ends up adding
Speaker 1: up pretty quickly, so it ends up being uh an
Speaker 1: effective way to extort people out of money. Today, the
Speaker 1: price is closer to five dollars on average, so it's
Speaker 1: gone up. It's no longer around three hundreds, around five.
Speaker 1: And again, just through sheer number alone, you can see
Speaker 1: the potential for hackers to make lots of money using
Speaker 1: this methodology. And also a lot of the software today
Speaker 1: comes along with a deadline, so it's not just that
Speaker 1: your information is locked away, but that you have a
Speaker 1: limited amount of time before UH something worse happens to you.
Speaker 1: So you've gotta like pay up before the end of
Speaker 1: the month, or we'll start deleting your information. We'll start
Speaker 1: deleting your files so that not only are they not
Speaker 1: accessible to you now, you'll never be able to access
Speaker 1: them again because we're gonna completely delete and overwrite them.
Speaker 1: So it becomes that kind of level of extortion. You know,
Speaker 1: you've got a nice, uh database, only it sure would
Speaker 1: be a shame as someone out though encrypted it and
Speaker 1: then stead deleting it piece by peace. That's the sort
Speaker 1: of message that the hackers are sending. So it's definitely
Speaker 1: gotten more sophisticated, more expensive, and more um malicious over time. However,
Speaker 1: ransomware does tend to change very quickly. You don't tend
Speaker 1: to see one type of ransomware dominate for longer than
Speaker 1: say a year or so. Kaspersky Labs, which is a
Speaker 1: computer security company, reported that the most prominent ransomware between
Speaker 1: two thousand and fourteen and two thousand fifteen was a
Speaker 1: program called crypto Wall, which accounted for more than half
Speaker 1: of all the ransomware examples found in the wild. Something
Speaker 1: like fifty eight percent of all ransomware was crypto Wall
Speaker 1: or some variation of crypto Wall, and according to the FBI,
Speaker 1: the hackers behind crypto Wall made eighteen million dollars from
Speaker 1: their victims, and crypto Wall was one of the earliest
Speaker 1: types of ransomware to spread over compromised websites, and earlier
Speaker 1: ransomwarely relied on other methodology too for distribution, but crypto
Speaker 1: wall went through compromise websites and email attachments and affected
Speaker 1: a lot of targeted computers. It used a two hundred
Speaker 1: fifty six bit key to encrypt specific types of files,
Speaker 1: so it would look for files that had uh specific
Speaker 1: extensions like a dot d C file, a dot A
Speaker 1: document file. It would look for those sorts of files
Speaker 1: and encrypt them using this two d fifty six bit key.
Speaker 1: Then it would use a two thousand, forty eight bit
Speaker 1: r s A key to encrypt the two fifties six
Speaker 1: bit key. This double encryption made it much more difficult
Speaker 1: for you to figure out how to reverse the process.
Speaker 1: But the following year saw crypto wall reduced to just
Speaker 1: five point one of all ransomware, so it went from
Speaker 1: fifty eight percent to five point to one percent in
Speaker 1: the span of one year. The new heavy hitter was
Speaker 1: a piece of software called Tesla crypt, and the hackers
Speaker 1: behind that malware frequently demanded their ransoms in Bitcoin and
Speaker 1: other forms of digital payment. Ransomware attackers continued to aim
Speaker 1: at the healthcare industry for the reasons I mentioned earlier.
Speaker 1: Hospitals have been affected by various types of ransomware UH.
