Phishing-driven ransomware attacks are rising – why aren’t we addressing the factors that enable them?
Tue 30 Jul 2024
In this opinion piece, cybersecurity expert and digital identity advocate, Al Lakhani, shines a light on the escalating threat of ransomware attacks and the pressing need for a paradigm shift in cybersecurity strategies.
– – – – – –
Reading this sentence probably took you around two seconds. In that time, it is estimated that around 38 ransomware attacks will have occurred. By the end of this sentence, this figure will likely be in the region of 190.
Annually, the number of malicious ransomware attacks on businesses’ accounts and IT systems is skyrocketing. In 2018, for example, worldwide figures suggested that 55.1% of organisations were affected by a ransomware attack. In 2023, this percentage soared to 72.7%, painting a grim picture of the cyber security landscape.
The cost of these attacks is eye watering. According to analysis from last year, a third of UK-based CISOs have paid between £3.8 million ($5 million) and £11.6 million ($15 million) to ransomware criminals to limit the impact of an attack. What is more, businesses spent an average of £1.41 million ($1.82 million) to recover from a ransomware attack in 2023, even if they did not end up paying the ransom.
In my opinion, however, the cybersecurity industry is consistently overlooking the root causes of these threats: credential phishing and password-based attacks.
Understanding how Ransomware Attacks Work
For the most part, ransomware incidents occur when a hacker’s malware infiltrates a user’s IT system and encrypts or ‘locks’ their data to prevent them from accessing their device or the files stored within it. Criminals then present the user or their organisation with an ultimatum: pay up, or risk losing access to your systems and data for good.
But how does the hacker infiltrate the user’s system in the first place? There are really only three attack vectors that criminals can use.
The first method is phishing, enticing users to click on malicious links or download infected attachments, thus allowing malware to infiltrate their devices. One notable example is Ryuk ransomware, created by the Wizard Spider cybercrime group, which has coerced various organisations, including school districts and radio stations, into paying substantial ransoms for data recovery.
The second method is password-based attacks, which exploit weak or stolen credentials to breach accounts or IT systems as legitimate users in order to implant the malware. In May 2021, Colonial Pipeline’s networks fell victim to such an attack, leading to panic buying, fuel shortages, and price spikes across parts of the eastern United States.
Elsewhere, many attacks are also caused by software vulnerabilities, which involve hackers infiltrating a victim’s system by bypassing unpatched or out-of-date software. For example, the Commercial Bank of China (ICBC) was reportedly forced to pay a ransom when they were hacked via the CitrixBleed vulnerability, which began when a new patch was announced to fix a weakness that had been identified.
Bad actors were immediately able to see what had changed with the patch update, and use the information to hack devices that had not yet been updated, making it a particularly high profile example of this form of threat.
Finally, hackers can also use backdoor tactics to carry out a ransomware attack. With this threat, criminals purposely build a malicious way to gain access to a business’s systems, allowing them to then implant malware and force them to pay a ransom. A good example of this was a ransomware attack on files and systems that used the SolarWinds Orion Platform. Hackers inserted malicious code into to open a backdoor into the platform, and the attack cost SolarWinds around £31.1 million ($40 million) to clean up.
With so few ways in which a ransomware attack can occur, you would think that businesses would be investing resources to stop them from happening – unfortunately, the solutions most businesses currently turn to could actually be making matters worse.
Businesses are Investing in the Wrong Solutions
This is because many businesses are still using 1st generation Multi-Factor Authentication (MFA), which tries to tackle phishing-driven ransomware attacks by implementing layer upon layer of authentication methods such as one-time passwords (OTPs), push notifications or QR codes.
And herein lies a key issue. These solutions rely on multiple devices that operate independently of each other, providing malicious actors with a range of opportunities to intercept or steal credentials, including users’ authentication tokens, such as with an Adversary in the Middle Attack (AiTM). Consequently, either by capturing the ‘2nd factor’ or ‘credentials’, criminals can access and place malware in an organisation’s systems without their knowledge.
But wait, it gets worse. These solutions also centralise the storage of credentials in a database, meaning they have a single point of vulnerability. Therefore, even if criminals have not intercepted your one-time passcode (OTP), they can simply breach the central database and encrypt your data at will, particularly if there is an unpatched vulnerability within their cyber security infrastructure.
The result? A hefty ransom and a serious amount of operational and reputational damage – just look at what happened when the British Library suffered an attack last year.
Eliminating the Ransomware Threat
I have just checked the clock. Provided we read at a similar pace, over 2,000 ransomware attacks will now have taken place since you started this piece, begging the question: how many more companies have to have their pants pulled down before the cyber security industry addresses the root cause of these attacks?
For starters, a mindset shift needs to occur. Businesses cannot keep investing in solutions that simply detect attacks and fail to protect against the key attack vectors that criminals use to implant malware.
Instead, resources must be set aside to implement the next generation of MFA, which provides an additional layer of security without phishable or stealable factors such as passwords, additional codes, or push notifications.
These solutions are built on the concept of transitive trust, which means that access to a trusted service (I.e. a domain that has been integrated with the identity provider) is only granted to a trusted device. This device must also be registered to the system and verified by its Trusted Platform Module (TPM) chip, and it must prove it is the control of a trusted user who is identified via biometrics or a secure PIN.
In addition, due to the decentralised nature of these solutions, all credentials (i.e. passwords or PINs) are stored locally inside the TPM, so hackers have nothing to steal from a central database.
For a criminal to access a system to implant a malware programme via compromised credentials, they would need to physically steal both the trusted device and the user’s PIN to gain access. In other words, they cannot access a device remotely, completely mitigating the risk of a phishing-driven or password-based ransomware attack.
To briefly conclude, businesses must prioritise prevention when it comes to ransomware, as the alternative is incredibly costly. This means addressing the root causes of the breach in the first place, which can only be done if organisations arm themselves with the right tools to do so. Businesses and the broader cybersecurity industry must reconsider their security strategies and embrace a future grounded in identity proofing and transitive trust.
– – – – – –
Al Lakhani is a recognised cyber security expert, digital identity crusader, inventor, entrepreneur, & university lecturer. With more than 25 years’ experience in cyber forensics, Al is a proven expert in the field of cybercrime and data forensics and has spent more than 26 thousand hours during his career working on the topic of digital identities, his number one passion.
Prior to founding IDEE, he founded the Forensics & Cyber Investigations unit at Alvarez & Marsal. Al’s most notable projects include the wind-down of Lehman Brothers and Washington Mutual and interim COO of Rubicon Global. Al also taught applications of blockchain technology at Munich University.
