Cryptolocker has you between a back up and a hard place

Mar 27, 2014 by Julio Hernandez-Castro
The online equivalent of a nasty clamp. Credit: CZmarlin

Cryptolocker, a particularly vicious form of malware that first appeared in September 2013, is a game-changer. After getting into your computer, it will encrypt all your data files, from your word documents to your photos, videos and PDFs. It will then ask for a ransom of around US$300 or 0.5 bitcoins to get them back. It has been one of the most commented developments in computer security circles in recent times, and copycats are appearing.

Criminals have been trying to make cryptoviruses of this kind work effectively for decades, but only now have they got it right. You can take some simple steps to protect yourself, but this threat is going to grow globally for some time.

Far from being a surprise, the arrival of Cryptolocker was easy to predict. I've taught cryptoviruses for more than 10 years in my lectures, and others have been aware of the threat for nearly 20 years. But Cryptolocker is the first example of the technique working on a large scale and for a sustained period of time.

From the brightest brains to your desktop

Credit where credit is due: Cryptolocker is the work of one or more criminals, who are probably netting tens or hundreds of millions in ransoms, but the original concept was fully developed in the mid 1990s by Moti Yung, a researcher at Columbia University who now works for Google, and his PhD student at the time, Adam Young.

Fortunately, criminals aren't known for their love of academic papers so the cryptovirus proposed by Yung and Young went largely unnoticed outside the academic community for nearly 20 years.

In some ways that's a good thing. We were spared from falling victim to this scam for a while. But on the other hand, if we'd paid more attention to these two brilliant researchers in the first place, we might have been better placed to have stopped or at least limited the damage Cryptolocker and similar ransomware has done and will undoubtedly inflict in the near future.

Until Cryptolocker, other criminals had tried in vain to produce a virus that could hold your files hostage until money exchanged hands. They were largely isolated attempts by individuals and most fell apart at the seams because the people behind them only had a passing knowledge of cryptography.

Cryptolocker main window, with its countdown timer. Credit: Realfintogive/Wikimedia Commons

Most were epic fails and could hardly even be called cryptoviruses. The AIDS trojan, CryZip, Skowor and Arhiveus are all examples of attempts to produce a virus that could hijack a computer's files but all achieved only limited success because the brains behind them didn't quite make the grade. More technically, they didn't use public key encryption so they were all easy to reverse engineer in order to extract the key without paying.

The first real threat was the PGPCoder/GPCode family of cryptoviruses. The author behind this malware updated it every time antivirus companies announced a breakthrough, using trial and error to stay ahead of the game.

The authors of Cryptolocker, on the other hand, seem to have got the recipe right the first time. That would suggest they are well-educated people who are versed in cryptography. But even these smart cookies don't appear to have read the papers produced by the Columbia researchers since they haven't implemented the virus in exactly the way Yung and Young suggested.

A recent survey of just over 1,500 UK computer users showed that 3.4% said they had been affected by the Cryptolocker virus, suggesting that many more people than expected could have fallen victim. Of those who had been affected, a shocking 41% claimed to have paid the ransom.

If these figures play out across the general UK population, we are looking at a multi-million pound operation – one of the most successful of its kind.

Bitcoin has played an important role in Cryptolocker's success, which might partially explain why it has thrived where others have failed. Before bitcoin, it was easier to investigate online payments. Now, with cryptocurrencies like these, ransom payments are hard to trace.

The battle continues

At least some of the ill-gotten gains secured from Cryptolocker are likely to be reinvested. The criminals behind it will likely pay for access to bigger botnets to reach a wider base of victims. Future versions of the virus will in all likelihood be more prevalent and will extend across other platforms, like smartphones and tablets.

This is the easy part though. Once you've got the code, infecting millions of computers is relatively straightforward. It's making users pay that will become an increasingly challenging area for the criminals.

Let's hope that they still haven't wised up to use academic writings as a source of inspiration. Some of the more recent work of the Columbia duo, as well as some of the research going on at my university, would prove very handy indeed.

Convincing a customer (even an unwilling one) to pay is basically an economic problem and involves techniques that could include extortion, bargaining, price discrimination and similar classical economic techniques. All kinds of tips on how to make this work to the criminal's advantage are out there, in economic theory. Then, there are also quite interesting examples of viruses and bacteria that have spread for millions of years continuously involved in relations with their environment that resemble blackmail. That could also help forecast criminals' future strategies.

Back up everything

But for now there is one very simple, clear-cut action to take if you want to avoid falling into the hands of Cryptolocker. It is a highly sophisticated tool but the worst can be avoided with very simple precautions: You must regularly back up all your data. You should do it carefully, using offline backups like an external hardrive that can't be easily accessed by malware once it has entered you system.

In the meantime, we in academia will keep working to stay ahead of the criminals, by 20 years or more.

Explore further: Ransoms paid by two of every five victims of CryptoLocker

add to favorites email to friend print save as pdf

Related Stories

Ransoms paid by two of every five victims of CryptoLocker

Feb 28, 2014

New research from the University of Kent has revealed that around 40% of people who fall victim to an advanced form of malware, known as CryptoLocker, have agreed to pay a ransom of around £300 to recover their files.

UK warns of ransom scam targeting 10s of millions

Nov 15, 2013

(AP)—British officials issued an unusually stark alert about a cyberscam that locks users out of their computers unless they pay a ransom, saying Friday that tens of millions of people may soon be targeted.

Ransomware no cause for New Year celebration: Sophos

Dec 16, 2013

( —From operating systems on desktops to software and peripherals on smartphones, information thieves have been clever, inventive and successfully stealthy in finding pathways for stealing personal ...

Recommended for you

Facebook dressed down over 'real names' policy

12 hours ago

Facebook says it temporarily restored hundreds of deleted profiles of self-described drag queens and others, but declined to change a policy requiring account holders to use their real names rather than drag names such as ...

Yelp to pay US fine for child privacy violation

19 hours ago

Online ratings operator Yelp agreed to pay $450,000 to settle US charges that it illegally collected data on children, in violation of privacy laws, officials said Wednesday.

User comments : 0