Speaker 1: Welcome to tech Stuff, a production from I Heart Radio.
Speaker 1: Hey there, and welcome to tech Stuff. I'm your host,
Speaker 1: Jonathan Strickland. I'm an executive producer with I Heart Radio
Speaker 1: and I love all things tech. Now, let me paint
Speaker 1: you a scenario, or, as my quiz to alter Ego
Speaker 1: would say, over on Ridiculous History, a sonario. You sit
Speaker 1: down to your computer. Maybe you're about to do some work,
Speaker 1: or maybe you're planning on, you know, being totally sussed
Speaker 1: while claiming to work on wires and among us. Maybe
Speaker 1: you just want to watch an episode of The Haunting
Speaker 1: a blind manner. But whatever the reason, you encounter an
Speaker 1: unexpected problem. Your computer won't come out of unlock mode. Instead,
Speaker 1: you get an ominous message. Someone has locked down your computer,
Speaker 1: creating a new path us were to keep you out.
Speaker 1: If you don't cough up a certain amount of money
Speaker 1: by a certain amount of time, something bad will happen.
Speaker 1: Maybe that's something bad is that the intruder will lock
Speaker 1: down your computer forever. Maybe they will convert all the
Speaker 1: data on your computer to gibberish. Maybe they'll fill up
Speaker 1: your computer with garbage data to turn it into a
Speaker 1: useless device. Or maybe they'll use the information stored on
Speaker 1: your computer against you in some way allah blackmail. You
Speaker 1: have been hit by ransomware. Ransomware is a subset of malware,
Speaker 1: or what we goofs is in the old days, lumped
Speaker 1: under the general term computer virus, though as it turns out,
Speaker 1: that's not accurate. Really, ransomware is ugly stuff, and it
Speaker 1: can cause enormous problems for people and organizations. There are
Speaker 1: dozens of stories of computer systems and critical infrastructure being
Speaker 1: hit by ransomware. One target that seems to get hit
Speaker 1: fairly frequently would be hospitals. That is particularly ugly, and
Speaker 1: even more so during a pandemic. So in this episode,
Speaker 1: we're going to explore the history of ransomware, how it
Speaker 1: works in general, and some stories on how it's been
Speaker 1: used and what people did in response. Now, often with
Speaker 1: these topics, I have to give pretty vague estimations of
Speaker 1: when something got started, sometimes even having to resort to
Speaker 1: using a decade rather than a specific year. Thankfully, I
Speaker 1: guess for ransomware, the origin story is fairly well established.
Speaker 1: Now I cannot for certain state that this is categorically
Speaker 1: the very first case of ransomware, but generally speaking people
Speaker 1: accept it as such, and so we come to the odd,
Speaker 1: sinister and absurd story of the Aid's Trojan. Now, in
Speaker 1: this case, a trojan is also a subset of malware.
Speaker 1: It's really more of a delivery system for malware, and
Speaker 1: one that a lot of folks are probably familiar with
Speaker 1: by concept, if not by name. The name Trojan references
Speaker 1: the story of the Trojan Horse, in which the Greek
Speaker 1: forces that have been laying siege to the Free city
Speaker 1: of Troy got a great idea. Hey, said the Greek forces,
Speaker 1: what if we pretend to give them a really big present,
Speaker 1: only instead of you know, I don't know, chocolate or whatever,
Speaker 1: they find out that it's actually some secret Greek task force.
Speaker 1: That task force will be inside Troy without having to
Speaker 1: break through the walls, and then they could actually open
Speaker 1: up the gates and let the rest of us in.
Speaker 1: And so the story goes, the Greeks constructed a massive
Speaker 1: wooden horse, hiding the warriors inside of the horse and
Speaker 1: then leaving it out for the Trojan forces to bring
Speaker 1: into the city while the rest of the Greek forces
Speaker 1: pretended to sail away. Well, according to the story, the
Speaker 1: Trojans celebrated and they pulled the massive wooden horse into
Speaker 1: the city as a kind of war trophy, and the
Speaker 1: Greek warriors inside the horse snuck out at night, opened
Speaker 1: up the city gates, and then the returning Greek forces
Speaker 1: just sauntered their way in conquering the city. In the
Speaker 1: world of malware, a trojan is some sort of program
Speaker 1: or application that appears to be legitimate but is secretly
Speaker 1: carrying along some malware. A lot of malware falls into
Speaker 1: this category or uses similar tactics to get people to,
Speaker 1: you know, actually install the malware on their computers. When
Speaker 1: file sharing became a huge trend as peer to peer
Speaker 1: networks took off, one of the biggest dangers wasn't that
Speaker 1: a movie studio or a record studio is going to
Speaker 1: come after you with some absurdly overblown lawsuit. Although those
Speaker 1: did happen. The bigger threat is that one of those
Speaker 1: files you downloaded was actually malware in disguise, or it
Speaker 1: had malware embedded within the program just waiting to be unleashed.
Speaker 1: The AIDS Trojan was called that because it had to
Speaker 1: do with events surrounding the AIDS crisis, and it was
Speaker 1: actually distributed on diskette. This was pre Internet days. Well,
Speaker 1: the Internet was around, but not many people were using it.
