Rough patch, or how to shut the window of (unpatched) opportunity

Tomáš Foltýn

 Simply throwing more staff at the patching problem won’t cut it, a study suggests.

To paraphrase English novelist Jane Austen, it is a fact universally acknowledged that organizations must act with alacrity when it comes to applying software patches to their systems. A number of recent notorious incidents – think the WannaCryptor malware outbreak or the breach at Equifax last year – have exposed the perils of a failure to implement fixes for software vulnerabilities in a timely manner.

A recent study by the Ponemon Institute and enterprise IT cloud services company ServiceNow sheds some light on the magnitude of the patching problem. Underpinned by interviews with 3,000 cybersecurity professionals worldwide, the report – called Today’s State of Vulnerability Response: Patch Work Demands Attention – found that one in every two (48%) organizations suffered at least one data breach in the last two years. Most (57%) of the breached firms attributed the incident to a vulnerability for which a patch was available at the time, but not applied. What is more, one in three of those breached actually knew they were vulnerable. Indeed, consistently plugging holes in software could have stopped many attacks dead in their tracks.

Seen from another perspective, headline-grabbing data breaches “are only the tip of the iceberg” – as the report itself notes, after all. It is little wonder, then, that firms need a more effective vulnerability response in order to close the gaps before attackers exploit them. Compounding things further is another finding in the study – both the volume of attacks and their severity are trending upwards, by 15% and 23%, respectively.

Patching is crucial

So how can businesses keep up with patching in the increasingly complex business and IT environments? To be sure, there are no simple answers to a question involving such complex tasks fraught with many potential pitfalls. Drawing on input from, and characteristics of, organizations that have avoided breaches, the report does, however, offer several insights and suggests a best-practices approach.

Let’s get a bit more statistical for a moment:

·         Organizations spend an average of 321 hours per week, or roughly eight full-time employees, to manage the vulnerability response process

·         Nearly two-thirds (64%) of the respondents said that they plan to hire more staff people dedicated to vulnerability response over the next year – on average, this equated to four extra employees, i.e. an increase of 50% over the existing staffing levels

Now, hiring more people may actually be easier said than done, given the well-known dearth of cybersecurity talent. Regardless, the study arrives at one of its key takeaways, which it calls “security’s patching paradox”: more employees alone does not translate into improved security.

The crux of the patching problem lies elsewhere, according to the report. A few more stats may help drive the message home:

·         Most respondents (55%) said that they spend more time navigating manual processes than actually responding to vulnerabilities

·         Most (61%) feel disadvantaged due to the reliance on manual processes when patching vulnerabilities

·         An average of 12 days was lost manually coordinating across teams for every vulnerability that they patched

·         Two-thirds (65%) said they find it difficult to triage which hole needs to be plugged first and what can wait its turn

The rub

In a nutshell, then, organizations are being held back by inefficient manual processes and find it difficult to prioritize effectively what requires to be patched as a matter of urgency. Adding to their woes is another finding gleaned from the survey: every second respondent (53%) said that the time window for patching – the time between the release of a patch and an attack – has dropped by an average of 29% over the last two years.

In patching, speed can be of the essence. Organizations that have avoided breaches in the past two years stand out in two key respects: the ability to detect vulnerabilities quickly and, even more importantly, the ability to patch vulnerabilities in a timely manner, reads the report.

Given the skills gap, firms need to automate routine vulnerability response processes and remove internal process and data barriers in order to streamline and speed up the patching process significantly. They need to scan their systems and networks for vulnerabilities to see where a hole needs to be plugged: 37% of breach victims said that they don’t even carry out such scans. Prioritization of vulnerabilities is also essential, and it should consider the severity of the flaws based on scanner or CVVS scores and on understanding the importance of the affected systems.

All told, instead of seeking scarce talent, organizations would be better advised to make their internal processes more efficient and reduce the burden on staff by increasing reliance on automation, according to the study.

https://www.welivesecurity.com/2018/04/19/patching-shut-window-unpatched/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

Trends 2018: Democracy hack

Camilo Gutiérrez Amaya

  

Can the electoral processes be protected?

The past two years have seen electoral contests taken place in several countries long regarded as key players on the global stage. However, the elections raised a whole host of questions, among which the most pressing was whether a cyberattack could influence an electoral process to the extent of causing a shift in the political course of a nation?