Speaker 1: Some of them include Los Angeles Hollywood Presbyterian Medical Center,
Speaker 1: the Los Angeles County Department of Health Services, Ottawa Hospital,
Speaker 1: Kentucky Methodist Hospital, and lots and lots of others. A
Speaker 1: ton of them are in California. In fact, in some cases,
Speaker 1: hospitals paid the ransom in order to regain control and
Speaker 1: access of their systems, but in other cases, savvy tech
Speaker 1: professionals were helping to quarantine affected computers to disconnect them
Speaker 1: from the network so that they wouldn't spread the malware
Speaker 1: further into the system. And then they worked to UH
Speaker 1: to reboot the systems using old backups, so essentially going
Speaker 1: to the backup files and you know, you lose some
Speaker 1: stuff because chances are you generated some data since the
Speaker 1: last backup, but it meant that they got back these
Speaker 1: systems UH and didn't have to pay the ransom in
Speaker 1: several cases. Now, sometimes hackers have a real flair for
Speaker 1: the dramatic UH. There's the team that's behind the Jigsaw ransomware,
Speaker 1: Jigsaw taking its name from the villain in the Saw
Speaker 1: series of films. The malware not only locked the victim's computer,
Speaker 1: but displayed an image of the puppet that was used
Speaker 1: by Jigsaw, Billy, the puppet from the Saw series, And
Speaker 1: there was a message there that would state that rather
Speaker 1: than just a regular deadline, Jigsaw would delete files as
Speaker 1: time passed, like every hour that passed would mean more
Speaker 1: files deleted. So the longer you waited, the more information
Speaker 1: you would lose. That gave that sense of urgency to
Speaker 1: pay off the hackers. H And also if you turned
Speaker 1: off your computer, it was even worse really, because the
Speaker 1: next time you booted your computer, one thousand files would
Speaker 1: be deleted from your computer. It was an incentive to
Speaker 1: not turn your system off, um, because once you turn
Speaker 1: it on again, you would lose a thousand times what
Speaker 1: you would lose every hour. It's pretty evil. By fourteen,
Speaker 1: hackers were designing locker based ransomware for Android systems, and
Speaker 1: one of those was Saiping, which used fake Adobe Flash
Speaker 1: update messages to commence users to install the malware that
Speaker 1: would lock you out of your Android device until you
Speaker 1: paid a two D dollar ransom using money packs. Those
Speaker 1: are those prepaid charge cards. So what happened is when
Speaker 1: you try to activate your phone, instead of getting the
Speaker 1: screen to unlock your phone, you've got a message saying
Speaker 1: you had to pay this amount of money uh in
Speaker 1: money packs to this particular account or you would not
Speaker 1: get access to your phone again. A similar piece of
Speaker 1: ransomware was called Coal or ko l e R or
Speaker 1: Color if you prefer, which claimed that the holder of
Speaker 1: the phone was being investigated by law enforcement and then
Speaker 1: they were being fined as a result. So this is
Speaker 1: playing on people's fear, right Like if you send them
Speaker 1: a message saying, hey, you're in trouble and unless you
Speaker 1: follow this link, you're gonna go to jail, that gives
Speaker 1: people a big incentive to try and figure out what's
Speaker 1: going on. A lot of people are going to click
Speaker 1: that link, not thinking that, hey, the FBI probably doesn't
Speaker 1: reach out through websites to let you know that you're
Speaker 1: in trouble. They probably come door to door for that
Speaker 1: kind of thing. But uh, it's the sort of thing
Speaker 1: that's meant to instill panic. And when we panic, we
Speaker 1: make bad decisions. We make very quick decisions. We don't
Speaker 1: think we don't use critical thinking. So that's the whole
Speaker 1: method of attack in this type of ransomware. So this
Speaker 1: one also added a nasty additional kick. It was a
Speaker 1: locker worm type of all where that would then send
Speaker 1: messages to anyone in the context list of a compromised device.
Speaker 1: So if you got me with that, if you send
Speaker 1: me a message saying, hey, we're the FBI and your
Speaker 1: totes in trouble brow and I fell for it and
Speaker 1: I clicked on it, then it would the malware would
Speaker 1: not only lock me on my phone, it would go
Speaker 1: through my contact list and send a message out to
Speaker 1: everyone in my contact list with a similar message in
Speaker 1: the hopes of catching even more people. So this way
Speaker 1: you allow the virus to propagate across the network. All
Speaker 1: you have to do is in fact a couple of
Speaker 1: well connected people, and chances are you're going to see
Speaker 1: a lot more infected devices as a resultant that becomes
Speaker 1: like a ripple effect that keeps moving out from the source. Uh,
Speaker 1: people who are savvy to it will ignore it, but
Speaker 1: that doesn't help all the people who don't ignore it.