Speaker 1: This was nineteen eighty nine. So the person who made
Speaker 1: this malware saved the malware on two disks disguised as
Speaker 1: a legitimate program. Only that he did it to twenty
Speaker 1: thousand discs, and I imagine that must have taken a
Speaker 1: very long time. So who received those discs? Who was
Speaker 1: on the target side? Well, the discs went to people
Speaker 1: who were part of a nineteen eighty nine World Health
Speaker 1: Organization conference on the AIDS crisis. And who was the
Speaker 1: mastermind behind this plot? Well, that would be Dr Joseph L. Pop,
Speaker 1: an evolutionary biologist and AIDS researcher. Okay, so let's get
Speaker 1: some more context. The medical community first began identifying medical
Speaker 1: cases that in retrospect we would understand to be related
Speaker 1: to acquired immuno deficiency syndrome or AIDS, back in nineteen
Speaker 1: eight one. The c d C would first use the
Speaker 1: term AIDS on September. The World Health Organization would hold
Speaker 1: its first meeting to discuss the global situation in nine three. Now,
Speaker 1: despite the clear danger, many countries, including the United States,
Speaker 1: failed to take this crisis very seriously at first, in
Speaker 1: large part because it was seemingly affecting only gay men,
Speaker 1: and the general social attitude toward homosexual in these countries,
Speaker 1: including the United States, was at the very least uninviting,
Speaker 1: which is putting it lightly. By nine nine, the US
Speaker 1: government couldn't sit by idly, and Congress created the National
Speaker 1: Commission on AIDS. Dr Anthony Fauci, And yes, I'm talking
Speaker 1: about that Dr Fauci, the same one today who's advocating
Speaker 1: social distancing and using masks during our COVID pandemic. Well
Speaker 1: back then he was endorsing giving HIV positive people access
Speaker 1: to experimental treatments, even if those people did not technically
Speaker 1: qualify for clinical trials, because that man is a freaking legend.
Speaker 1: And just to be clear, HIV is human immuno deficiency virus.
Speaker 1: That's the virus that can lead to AIDS. The number
Speaker 1: of AIDS cases in the United States at that point
Speaker 1: reached one hundred thousand, and the w h O, the
Speaker 1: World Health Organization, estimated that there were up to four
Speaker 1: hundred doll and cases around the world, and in some
Speaker 1: parts of the world, like Africa, the medical establishment was
Speaker 1: woefully underprepared to treat infected people and outbreaks were rampant,
Speaker 1: and all of this is important when we get to
Speaker 1: motives behind this trojan malware a little bit later on.
Speaker 1: That's why I needed to set the stage. So Dr
Speaker 1: Pop had been a collaborating member of a group called
Speaker 1: the Flying Doctors, and that itself was a branch of
Speaker 1: the African Medical Research Foundation. Pop had served as a
Speaker 1: consultant for the World Health Organization in Kenya and had
Speaker 1: even organized AIDS related conferences himself. So Dr Pop takes
Speaker 1: a look at the list of attendees to this w
Speaker 1: h O conference in males twenty thousand people and various organizations.
Speaker 1: A diskette and the discs label stated that it was
Speaker 1: an quote AIDS Information Introductory Diskette end quote from a
Speaker 1: company called PC Cyborg Corporation, a fictional company of Dr
Speaker 1: Pop's invention. Now, if you were to insert the diskette
Speaker 1: into a PC and then run the program, you would
Speaker 1: encounter a seemingly straightforward survey, you know, a questionnaire about AIDS.
Speaker 1: But in the background, the malware was infecting the auto
Speaker 1: exec dot bat file in the root directory for the PC. Now,
Speaker 1: this file is the startup file for a computer of
Speaker 1: that era. It's in charge of booting up a computer
Speaker 1: and activating all the components to work with the operating system.
Speaker 1: It sets up everything to move forward when you are
Speaker 1: actually using your computer, so when you power it on,
Speaker 1: this is the program that sets everything up. And then,
Speaker 1: like the Greek soldiers in our legend about the City
Speaker 1: of Troy, the malware would lie and wait for the
Speaker 1: right moment to strike. But instead of waiting for night
Speaker 1: to fall, the malware would keep count of how many
Speaker 1: times the program had been activated, although actually some sources
Speaker 1: say it tracked how frequently the computer system was rebooted
Speaker 1: or turned on, so different reports have conflicting information about this,
Speaker 1: but generally speaking, it was keeping track of how frequently
Speaker 1: the system was being used, and eventually, typically around either
Speaker 1: the program activation or reboot number ninety, the malware would
Speaker 1: then initiate the actual attacks. So it would wait until
Speaker 1: this counter I'd hit nine of ninety instances of this
Speaker 1: thing happening. The program would then encrypt all the files
Speaker 1: on the sea drive of the host machine, which is
Speaker 1: where most files lived. The sea drive is kind of
Speaker 1: the default drive on PC machines, and it rendered those
Speaker 1: files inaccessible to the user, and it would also launch
Speaker 1: a ransom message. Now, if you search for the stuff online,
Speaker 1: you're likely to come across a picture of a screen
Speaker 1: that has a message that starts with quote, attention, I
Speaker 1: have and elected to inform you that throughout your process
Speaker 1: of collecting and executing files and so on and so on.
Speaker 1: It then goes on to drop some expletives. So I'm
Speaker 1: not going to quote the whole thing on here. This
Speaker 1: show is family friendly for the most part. And the
Speaker 1: message also gloats over the fact that the computer has
Speaker 1: been infected by a virus. But that is not the
Speaker 1: actual message that popped up with the AIDS trojan. It's
Speaker 1: frequently used in articles that are about the AIDS trojan,
Speaker 1: but that's not what users saw. For one thing, that
Speaker 1: message has no information regarding the actual ransom, which for
Speaker 1: ransomware is kind of an important step. The message that
Speaker 1: gets shown all over the place concludes by saying, rememb
Speaker 1: member that that's actually the way it's written. Now that's misspelled.