To venture a definitive answer to such a question would be a daunting task for anyone, regardless of whether they sat in the chair of a political scientist or cybersecurity researcher. Nonetheless, it has become apparent that the scenario in which we currently find ourselves, poses a number of challenges. There is substantial evidence that the implementation of electronic voting has yielded results that are far from secure, as we will demonstrate here.

Moreover, there are two other crucial factors to which we must draw attention. Firstly, the influence of social networks on public opinion, especially in respect to pushing a political agenda, particularly the way in which they support hacktivism; and lastly, the need to include national cybersecurity issues as part of the political agenda.

Insecure electronic voting systems

It was only a matter of time before information technology would be incorporated into the electoral process, especially given the reasons why certain countries (such as Argentina, Brazil, Germany and the United States) decided to introduce a limited implementation of electronic voting, in some extent: to put an end to fraud, to standardize and speed up the counting process, and to supplement rather than replace the paper ballot system.

We can all agree that technology advances inexorably, but perhaps efforts should be aimed toward implementing more control mechanisms rather than favoring an approach that actually adds new points of failure without removing any of the risks.

Just as unscrupulous campaign officials, activists and other key players have found ways to commit fraud over the years by exploiting the electoral system itself, soon cybercriminals will discover ways to capitalize on the digital system, particularly if they are armed with sponsorship of some kind.

Back in 2006, Finnish computer programmer and co-founder of ROMmon, Harri Hursti had already demonstrated in the well-known documentary Hacking Democracy, how the Diebold voting system in Leon County, Florida, could be easily and completely compromised just by using a memory card.

Just like that, he was able to change all of the votes without being detected. Nonetheless, this same software – that with just a few adjustments, a new name and a change of ownership – continues to be used in the United States to record and count tally votes.

Fast forward 10 years and very little has changed, other than the fact that additional evidence has been revealed. Brazil’s electronic ballot box has been mired in controversy since 2012, when it was discovered that it was possible to crack voting secrecy completely. After years of substantiated allegations of vulnerabilities, the Superior Electoral Court will go back to implementing paper ballots (in a hybrid format) for just 5% of ballot boxes to be used for elections in 2018. Meanwhile, electronic ballot procedures in both Argentina and Germany have been shown to be flawed as well.

The preponderance of evidence to date, strongly suggest that we cannot rely solely on technology for something as significant to our lives as the electoral process; it must only be used as a complementary tool. If the idea is to mitigate any and all forms of fraud, thus boosting faith in both the results and our democracies, we must consider hybrid systems with both paper and electronic ballot records.

Hacktivism that can change public opinion

Social media has become the new frontier of the political stage and used by political campaigns to reach increasingly large numbers of people. As we now know, these same networks have also been used to undermine electoral campaigns by spewing falsehoods, and promoting fake news reports, not to mention widespread attacks on reputation aimed at public figures.

A number of these attacks use bots, computer threats such as bots or other form of malware, which could be mitigated with adequate security management protocols in place. Otherwise, what might appear to be the indication of a trend may actually be the manifestation of a group of attackers.

While such an attack might help to manipulate or skew popular opinion, it does not signal doomsday for democracy. However, but it does pose some critical cybersecurity challenges in order to ensure that the voice of the populace is truly represented in the elections.

The “Defending Digital Democracy” program, announced earlier in July, is backed and endorsed by companies like Facebook and Google, which suggests how highly they rate the importance of securing these types of mechanisms.

If the parties involved don’t take matters into their own hands, these kinds of incidents will continue to happen well into the future.

National cybersecurity

If technology is a major part of our lives, then the governments must be tasked with the responsibility of ensuring that users interact with technology as safely as possible, by implementing a national cybersecurity programs engaging with key players, such as CISOs and auditors.

And if public officers, such as court authorities or voting commission officials, must make decisions regarding the implementation of certain technologies, then they should undergo cybersecurity training appropriate to the situation, to help them make the most suitable choices.

There is no doubt that new risks come with every new advancement, but if we want to use technology to improve our lives, then we must prevent it from creating greater problems overall than benefits. All aspects of an electoral system must be regarded as part of every country’s critical infrastructure (and be safeguarded as such).