Speaker 1: It's pretty nasty stuff though. By two thousand fifteen, enterprising
Speaker 1: programmers began to create ransomware as a service or are
Speaker 1: a a s now. These were the people who had
Speaker 1: designed the tools that other folks would actually use. So
Speaker 1: you might have programmers who have no desire to actually
Speaker 1: use ransomware themselves. They're not directly going to put it
Speaker 1: to use. Instead, they'll sell it to hackers who do
Speaker 1: want to use it, but who don't have the ability
Speaker 1: to program or design these algorithms or these types of malware,
Speaker 1: and so you'd sell it for like a thousand to
Speaker 1: three thousand dollars. There's a lot of money, but when
Speaker 1: you factor into the account the fact that you can
Speaker 1: demand five h bucks per locked computer, and if you're
Speaker 1: hitting thousands of them, three thousand dollars is nothing. A
Speaker 1: lot of these ransomware as a service providers also demand
Speaker 1: a certain percentage of the profits, like ten, but still
Speaker 1: you're still talking huge amounts of money, So it doesn't
Speaker 1: take very many victims to play ball before you recapture
Speaker 1: your costs, and it makes ransomware even more prevalent. One
Speaker 1: ransomware attack that made headlines in the United States happened
Speaker 1: on November That was the Friday following the US holiday
Speaker 1: of Thanksgiving, which is also known as Black Friday. For
Speaker 1: those who don't know what Black Friday is, that's a day.
Speaker 1: It's called that because a lot of stores will open
Speaker 1: up with special sales and it's all in an effort
Speaker 1: to sell enough stuff to make an overall profit for
Speaker 1: the end of the year, to go in the black.
Speaker 1: As they say, if you're in the red, that means
Speaker 1: that you're operating at a loss. If you're in the black,
Speaker 1: you're operating at a profit. That's why it's called Black Friday. Well,
Speaker 1: that's a very popular day for people to go out shopping,
Speaker 1: and it means it's also a popular day to to
Speaker 1: just get outside and travel. So the hackers had targeted
Speaker 1: San Francisco's municipal transportation system also known as MUNI, M
Speaker 1: You and I, and on that day they were able
Speaker 1: to infect the ticketing and bus management system for MUNI
Speaker 1: with a ransomware attack. They demanded one hundred bitcoin for
Speaker 1: the antidote for the the key to decode everything uh
Speaker 1: and at that time a hundred bitcoin was worth about
Speaker 1: seventy three thousand dollars. But instead of paying the ransom,
Speaker 1: MUNI decided to offer free rides to passengers while they
Speaker 1: worked on a solution. So for two days you could
Speaker 1: ride Muni absolutely free. You didn't have to have a
Speaker 1: ticket or anything. You could just get on um. But
Speaker 1: then once they were able to reboot the system and
Speaker 1: restore from backup the it was back to normal operations.
Speaker 1: So it was only a temporary downtime for Muni. It
Speaker 1: was very you know, it was still damaging because that's
Speaker 1: two days without any revenue, but it showed that the
Speaker 1: city of San Francisco and Muni in particular, was not
Speaker 1: willing to play ball by the hackers standards. Now, there
Speaker 1: are dozens of other variations that have appeared over the years,
Speaker 1: but I think it's a good time too now look
Speaker 1: over at the want to Cry virus, because that is
Speaker 1: the most recent version of ransomware as of the recording
Speaker 1: of this episode, and I'm gonna jump right into that
Speaker 1: topic right as when we take another break to thank
Speaker 1: our sponsors. One of Cry is an aggressive, coordinated ransomware attack,
Speaker 1: one of the biggest ransomware attacks in history, and it's
Speaker 1: affected hundreds of thousands of computers, many of which are
Speaker 1: part of the health care industry. Its main method of
Speaker 1: compromising a machine is to exploit vulnerabilities that are in
Speaker 1: an old build of the Service Message Block Protocol, which
Speaker 1: is part of a larger block of protocols that Windows
Speaker 1: machines used for file sharing. Specifically, the virus could attack
Speaker 1: computers that had inbound SMB communications on ports one, nine
Speaker 1: or four forty five, and then there were some later
Speaker 1: variants that aimed at different ports, but the initial one
Speaker 1: was looking at those two. All you have to do
Speaker 1: to protect yourself against this, by the way, is updating
Speaker 1: your computer to the latest Microsoft security patch. It removes
Speaker 1: the vulnerability. Now, once the computer is infected, the malware
Speaker 1: could sort of put out feelers across the local network.