Speaker 1: There is no cure for AIDS end quote, So I
Speaker 1: just want to clear out the confusion. That was not
Speaker 1: the message that dr pops ransomware used. Instead, the actual
Speaker 1: message came across as more official and less of a
Speaker 1: Nelson from the Simpsons, pointing and saying ha ha. The
Speaker 1: real message starts off as quote, Dear customer, it is
Speaker 1: time to pay for your software lease from PC Cyborg Corporation.
Speaker 1: Complete the invoice and attached payment for the lease option
Speaker 1: of your choice. End quote, and the two choices offered
Speaker 1: included a yearly lease for one eighty nine dollars or
Speaker 1: a lifetime lease for three d seventy eight dollars. In
Speaker 1: either case, the user was instructed to pay in the
Speaker 1: form of a banker's draft, a cashier's check, or international
Speaker 1: money order payable to PC Cyborg Corporation to a post
Speaker 1: office box located in Panama. Now, presumably, after paying this
Speaker 1: so called lease, you would receive a way to decrypt
Speaker 1: the files on your computer from the PC Cyborg Corporation.
Speaker 1: But the timeline for how this all shook out was
Speaker 1: a bit too short to know for sure whether or
Speaker 1: not Dr Pop would have sent anything out, because I'm
Speaker 1: not even sure that Dr Pop had a chance to
Speaker 1: retrieve anything from that post office box before it all
Speaker 1: went down. Now, the fact that the malware didn't go
Speaker 1: into action immediately, it would wait a bit before striking
Speaker 1: meant that the outbreak of infected computers was a little staggered.
Speaker 1: The first reports of the computer virus came out of England,
Speaker 1: and that's also when it first became clear that this
Speaker 1: was a new type of crime, one that wasn't covered
Speaker 1: on the lawbooks explicitly, which would force prosecutors to rely
Speaker 1: on older laws and hope that those laws could maybe
Speaker 1: bend enough to apply to this brand new crime. As
Speaker 1: news spread through the medical research community of the virus,
Speaker 1: some organizations took extreme steps. The newspaper The Independent reported
Speaker 1: that and AIDS organization in Italy chose to delete data
Speaker 1: off of infected machines and they lost ten years of
Speaker 1: work in the process. Now, as it turned out, that
Speaker 1: was an extreme overreaction, but this was a new type
Speaker 1: of crisis, so I can't really put too much blame here.
Speaker 1: While computer scientists started to tackle the technological problem of
Speaker 1: how to decrypt infected computers, Scotland Yards Computer Unit launched
Speaker 1: its largest investigation at that point to try and track
Speaker 1: down the perpetrator, and Dr Pop might have even slipped
Speaker 1: away without anyone ever knowing about his involvement except for
Speaker 1: his odd behaviors which gave him away. Researchers figured out
Speaker 1: how to decrypt the machines. They created a decryption tool
Speaker 1: called AIDS out, for example, that would reverse the process
Speaker 1: on an infected computer, so you could decrypt your own files.
Speaker 1: If Dr Pop had just kept a low profile, the
Speaker 1: AIDS trojan might have entered computer lore as a great
Speaker 1: unsolved mystery. But Dr Pop was behaving in odd ways.
Speaker 1: Shortly after mailing out the discs, he attended an AIDS
Speaker 1: seminar in Nairobi, and while this was a short time
Speaker 1: after the infected discs had hit the targets, it was
Speaker 1: already becoming a big point of conversation. It was like
Speaker 1: less than two weeks after he had mailed out the discs,
Speaker 1: and maybe that unnerved Dr Pop. As he was traveling
Speaker 1: back to the United States, he had a layover at
Speaker 1: an airport in Amsterdam, and he wrote the phrase Dr
Speaker 1: Pop has been poisoned on a fellow traveler's suitcase. That
Speaker 1: did not go unnoticed, and authorities decided they wanted to
Speaker 1: have a little word with Dr Pop. Upon searching his luggage,
Speaker 1: the authorities found material with the label PC Cyborg Corporation,
Speaker 1: the fictional company at the heart of the ransomware. Pop
Speaker 1: was allowed to return to the United States, but not
Speaker 1: long afterward received a visit from the FBI, who arrested him,
Speaker 1: and then the US extradited Dr Pop to Britain on
Speaker 1: charges of blackmail and criminal damage. Pop's lawyers would claim
Speaker 1: that Pop was planning on using that money from his
Speaker 1: scheme to fund alternative AIDS research, kind of framing his
Speaker 1: defense in such a way as to make it seem
Speaker 1: as though Pop was responding to what he saw as
Speaker 1: a flawed approach to tackling this global crisis. Now, as
Speaker 1: I mentioned earlier, it took far too long for most
Speaker 1: of the world to take the AIDS crisis seriously, so
Speaker 1: this narrative had a bit of an appeal to it.
Speaker 1: There was evidence that the world was not responding quickly
Speaker 1: or appropriately to this problem, so he was kind of
Speaker 1: like a Robin Hood figure at least by this story,
Speaker 1: you know, stealing from bloated bureaucracies that were spending more
Speaker 1: money on infrastructure than on actual research. Or at least
Speaker 1: that was the narrative that his lawyers wanted people to accept,
Speaker 1: but there were some potential alternative motivations. The guard In
Speaker 1: newspaper published an article that revealed that Dr Pop had
Speaker 1: recently applied for a job with the w h O
Speaker 1: but had been rejected, so it's possible that the malware
Speaker 1: was an act of vindictive revenge for being snubbed. The
Speaker 1: actual trial was a huge mess for many reasons. One
Speaker 1: big one, as I mentioned, is that the legal system
Speaker 1: didn't yet have a framework for cyber crimes like this,
Speaker 1: so they had to apply older crimes in the charge.
