Time to get serious about ransomware risk prevention

BrandonT

BrandonT

Well-known member
Hey folks. With the recent infection of an update to Transmission with ransomware, I'm getting anxious about this new threat that I'm sure will only get worse and worse. Let's just not even discuss the merits and morality on torrenting. This has nothing to do with that, as the infection was in the application update (by hackers). So it could happen with any update to small company third party software.

As a paranoid precaution, let's also leave out ALL mentions of software that would make good targets for folks like us.

Here's some thoughts of mine on how to possibly prevent the risks, and some problems that I'm not sure about:

-There's the typical avoidance of risky websites that I hope we all do. If you have to visit something, do it on a computer separate from your edit computer, that doesn't get hooked up to external hard drives.

-Building off the previous point, start limiting website and third party application usage to only the most necessary and security-conscious sites/ applications.

-Use browser extensions to block popups and scripts.

-Use software that prompts you to allow/ not allow new network connections. I'm leaving out the software name here.

-Disconnect your hard drives that aren't actively being used at the moment. That is, both power and data. This also makes the hard drives more likely to last longer, and not fry. And also prevents lighting strike damage (the reason to disconnect power and data cables). I started doing this after a hard drive fried recently.

-Only have one hard drive connected at a time, unless you're backing up data.

-Backup your footage using the same file structure as on your edit drive, so that the next point below would work.

-Backup your progressive project files to a cloud service. I think that the subscription edit software that most of us use has this built in. I need to check into that.

-Turn off auto updates on software??? This is one I'm considering and am not sure about. People got infected from an update to Transmission. But, software vulnerabilities also get patched from updates. Thoughts on this?

-Disconnect from the Internet on edit machines, except when needed?? This is something that a more built up company could easily do. Have a dedicated machine for editing, and separate machine and office space for other aspects of the business. But me as a solopreneur/ freelancer, I should be able to use my $2,200 machine for all aspects of my work. And I need constant Internet access for that. I also don't have the physical office space to setup another full system, and am not going to use a laptop (without added peripherals) for conduct my day to day business.

-The ransomware waits a few days before locking up your system. So this presents a problem with backing up your footage to another drive. So maybe you should have a drive that you backup to NOT MORE FREQUENTLY than every 5 days.

(I'll add to the list if this thread gets popular)
 
Last edited:
In case anyone is wondering what this is about: First Mac Ransomware ‘KeRanger’ Strikes Via Transmission BitTorrent Software

I work mainly under Windows and have BitDefender ( antivirus ) and MalwareBytes ( anti-malware ) software installed and I use a VPN service to connect to the web. This combination has been very effective at keeping things safe. ( BitDefender and MalwareBytes are available for both Mac and Windows operating systems )

One other precaution I've made is to un-install JAVA from all of my computers.
 
1. Use Google Chrome instead of Internet Explorer. Or maybe Firefox.

2. Normally run as a Standard User, not an Administrator. In other words, you need two user accounts: one for normal use, named like Brandon, which is a Standard User; and one named like Admin which is an Administrator user account. Log in as Admin only to install something. Log in as Brandon to edit videos, surf the web, check email, etc. Viruses run as the logged-in user. If the user doesn't have the right to install something, the virus can't install itself. This simple rule is a central part of industrial-strength operating systems like Unix, Linux, and BSD. Some daring and I guess very smart computer guys use only this technique. They have no antivirus software installed, not even on their Windows computers, and they have never caught a virus.

3. Use an ad-blocking Hosts file, which also blocks malware.
 
That's why I am fascinated that companies, including big ones, put their entire business on a cloud server like Google or Microsoft. Wait until that is held hostage.

What do you do to prevent the loss of Adobe's Creative Cloud; keep a copy of CS6?
 
Antivirus will not usually stop Cryptovariants. They're polymorphic.

1. Institute a software restriction policy, whitelisting known safe applications. If this is beyond your comfort zone, read on...
2. Don't open email attachments from unknown sources. Most of these are distributed as zips that contain javascript files that will execute and download the actual malicious file. They are quite often disguised as invoices and resumes.
3. Install Cryptoprevent available here: https://www.foolis*%t.com/cryptoprevent-malware-prevention/ EDIT: The website is Foolish IT - the profanity filter saw it as something else. :)
4. Install Malwarebytes Anti Ransomware: https://forums.malwarebytes.org/index.php?/topic/177751-introducing-malwarebytes-anti-ransomware/
5. Most importantly: back your stuff up to multiple locations.

Some of the variants have defects in their encryption that have been exploited and can be decrypted. Most of them haven't, so nuking and restoring from backups is the only option in those cases.

If you use cloud storage like Google Drive or Dropbox, don't install the sync feature. Only use the web interface.
 
Last edited:
Great advice. Thank you. I tried the admin and std user account thing but some of my software plugins wouldn't work when I was a standard user so I have had to keep editing as admin. Any ideas?
 
The cryptovariants don't require admin credentials to screw you up. They will encrypt any file that the current user has access to, including any mapped drives, external drives, local Dropbox folder, etc.
 
You're welcome! The free version is just as effective, but you have to check for updates manually.
 
You must log in or register to reply here.
Back
Top