Speaker 1: So if this infected machine is on a local network
Speaker 1: with other machines, it could then use that to send
Speaker 1: the malware to the other devices on that local network,
Speaker 1: so it could spread really fast. All it takes is
Speaker 1: that one compromise device on a system to have it
Speaker 1: spread throughout the entire system, and it made it particularly
Speaker 1: dangerous for these interconnected devices that weren't up to date
Speaker 1: on security patches. Now. Before it made its debut, Want
Speaker 1: to Cry was published as part of a large group
Speaker 1: of documents stolen from the n ess A by a
Speaker 1: group of hackers. So among those documents was a list
Speaker 1: of twenty three hacking tools that targeted indoors vulnerabilities. One
Speaker 1: of those hacking tools was codenamed Eternal Blue, and that
Speaker 1: is what would become Wanna Cry. So Wanna Cry started
Speaker 1: off as an n S a identified and targeted vulnerability
Speaker 1: in Windows operating systems. This raises some tricky questions about
Speaker 1: intelligence agencies and how they intersect with computer vulnerabilities that
Speaker 1: I will get to in just a moment. But nearly
Speaker 1: a month went by without want to Cry becoming a
Speaker 1: public menace. So it was released by this group of
Speaker 1: hackers into the wild. Anyone who went to tour and
Speaker 1: went to this particular site could or really file sharing
Speaker 1: area could get hold of these documents. But for about
Speaker 1: a month nothing really happened. Then on May twelve, two
Speaker 1: thousand seventeen, at eight forty two a m. London time,
Speaker 1: and I love how precise we can be with this,
Speaker 1: the virus was unleashed and the first attacked attack lasted
Speaker 1: for most of the day and it compromised hundreds of
Speaker 1: thousands of machines. But it wasn't as bad as it
Speaker 1: could have been because it got sidelined when a British
Speaker 1: cybersecurity analyst found a u r L embedded in the
Speaker 1: Wanna cry virus attack. That led them to a kill
Speaker 1: switch for the virus. So this was something that the
Speaker 1: hackers had built into the system, or really you could
Speaker 1: argue the n S a built into the system so
Speaker 1: that you could shut it off remotely. So they did.
Speaker 1: They flipped the kill switch and it stopped the spread
Speaker 1: of the virus right there, So it could have been
Speaker 1: much worse than it was if it had left been
Speaker 1: left unchecked. The hacking group that was responsible was called
Speaker 1: the Shadow Brokers Um. They sent out a message on
Speaker 1: May sixteenth claiming to have many more exploits for sale
Speaker 1: if hackers wanted to subscribe to their services. So they
Speaker 1: were saying, hey, you see how much mess we made
Speaker 1: with want to cry? We have a whole lot more.
Speaker 1: Just become a subscriber and then we'll share our tools
Speaker 1: with you. Meanwhile, affected computers were causing huge headaches for
Speaker 1: thousands of people in the UK. Several hospitals sent out
Speaker 1: messages that some appointments and operations would be postponed while
Speaker 1: they were working on fixing these compromise systems. They said,
Speaker 1: it just wasn't safe. It was putting people's health at
Speaker 1: risk to try and maintain appointments and operations without having
Speaker 1: those computer systems in place. Experts were work working really
Speaker 1: hard to restore systems from backups, but that's a pretty
Speaker 1: slow process, and just the sheer number of affected computers
Speaker 1: across multiple companies and multiple countries meant that there was
Speaker 1: no coordinated effort. Right Like, you had all these individual
Speaker 1: little islands that were affected by this virus, and each
Speaker 1: one had to respond to it in its own way,
Speaker 1: in its own time, So there was no coordinated, major
Speaker 1: effort to overturn the virus. It was just pockets of
Speaker 1: that throughout the world. The same was true for others
Speaker 1: systems all over the world. In all, fifty countries were
Speaker 1: affected by the Wanna cry virus. That being said, according
Speaker 1: to zd net, despite the fact that the virus was
Speaker 1: pretty widespread, only zero point one percent of the victims
Speaker 1: have opted to pay the ransom. As of the zd
Speaker 1: net report, the hackers had raised about a hundred eight
Speaker 1: thousand dollars total, which, considering the size of the attack
Speaker 1: and the number of systems that were compromised. Is actually
Speaker 1: a pretty small amount of money. Hundred eight thousand dollars.