Speaker 1: But another was Pop's own behavior. Reportedly, he would show
Speaker 1: up to court while wearing a cardboard box on his head,
Speaker 1: or he would put curlers in his beard or a
Speaker 1: condom on his nose, and he claimed that it was
Speaker 1: to ward off radiation. The judge in the case ultimately
Speaker 1: ruled that Dr Pop was unfit to stand trial. Prosecutors
Speaker 1: were frustrated, pointing out that a digital diary in Pop's
Speaker 1: possession revealed that this aid's trojan plan had been in
Speaker 1: development for well over a year, indicating that this was
Speaker 1: not some sort of spontaneous manic manifestation. And nevertheless, Pop
Speaker 1: was off the hook and he returned back home to
Speaker 1: the United States. He continued his work researching evolutionary biology.
Speaker 1: According to some sources that came across. He also spent
Speaker 1: a lot of time pushing some rather unorthodox ideas about
Speaker 1: human reproduction that I find at best misogynistic. Anyway, he
Speaker 1: passed away in two thousand seven. His legacy includes not
Speaker 1: just the first case of ransomware, but also a lovely
Speaker 1: butterfly conservatory in Cooperstown, New York. For real, So I
Speaker 1: mean that Joseph L. Pop Junior Butterfly Conservatory is a
Speaker 1: place you can visit, you know, when things are more safe.
Speaker 1: When we come back, I'll talk a bit more about
Speaker 1: the encryption method Pop used and why the ransomware of
Speaker 1: today is far more dangerous. But first let's take a
Speaker 1: quick break. When Pop designed his malware, he had a
Speaker 1: limited tool set. When it came to encrypting the files
Speaker 1: on target computers, he used a process called symmetric key encryption. Now,
Speaker 1: the name gives us a hint about how this works.
Speaker 1: You've got a key to encode and decode text, and
Speaker 1: that key is the same for both parties that are
Speaker 1: trying to communicate secretly. You each have an exact copy
Speaker 1: of this key. This is easier to understand with an analogy.
Speaker 1: So let's say that you and I both have a
Speaker 1: Captain Crusader decoder ring, and I can write a message
Speaker 1: in plain old English, and then I use this decoder
Speaker 1: ring to encode that message so that it looks like
Speaker 1: a meaningless jumble of letters, numbers, and symbols. I send
Speaker 1: you the encoded message. You have your own ring, which
Speaker 1: in every way is a duplicate of the one I have,
Speaker 1: and using your ring, you reverse the process. You turn
Speaker 1: each coded letter back into the original uncoded text, and
Speaker 1: after some work, voila, you have the original message. You
Speaker 1: probably see the limitations of this approach right away. It
Speaker 1: depends upon the various parties having access to a private
Speaker 1: encryption key. If anyone else should get hold of that key,
Speaker 1: they could conceivably reverse the encryption process on any intercepted message.
Speaker 1: So the encryption method only works if the keys remain secret,
Speaker 1: and that's tricky because you first have to make sure
Speaker 1: that both parties have the secret key, and getting a
Speaker 1: secret key to somebody securely is its own problem. Moreover,
Speaker 1: this type of encryption can be vulnerable to cryptanalysis, that is,
Speaker 1: efforts of others to reverse the process without a key
Speaker 1: in an effort to determine what the key is. This
Speaker 1: is something that happened a lot during World War Two,
Speaker 1: where both the Axis and the Allied powers worked hard
Speaker 1: to crack the codes of the opposition and then try
Speaker 1: to keep the fact that they had cracked the codes
Speaker 1: secret long enough to capitalize on the discovered information. The
Speaker 1: limitations of symmetric key cryptography made ransomware largely an impractical
Speaker 1: method to make some cash. With a wide enough spread,
Speaker 1: you might get some hits from people who lack the
Speaker 1: information or access to information to make an informed decision,
Speaker 1: So a few targets might panic and capitulate, but it's
Speaker 1: not the most reliable means of pulling off a big heist.
Speaker 1: A few years after Dr Pop's attempt, a pair of researchers,
Speaker 1: or as some have written, a cryptographer and a hacker,
Speaker 1: laid out the strategies that they expected to see used
Speaker 1: in future ransomware attacks, and they were right. The two
Speaker 1: were multi Yng and Adam L Young, Young and Young.
Speaker 1: They were working together to anticipate future problems, and just
Speaker 1: to be clear here, they were looking at the challenges
Speaker 1: from the perspective of a potential attacker, which is important
Speaker 1: because that's what the attackers are doing all the time right.
Speaker 1: I mean this is similar to white hat hackers, who
Speaker 1: operate the same way as a malicious attacker, but for
Speaker 1: the purposes of figuring out where vulnerabilities are within a
Speaker 1: system and in an effort to design a more effective
Speaker 1: digital security measure. Young and Young started to ask some
Speaker 1: pretty simple questions and come up with answers. So let's
Speaker 1: say you want to design some malware. You know for
Speaker 1: some reason, you'd probably have a checklist of things you
Speaker 1: would want for that malware. Now, depending upon your motivations,
Speaker 1: you might want the malware to remain hidden from view
Speaker 1: as well. If you're making a statement with malware, that's
Speaker 1: probably not the case. Maybe you want to hijack computer
Speaker 1: systems and display some sort of anarchistic message on monitors.
