Windows 10 Has Built-in Ransomware Protection: How To Use It

Ransomware protection is built right into Windows. Here’s how to get started.

Ransomware gangs have gone pro. DarkSide, the group responsible for a spate of ransomware attacks including Colonial Pipeline, now operates with a business model that mirrors legitimate businesses.

Called Ransomware-as-a-Service (RaaS), it uses partners to execute cyberattacks. For individuals and small businesses and schools, attacks from RaaS groups pose the risk of loss of access to all critical data, in addition to the financial burden of paying a ransom.

The small steps to prepare yourself for a potential future ransomware attack will also protect you from other malware and viruses.

It’s not widely known to consumers and small business users that Microsoft offers built-in ransomware protection.

Turning it on is pretty simple: type in "Ransomware Protection" in the Windows 10 Cortana search bar (typically in the bottom lower left of the screen) then select the "Ransomware Protection" screen.

Toggle on the "Controlled folder access." Then you have the option to select which folders you want protected.

Click on "Protected folders." The Protected Folders screen should already be populated by folders that are protected by default. You’re also given the option to add other protected folders.

In addition, you have the option to add folders from Microsoft’s file hosting service OneDrive, if you subscribe to that service.

"In a ransomware attack, your files can get encrypted and held hostage. With controlled folder access, a notification appears, where an app attempted to make changes to a file in a protected folder," according to a Microsoft document describing the feature.

You can also "whitelist" applications. While the goal of Windows ransomware protection is to block suspicious software, if an app is blocked that you know is safe, Microsoft allows you to build a white list. Use the Controlled Folder Access for whitelisting apps. You can do this by going to "allow an app through Controlled folder access."

Other tactics to fend off ransomware:

Use a secure cloud-based file hosting service with automatic backup so you’re regularly backing up files.

Another strategy is a so-called "air gap" where the external storage device is completely disconnected (i.e., offline) from your computer and the internet. Back up your files, then disconnect the storage device.

Another piece of advice recommended by cybersecurity experts is to separate work and personal devices. While attackers tend to target corporations, schools, and hospitals, consumers who are working from home can get targeted by attackers too.

Credit: foxnews.com

Ransomware Targeting Mac Users Also Steals ...

  ... Your Passwords and Credit Card Information

Apple Bytes: 

For just about as long as there have been computers, there have been people creating tiny pieces of software designed to steal information from other computers. Sometimes that involves stealing money, while other times it's just for the sake of gathering personal information.

Sometimes it's both.

There is an entire industry that exists to try and prevent these little pieces of software from infecting your computer and ruining your day (or worse). That's how we get anti-virus software, VPNs, and firewalls. Of course, if you use a Mac, you've pretty much always just ignored all of that because generally speaking, most of the viruses--as those little pieces of software are known--were made for Windows-based PCs.

Yes, there have been a few that affect macOS but you're more likely to get a sensible answer to a question from Siri than have your Mac infected with a virus. It just doesn't happen very often.

Which is why it's bad news that a new ransomware attack is targeting Macs. Known as ThiefQuest, the malware was discovered by Dinesh Devadoss, a researcher at K7 Lab.

Ransomware is software that encrypts a targeted computer's files and demands a ransom in exchange for the decryption key. Usually, these attacks target local governments or hospitals, or large corporations with large networks of computers. When the ransomware infects the network, the entire thing is encrypted, meaning the organization is essentially paralyzed until it pays up.

So, it's not something you really want on your MacBook Pro.

As if that wasn't bad enough, this particular virus is actually a combination of both ransomware and a keystroke tracker which allows the hacker to monitor a user's keyboard strokes and capture login credentials or payment information. That makes it potentially even more malicious, though putting them together also makes it less dangerous, at least in practice.

Ransomware is definitely bad news, and having someone snooping on your passwords or credit card information is potentially even worse. Except, once your computer's files are encrypted and a ransom note pops up on your screen, it's not all that likely that you're going to start logging into your bank account or Facebook profile. That means the malware isn't likely to actually capture any information from you.

Also, as of now, it appears that the ransomware is being distributed through compromised versions of software installers found on torrent sites. So far it's been discovered in installers for security software Little Snitch, a DJ tool called Mixed In Key, and Ableton, which is a live music production tool. In other words, if you're pirating software, you're putting yourself at risk.

The good news is, it isn't likely that you'll become infected in the normal course of using your Mac. If you only install software that you get from a trusted source like the Mac App Store, or that has been "signed" or verified by Apple, you can avoid many of the risks of installing malware. Sure, that usually means actually, you know, paying for the software you use, but as they say, you get what you pay for.

And sometimes you end up paying a lot more.

Credit: Inc.com

Ransomware: Cities Have Become A Big Target & It'll Get Worse

A number of US cities have paid ransoms of hundreds of thousands of dollars after getting caught out by hackers - and if the business model is working, cybercriminals will keep exploiting it.

Ransomware once seemed to be on the decline, but it's now gained a new lease on life - and additional notoriety - after crooks identified a lucrative new set of targets for their file-encrypting malware.

Once content to target individuals' PCs, cybercriminals have extended their reach upwards after realizing that they can make tens of thousands of dollars at a time by encrypting the entire networks of small and medium-sized businesses and other organizations, and holding them to ransom.

While some cybercriminal gangs shifted away from using ransomware in favor of other attacks such as cryptojacking or trojan malware, those specializing in file-locking campaigns kept plugging away, developing more highly targeted - and much more effective - attacks.

Cities and local governments, particularly those in the US, have fast become regular victims of ransomware campaigns. Recently, Riviera Beach and Lake City paid $600,000 and $500,000 after ransomware took down their systems.

They're paying because it's the quickest way to get your operations back up and running. If you look at some incidents that have impacted critical services, those are highly disruptive and definitely felt by the citizens of the city. That's probably factoring in to cities decisions to pay.

And, because targeting cities is bringing in lucrative paydays, cybercriminals are going to keep attacking them with ransomware. Ultimately, these guys are conducting these operations because they want to make a profit - they wouldn't be doing so if it wasn't working.

The best option for such cities - and the one which protects their budgets in the long run - is to invest in security before falling victim to an incident. That's not without cost and pain, however.

Read the complete article > ZDnet.com