Speaker 1: It's a lot of money to me, But if you're
Speaker 1: talking about the payoff for a massive attack on that scale,
Speaker 1: it's a fraction of what those hackers were hoping for.
Speaker 1: I'm sure of that. Uh. Now here are some takeaways
Speaker 1: from the Wanna Cry experience that I think are really important. First,
Speaker 1: let's talk about the n s A. And I'm gonna
Speaker 1: try and maintain my composure because I have very strong
Speaker 1: feelings about this particular issue. So this is my own
Speaker 1: personal opinion in This is not the opinion of how
Speaker 1: stuff works. It's just Jonathan Strickland's opinion. I find it
Speaker 1: unconscionable that an intelligence agency would identify and design an
Speaker 1: exploit for a vulnerability in software rather than informing the
Speaker 1: respective parties about the vulnerability. So, in other words, instead
Speaker 1: of going to Microsoft and saying, hey, we we discovered
Speaker 1: this vulnerability that's in your software. You should patch it
Speaker 1: or else someone else might create an exploit for it,
Speaker 1: they said, hey, there's a vulnerability in Windows. Let's create
Speaker 1: our own exploit for it that we might end up
Speaker 1: using for intelligence purposes. In the future. Never mind the
Speaker 1: fact that this puts everyone at risk, as is evidenced
Speaker 1: by the fact that the want to Cry virus is
Speaker 1: an actual thing. So the company Microsoft had no knowledge
Speaker 1: of this vulnerability. They weren't aware that it existed. It
Speaker 1: wasn't until the shadow brokers published those n s A
Speaker 1: hacking tools that Microsoft found out about it, and then
Speaker 1: they got to work creating a security patch to cover
Speaker 1: and change that exploit so that it wouldn't work anymore.
Speaker 1: And then they made the security patch available, so if
Speaker 1: you installed it, you were fine. Your security patch was
Speaker 1: up to date. Then the at least the initial attack
Speaker 1: of want to Cry wouldn't affect you because the vulnerability
Speaker 1: had been patched up. So I say shame on the
Speaker 1: n s A for identifying and then building a tool
Speaker 1: to exploit such a vulnerability for their own purposes. As
Speaker 1: we've seen this particular case, it can result in someone
Speaker 1: else getting those same tools and using them to cause
Speaker 1: a great deal of trouble. But it was also possible
Speaker 1: that just by sitting on this information and not sharing
Speaker 1: it with Microsoft, the n s A could have given
Speaker 1: other parties the chance to discover that same weakness and
Speaker 1: develop their own exploits for it, which would have been
Speaker 1: even worse because Microsoft wouldn't have known about until after
Speaker 1: people had been actively affected by that exploit. So, in
Speaker 1: other words, even if the NSA had never had their
Speaker 1: hacking tools stolen, let's say that the hackers never were
Speaker 1: able to get hold of eternal Blue and turn it
Speaker 1: into want to cry. Even if that had never happened,
Speaker 1: someone still might have discovered that Microsoft vulnerability and exploited it. Meanwhile,
Speaker 1: the n s A had known about it the whole time.
Speaker 1: I really maintain that it was their responsibility to share
Speaker 1: that information with Microsoft considering the potential for destruction. And
Speaker 1: I find it really troubling that an intelligence agency can
Speaker 1: act in such a way that puts hundreds of thousands
Speaker 1: of computers and people, because we're talking about the health
Speaker 1: care industry at risk. I don't know that any intelligence
Speaker 1: is worth that. Again, that's my own personal opinion. So
Speaker 1: that's the Jonathan bias to be perfectly blunt. But another
Speaker 1: takeaway is that in order to practice good security, you
Speaker 1: need to make sure your operating system is patched and current.