Speaker 1: But if your goal is to do something else like
Speaker 1: secretly monitor communications or steal information, or spread an infection
Speaker 1: to other computers on a connected system, chances are you
Speaker 1: don't want people detecting the malware right away. But let's
Speaker 1: say you actually want people to know that their machines
Speaker 1: are infected, because the whole point of your malware is
Speaker 1: to extort money from the owners of the target systems,
Speaker 1: and you can only do that if they realize that
Speaker 1: they've been targeted. You'll have a few other considerations at play.
Speaker 1: For example, you probably don't want people to be able
Speaker 1: to remove the malware easily before it can actually do
Speaker 1: its work. Young and Young compared this to the face
Speaker 1: hugger in the Alien franchise of films. Once the face
Speaker 1: hugger latches onto a person, any attempts to remove it
Speaker 1: from the victim cause injury to the victim. So a
Speaker 1: malware designer will likely want to make it difficult or
Speaker 1: impossible to remove the malware without causing harm to the
Speaker 1: target machine. It reduces the incentive to just rip out
Speaker 1: the malware, So you want your malware to be like
Speaker 1: a barbed arrow. Removing the arrow has the potential to
Speaker 1: cause even more damage than it creates, an opportunity to
Speaker 1: convince people to pay up rather than risk their data
Speaker 1: being out of reach forever. The question then arises, how
Speaker 1: do you make sure the attack is one that isn't
Speaker 1: easily reversible? How do you avoid the weakness of pops approach?
Speaker 1: And their answer wasn't Another approach to cryptography, one that
Speaker 1: had its history dating back several decades. This approach called
Speaker 1: asymmetric key or public private key cryptography sidestep the major
Speaker 1: vulnerabilities of the symmetric key approach. Now I'll describe what's
Speaker 1: going on from a very high level, and just to
Speaker 1: let you guys know, I'm not going to go into
Speaker 1: a deep dive into detail because it's a very complicated
Speaker 1: concept to unwrap and it merits its own episode. In fact,
Speaker 1: I've actually done episodes about this. But with a symmetric key,
Speaker 1: the two parties in communication are using exact copies of
Speaker 1: the same encoding and decoding component. But with an asymmetric key,
Speaker 1: you've got one key that encodes and a different key
Speaker 1: that decodes, and that's it. Communication goes one way for
Speaker 1: each set of keys. This allows for a public key
Speaker 1: for encoding and a private key for decoding. So again
Speaker 1: let's talk about examples. Let's say I want to send
Speaker 1: you an encrypted message, and that way, anyone who intercepts
Speaker 1: my communication to you would just see a garbled mess
Speaker 1: of nonsense. Now you have your own private key and
Speaker 1: there is a corresponding public key, and you have made
Speaker 1: the public key truly public. Anyone in the world can
Speaker 1: use it to send you encrypted messages. So I use
Speaker 1: your public key to encode my message to you. Now
Speaker 1: we've got an encrypted message, one that could only be
Speaker 1: decoded by the private key. There's only one of those,
Speaker 1: and it's in your possession, and that one you are
Speaker 1: not sharing with nobody. Gosh darn it. So with a
Speaker 1: public private key, everyone can send you encrypted messages. Only
Speaker 1: you can decrypt them to see the original text. The
Speaker 1: public key cannot be used for decoding. It can only
Speaker 1: be used for encoding. But then, what if you wanted
Speaker 1: to send a reply message to me, then you wanted
Speaker 1: to encrypt it. Well, in that case, you would use
Speaker 1: my public key, the one I have for anyone to
Speaker 1: send me an encrypted message. You send your encoded message
Speaker 1: to me, and then I use my private key to
Speaker 1: decipher that message and read the contents. So we're using
Speaker 1: two different sets of keys here, to public and to
Speaker 1: private keys. Now why is this important for ransomware? Well,
Speaker 1: asymmetric keys are harder to crack through cryptanalysis. You cannot
Speaker 1: reverse engineer them nearly as effectively. They typically rely on
Speaker 1: factoring really big numbers. So, for example, take two enormous
Speaker 1: prime numbers, and a prime number is a number that
Speaker 1: can only be divided by itself. So you multiply these
Speaker 1: two huge prime numbers together, and thus you get an
Speaker 1: even bigger number that is the the product of these
Speaker 1: two being multiplied. This bigger number, you can think of
Speaker 1: that as the public key. If you happen to know
Speaker 1: the two factors that were used to create that bigger number,
Speaker 1: then you can decode messages that use that public key.
Speaker 1: That would technically be the private key. But by choosing
Speaker 1: really really big prime numbers, you've created a difficult computational challenge.
Speaker 1: A computer system would have to go through all the
Speaker 1: factors of that big number and then dismiss any of
Speaker 1: the factors that are not themselves prime numbers. So if
Speaker 1: one of the factors where something like a four, you
Speaker 1: would toss that one. That could not possibly be one
Speaker 1: of the components you need because four it can be
Speaker 1: divided by two, So four is not a prime number.
Speaker 1: You get rid of it, You get rid of all
Speaker 1: the non prime factors. Then you would have to find
Speaker 1: the specific pair of really big prime numbers that were
Speaker 1: used to create this private key. Now this isn't impossible,
Speaker 1: but as you use larger prime numbers, it gets more
Speaker 1: computationally complex and it requires more processing power and thus
Speaker 1: more time to crack it. Time is a precious resource,
Speaker 1: you know, you can think of time as money, so
Speaker 1: you don't even need to make the encryption full proof.
Speaker 1: You just need to make it good enough so that
Speaker 1: is too expensive for anyone to bother trying to crack it. Anyway,
Speaker 1: this type of cryptography is fascinating, and like all cryptog or,
Speaker 1: he becomes a sort of seesaw approach as people find
Speaker 1: new ways to decrypt things more effectively and efficiently. Young
Speaker 1: and Young projected that future ransomware designers would make use
Speaker 1: of asymmetric cryptography approaches to make it more difficult to
Speaker 1: reverse the attack, and it would just be easier for
Speaker 1: people to pay the hackers the ransoms. So in other words,
Speaker 1: you might say, well, they're asking for ten thousand dollars,
Speaker 1: but the value of my data is incredibly high, and
Speaker 1: the price of reversing this attack could end up being
Speaker 1: much more expensive than ten grand, so we'll just cough
Speaker 1: up the money. Young and Young called this crypto viral extortion,
Speaker 1: defining it as quote an active attack in which the
Speaker 1: hybrid encrypts the victims files works if there are no backups.
Speaker 1: Attacker demands ransom in return for the randomly generated symmetric key.
Speaker 1: Cannot determine decryption key even when code is scrutinized end quote.
Speaker 1: Young also describes some related scenarios that are equally troubling,
Speaker 1: such as one in which malware infects a computer and
Speaker 1: then uses cryptography to encode specific information on that computer
Speaker 1: before broadcasting the information to the attacker, essentially sending secret
Speaker 1: messages from the target machine. The attacker has created the
Speaker 1: keys for encoding and decoding, and thus only the attacker
Speaker 1: knows what information was even stolen. So even if someone
Speaker 1: detects that a security breach has happened, they couldn't be
Speaker 1: certain what information had been accessed. That's not great if
Speaker 1: you're handling supersensitive information like financial information or medical records
Speaker 1: or military communications, etcetera. But I digress. When we come back,
Speaker 1: i'll dive into a little more detail in cryptoviral extortion
Speaker 1: methods and we'll talk about a few cases where we've
Speaker 1: seen it play out. But first let's take another quick break.
Speaker 1: You'll pointed out that a crypto viral extortion methodology really
Speaker 1: only works if a computer system lacks backups, and that's
Speaker 1: because you could potentially wipe an effect infected machine clean.
Speaker 1: Right you've got hit by ransomware, you could just completely
Speaker 1: reformat that machine. You can even uninstall and reinstall the
Speaker 1: operating system and all the necessary applications, and then restore
Speaker 1: the data from your backup. It doesn't matter if the
Speaker 1: attacker encrypted all the content on the computer, because you've
Speaker 1: got an unaffected copy of that material. I think what
Speaker 1: I'm trying to say here is that it's a good
Speaker 1: idea to make regular backups of your data, preferably onto
Speaker 1: a secondary storage device that you can keep in a
Speaker 1: safe location. There are a lot of external hard drive
Speaker 1: solutions out there, and many of them are not very expensive.
Speaker 1: So if you work on sensitive stuff, or let's say
Speaker 1: you've just got a lot of data that you're attached to,
Speaker 1: like maybe a lot of sentimental photos and videos and stuff,
Speaker 1: I recommend investing in a backup. It's an extra step,
Speaker 1: and I get it that can be a hassle, but
Speaker 1: it's better to have it and not need it than
Speaker 1: need it and not have it. Uh. Cloud storage can
Speaker 1: also be a solution, so that's also a potential, but
Speaker 1: you should definitely have a backup now. Young also said
Speaker 1: that an attacker could take a couple of different tactics
Speaker 1: to make their approach more robust. And this gets pretty
Speaker 1: technical too, so I'm not going to go into any
Speaker 1: detail because to explain all of it would require another episode.
Speaker 1: But the point is that Young and Young were anticipating
Speaker 1: the attacks that would happen in the future, and they
Speaker 1: published this paper that they wrote in It would take
Speaker 1: about a decade before we started seeing ransomware attacks that
Speaker 1: kind of aligned with the predictions, but they were on
Speaker 1: the way. And by the way, I think this is
Speaker 1: a good point for me to reaffirm my stance on
Speaker 1: this kind of work. So from one perspective, you could
Speaker 1: argue that this research accelerated the development of new approaches
Speaker 1: to ransomware. In other words, that by publishing these findings,
Speaker 1: Young and Young were enabling the next wave of attackers.
Speaker 1: But on the other hand, figuring out potential vulnerabilities is
Speaker 1: important if you want to prevent people from exploiting those vulnerabilities.
Speaker 1: So the good guys have to look at how to
Speaker 1: crack systems because that's what the bad guys are always doing.