Speaker 1: Now I'm just as guilty as other people at putting
Speaker 1: off installing updates if you ever get that message like
Speaker 1: you need to install some updates, chances are you've gotten
Speaker 1: on the computer to do something specific and you don't
Speaker 1: really want to put that off by installing updates. You
Speaker 1: want to get to whatever it is you need to do,
Speaker 1: and so you might just put it off, and you
Speaker 1: might keep putting it off until your computer forces you
Speaker 1: to do it. But really the better plan is to
Speaker 1: go ahead and install those security patches when you get them,
Speaker 1: so that you can make sure that your computer is
Speaker 1: not vulnerable to these sort of attacks. Plus, you know
Speaker 1: what often means that your system is just running more
Speaker 1: effectively if it's patched properly. So just be sure you're
Speaker 1: installing legitimate updates to your system, not falling for some
Speaker 1: fishing scam. Typically you can do it because if it's
Speaker 1: the system itself that's prompting you to update, and you're
Speaker 1: not in any browser or anything, you're probably pretty safe.
Speaker 1: You're either pretty safe for your computer is already compromised,
Speaker 1: in which case you know it's too late anyway. And finally,
Speaker 1: back up your data. Use some sort of system to
Speaker 1: back everything up, whether it's an external drive a cloud
Speaker 1: based system, back up your information that way. If worst
Speaker 1: comes to worst, if you cannot retrieve your information because
Speaker 1: of a ransomware attack, you can bite the bullet, wipe
Speaker 1: your system, install the operating system again, go to your backups,
Speaker 1: and restore from your backups. Now, that probably means that
Speaker 1: you're gonna lose some stuff, because chances are you've generated
Speaker 1: some data since the last time you did a backup.
Speaker 1: Unless you're doing backups very frequently, that's always going to
Speaker 1: be the case. But it's better to lose some data
Speaker 1: rather than lose everything or be forced to pay into
Speaker 1: a ransomware attack, because every time someone pays the hackers,
Speaker 1: you are sending the message this is a way you
Speaker 1: can make money, and you're inspiring other people to take
Speaker 1: the same pathway as the hackers did, whether they're designing
Speaker 1: their own or using and off the shelf ransomware as
Speaker 1: a service approach. So don't negotiate with the hackers. Instead,
Speaker 1: use backups, patch your security, have up to date antivirus software,
Speaker 1: running practice, good web browsing and email hygiene so that
Speaker 1: you're not inviting these sort of attacks into your life.
Speaker 1: And if you do that, you really minimize the chance
Speaker 1: that you will fall victim to this kind of attack.
Speaker 1: It no, no system is ever going to be perfect,
Speaker 1: no system is ever going to be full proof, but
Speaker 1: you reduce those odds drastically, and if you are backing
Speaker 1: up your information, then you can at least you know again,
Speaker 1: wipe your machine and start over again without worrying about
Speaker 1: enabling some hackers into and inspiring future generations of hackers
Speaker 1: to do the same thing further down the line. And
Speaker 1: that's it. That's all I have to say about ransomware
Speaker 1: and want to cry for this episode. I might end
Speaker 1: up having to do another one in the future. The
Speaker 1: story is still playing out as I record this episode,
Speaker 1: so who knows. But if you guys have any suggestions
Speaker 1: for future episodes of tech Stuff, whether it's a topic
Speaker 1: you want me to cover, or someone you would like
Speaker 1: me to interview, or perhaps a guest host you would
Speaker 1: love to see on the show, send me a message.
Speaker 1: The email address for the show is text stuff at
Speaker 1: how stuff works dot com, where you can drop me
Speaker 1: a line on Twitter or Facebook. The handle for the
Speaker 1: show at both of those is text Stuff hs W.
Speaker 1: And finally, you can watch this show stream live on Twitch.
Speaker 1: I record I live stream all my recordings. You get
Speaker 1: to see me make mistakes chat with folks in between segments.
Speaker 1: So if you want to be part of that, want
Speaker 1: to be part of the community, go to twitch dot
Speaker 1: tv slash tech stuff. You'll be able to see the
Speaker 1: show page and the schedule. And I would love for
Speaker 1: you to join me someday in one of these podcast dreams.
Speaker 1: I have a lot of fun chatting with everyone there
Speaker 1: and just kind of geeking out over technology. So join me,
Speaker 1: won't you, And I'll talk to you guys again really
Speaker 1: soon for more on this and thousands of other topics
Speaker 1: because it how staff works dot com