Speaker 1: If good guys were not doing it too, then only
Speaker 1: the bad guys would be figuring out how to exploit systems,
Speaker 1: and we would be caught unawares far more often, with
Speaker 1: much more dire consequences as a result. Now, all that
Speaker 1: being said, there is a tendency even within the white
Speaker 1: hat community to communicate these discoveries in a way that
Speaker 1: comes across as you know, smug or snarky, or sometimes
Speaker 1: even cruel. That's more of a commentary about communication style
Speaker 1: and the tendency to detach the significance of the consequences
Speaker 1: of an action from the problems of just solving tough
Speaker 1: computational challenges. But that's a soapbox for another episode. In
Speaker 1: the mid two thousand's we started to see slightly more
Speaker 1: sophisticated attempts at ransomware emerge. One ransomware was cry zip,
Speaker 1: and the name suggests that it used ZIP file compression
Speaker 1: technology as part of the attack. In fact, that's exactly
Speaker 1: what it did. Essentially, if you were unlucky enough to
Speaker 1: have fallen for the tactic and installed the program, cry
Speaker 1: zip would crawl through your sea drive and select files
Speaker 1: to put into a password protected ZIP folder, and then
Speaker 1: it would delete all the original files. So rather than
Speaker 1: a hard drive full of files, you would see a
Speaker 1: folder with password protection on it, and the ransomware would
Speaker 1: place a t x T or text file on the
Speaker 1: drive that, if you opened, would of you instructions on
Speaker 1: where you were to deposit money. In return, you would
Speaker 1: get the password to access your files. The hacker who
Speaker 1: designed this actually put the password within the d l
Speaker 1: L file for the ransomware itself, unencrypted too. I guess
Speaker 1: they just figured no one was going to go looking
Speaker 1: for it. But it turns out if you include your
Speaker 1: password with the protected stuff, it's not that protected. It's
Speaker 1: kind of like writing the password for your computer on
Speaker 1: a post it note and then putting the post it
Speaker 1: note next to your computer. What's even the point. The
Speaker 1: Archivaus ransomware, which was based off of Chrysip, was another
Speaker 1: one that caused some mischief. In two thousand six, Mike
Speaker 1: Chrysip analysts found the password for the ransomware embedded within
Speaker 1: the code of the malware itself, and it was a
Speaker 1: thirty digit pass code. I'm not gonna read it, because
Speaker 1: who wants to hear a string of seemingly ran of
Speaker 1: letters and numbers. The point is that if the code
Speaker 1: had not contained the passwords, it would have been a
Speaker 1: lot trickier to get around, But while some folks were
Speaker 1: tricked into installing the malware, the solution ended up being
Speaker 1: fairly straightforward in the end, so it didn't have as
Speaker 1: massive an impact as it could have. By ransomware was
Speaker 1: on the rise, in September of that year, hackers released
Speaker 1: a particularly effective weapon called crypto Locker. Like the other
Speaker 1: examples that I've mentioned, this malware, once it was installed,
Speaker 1: would encrypted files on Windows machines and then show a
Speaker 1: message demanding payment in exchange for the decryption key. One
Speaker 1: new twist is that the hackers were demanding the ransom
Speaker 1: be paid in bitcoins, the cryptocurrency that makes transactions difficult
Speaker 1: to trace. If the hackers remained careful about how they
Speaker 1: accessed their ill gotten gains, they could profit off their
Speaker 1: crime without much fear of being tracked by the authorities.
Speaker 1: The trojan horse attacks carrying crypto Lockers spread primarily through
Speaker 1: email attachments. The code could not replicate itself. It couldn't
Speaker 1: spread to other machines all on its own, so it
Speaker 1: wasn't a virus or a worm like other malware. Instead,
Speaker 1: the hackers created a boton net to spam out millions
Speaker 1: of computers with emails carrying infected files. A boton net,
Speaker 1: by the way, is a network of computers a k a.
Speaker 1: Bots that ultimately are under the control of a hacker
Speaker 1: or a group of hackers. There are other types of
Speaker 1: malware that can give a hacker remote access to your computer.
Speaker 1: Sometimes this is done just to snoop on communications, other
Speaker 1: times to turn your computer into a resource for the hackers.
Speaker 1: So in this case it was a resource. It was
Speaker 1: meant to help distribute emails, and these emails had the
Speaker 1: infected attachments. Uh. This also comes with the bonus of
Speaker 1: creating some separation between the hacker and the emails. So,
Speaker 1: in other words, if authorities were to trace back where
Speaker 1: the email came from and they found out it came
Speaker 1: from your computer, and your computer had been compromised by
Speaker 1: this botan net, you could be on the hook at
Speaker 1: least temporarily, while the hacker remains undetected. The cryptographic method
Speaker 1: used by crypto locker was pretty sophisticated, and unlike the
Speaker 1: earlier examples, the decryption key was not evident within the
Speaker 1: code of the malware itself. Crypto Locker used asymmetric keys,
Speaker 1: a public and a private one, and the hackers held
Speaker 1: on to both of them. A task force called Operation
Speaker 1: Tovar was able to discover the decryption keys another way,
Speaker 1: because the task force targeted the bot net, not the
Speaker 1: actual ransomware directly. Doing this gave the team access to
Speaker 1: the decryption keys, but it took time, and in the
Speaker 1: gap between when the malware first hit the Internet and
Speaker 1: started to infect machines and when the task force had
Speaker 1: found the decryption keys, a lot of people and companies
Speaker 1: had given up and they had ponied up the cash
Speaker 1: to get their data back. Since crypto Locker, numerous ransomware variants,
Speaker 1: many of them descended from crypto Locker itself, have appeared
Speaker 1: on the scene. The medical sector continues to be one
Speaker 1: that gets hit hard by this type of malware, and
Speaker 1: from a criminals perspective, you can understand why the information
Speaker 1: on computers that are tied to the medical industry contain
Speaker 1: critical information. A lot of that information is private. It
Speaker 1: is protected by law, so for it to get revealed
Speaker 1: would be a big legal problem as well. It's tied
Speaker 1: to patients frequently, and there is an enormous sense of
Speaker 1: urgency to regain access to that kind of information, and
Speaker 1: many medical establishments, including hospitals, lacked the robust backup infrastructure
Speaker 1: to recover in the event of a ransomware attack. And
Speaker 1: that's not just me throwing shade at hospitals for not
Speaker 1: having appropriate backups. This is actually a really tricky area
Speaker 1: because you want that data to remain secure and private,
Speaker 1: and making copies of data creates an opportunity for data breaches.
Speaker 1: So it's a pretty delicate balance. Since crypto Locker, we've
Speaker 1: seen a lot of other ransomware variants out in the wild. Locky,
Speaker 1: similar to crypto Locker, targeted more than one sixty different
Speaker 1: file types when infecting machines, particularly those file types that
Speaker 1: are prevalent in areas like design and engineering. Wanna cry,
Speaker 1: which made headlines in teen, took advantage of an exploit
Speaker 1: in older Windows systems. Now, one juicy bit of information
Speaker 1: about that mess was that the United States National Security
Speaker 1: Agency a A the n s A had discovered this exploit,
Speaker 1: but then they sat on it. They were quiet about it,
Speaker 1: presumably so that the agency itself would be able to
Speaker 1: take advantage of that exploit. Now, reporting the exploit would
Speaker 1: have given Microsoft the chance to patch the problem, So
Speaker 1: the NSA said nothing at all so that they could
Speaker 1: take advantage of it. And then addictively, hackers got hold
Speaker 1: of that information, and so they used the exploit themselves
Speaker 1: to craft the Wanna cry ransomware, which, like crypto locker,
Speaker 1: demanded payment in the form of bitcoin to return data.
Speaker 1: And that gives me a chance not just to wag
Speaker 1: my finger at the n S, a an organization that
Speaker 1: has had an incredibly shady reputation, but also to explain
Speaker 1: how this points out that a government mandated back door
Speaker 1: into any system is always a bad idea. Governments love
Speaker 1: the idea because monitoring digital communication is really hard, and
Speaker 1: sometimes parties that are in opposition to that government, whether
Speaker 1: foreign or domestic, will use digital communications, you know, plan stuff,
Speaker 1: and so it would be useful to have a window
Speaker 1: to peek through and see what's going on and prepare.
Speaker 1: But even if you trust your government, a backdoor is
Speaker 1: something that can potentially be exploited by any one if
Speaker 1: they find out about it, which was kind of the
Speaker 1: case with Wanna cry, although that was an exploit, not
Speaker 1: an intentional back door. You do not improve national security
Speaker 1: by making systems less secure anyway. Want to Cry could
Speaker 1: have been an enormous problem. But fortunately Microsoft was able
Speaker 1: to patch the exploit quickly and data security specialists discovered
Speaker 1: a kill switch for the ransomware and we're able to
Speaker 1: shut it down before I could really go into overdrive.
Speaker 1: So we were lucky on that one. Other examples of
Speaker 1: ransomware include malware names like bad Rabbit, Yoke, troll Dish,
Speaker 1: Golden Eye, and ganned Crab. The details vary from case
Speaker 1: to case, but the general approach is very similar. To
Speaker 1: close this out, I want to stress a few good
Speaker 1: ways to prevent yourself from becoming a victim of ransomware. First,
Speaker 1: of course, is to be on alert for suspicious messages
Speaker 1: and files and attachments. Don't open emails from sources you
Speaker 1: don't know. Definitely don't open unfamiliar email attachments, and back
Speaker 1: up your data. The best defense against ransomware is just
Speaker 1: not to install the dang stuff in the first place.
Speaker 1: But if you do get tricked, and we all get
Speaker 1: tricked on occasion, having that backup is key. What you
Speaker 1: absolutely do not want to do is pay the ransom.
Speaker 1: Every time a ransom is paid, the message is sent
Speaker 1: out that this tactic works. This is a way to
Speaker 1: make money. So if we send that message, we shouldn't
Speaker 1: be surprised when we see it happen again and again,
Speaker 1: because other people will follow suit in an effort to
Speaker 1: make some cash. And also keep in mind, there's no
Speaker 1: guarantee that paying the ransom will actually get you the
Speaker 1: decryption key. There might be cases where there is no
Speaker 1: way to recover the day, but you don't necessarily know that,
Speaker 1: and then you pay the ransom and you never get
Speaker 1: a cure for your problem. So paying is a terrible idea.
Speaker 1: Let's all just remember the lesson we learned from that
Speaker 1: classic film War Games. The only winning move is not
Speaker 1: to play, and that wraps up this look at what
Speaker 1: ransomware is and its history. It is fascinating. It is
Speaker 1: important to be very much on alert about it, especially
Speaker 1: right now and again in our pandemic, we've seen an
Speaker 1: uptick in malware attacks and spamming attacks because we have
Speaker 1: people who are not in centralized locations anymore. They're working
Speaker 1: from home. Their security at home maybe lower than it
Speaker 1: is in say, an office environment. So it's even more
Speaker 1: important that we each do our part and we pay
Speaker 1: very close attention, and if we do get attacked, we
Speaker 1: should not panic. We should really care fully consider all
Speaker 1: of our options. Sometimes just the option of waiting. It
Speaker 1: works because there are people in data security constantly trying
Speaker 1: to build decryptor tools to reverse these kind of attacks.
Speaker 1: So hold on and just be alert, keep calm, and
Speaker 1: don't install ransomwhere I guess is what I'm saying. If
Speaker 1: you guys have suggestions for topics for future episodes of
Speaker 1: tech Stuff, reach out to me on Twitter. The handle
Speaker 1: is text stuff h s W and I'll talk to
Speaker 1: you again really soon. Text Stuff is an I Heart
Speaker 1: Radio production. For more podcasts from my Heart Radio, visit
Speaker 1: the i Heart Radio app, Apple Podcasts, or wherever you
Speaker 1: listen to your favorite shows.