The challenges are laid out before us. Now is the time to engage in preventive measures that focus on the digital security of information, and all those involved must contribute to solutions that guarantee the proper implementation of democratic processes.

https://www.welivesecurity.com/2018/04/18/trends-2018-democracy-hack/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

Quarterly cybercrime digest: Sentencing

Tomáš Foltýn  

 The long arm of the law caught up with a number of cybercriminals in the first three months of this year.

Picking up where we left off in Part 1, we continue to comb through headlines in order to bring another instalment in our rundown of some of the recent law enforcement actions in its struggle against cybercrime. As the old adage goes, the wheels of justice turn slowly (perhaps sometimes too slowly?), but grind exceedingly fine.

Sentencing

Man sent to prison over giant credit card info theft

A New Jersey court sentenced a Russian national, Vladimir Drinkman, to 12 years in prison for his role in what US authorities described as the “largest known data breach conspiracy ever prosecuted” by the country. Drinkman’s accomplice, Dmitriy Smilianets, was also sentenced, albeit “only” to 51 months. Having already served his time, Smilianets was released.

Between 2005 and 2012, the ring caused losses worth hundreds of millions of US dollars after selling 160 million credit card numbers that they had stolen from a number of payment processors, banks, and retailers. This includes some of the worst known breaches, including the hack in Heartland in 2009, which was the very largest breach reported at the time. Drinkman was nabbed in the Netherlands in 2012 and extradited to the US three years later.

Another member of the ring, Albert Gonzalez, of the US, is already serving a sentence of 20 years. Three more suspected members of the gang – two Russians and one Ukrainian national – are at large.

Ringleader of credit card fraud ring jailed

An American was sent to prison for nine years after he led a 12-member gang that had, for two-and-a-half years, purchased large amounts of stolen credit card details on the dark web and used the information to manufacture fake credit cards, according to an announcement by the US Department of Justice. They used the fake cards to purchase various merchandise, ranging from gift cards to large quantities of cigarettes, which they then resold for cash. Just like all of the other 11 members of the ring, Travon Williams also pleaded guilty to the charges.

UK academic who tormented victims online jailed for 32 years

Those with malicious intent often flock to the dark web. But even in the context of all manner of illicit activity that occurs in the internet’s seedy underbelly, one recent case stands out. In the middle of February, a British court sent a 29-year-old university researcher to jail for 32 years for engaging in particularly depraved acts that he had perpetrated via the dark web, according to a BBC report. The details are too appalling to describe here, so let us just say that Matthew Falder, a former excellent Cambridge student, confessed to 137 charges against 46 people – all over a span of almost 10 years. Tracking Falder down and arresting him took four years. Sometimes those wheels of justice seem to turn way too slowly.

Disgruntled ex-employee jailed

A Welsh man was sentenced to 10 months in jail for launching a revenge cyberattack on his former employer, reads a report by The Daily Post. In fact, Gavin Prince’s former boss at a tenant referencing firm called ‘LetsXL’ said that the IT expert had been causing trouble even during his tenure with the company – by deliberately crashing its systems to justify his job. As if earning himself the sack weren’t enough, Prince went on to launch a four-day attack at the company. He changed passwords to mailboxes, accessed the e-mails of other employees, and even set the emails of one employee to delete.

Hacker who DDoS-ed Google and Skype put behind bars

A prolific British hacker was jailed in January for two years after he admitted to various computer-related offences, the BBC reported. Among other offences, Alex Bessell, 21, used 9,000 bots, or zombie computers, to carry out more than 100 distributed denial-of-service (DDoS) attacks at various firms, including Google, Skype and Pokemon. Having started his malicious campaigns at the age of 14, Bessell also went on to operate his own Darknet business that sold malicious wares, both of his own and others’ making. No less than 9,000 such items recorded 34,000 purchases between them.

Ukraine convicts two DDoS extortionists

Meanwhile, a court in Ukraine sentenced a woman and a man to suspended jail times of five years each for orchestrating powerful DDoS attacks and running a DDoS extortion scheme in 2015 and 2016. According to a BankInfoSecurity report citing court documents, Inna Yatsenko and Gayk Grishkyan disrupted hundreds of websites, including those belonging to a number of international firms. Their first target – a popular dating service called AnastasiaDate that connects men in North America with women from Eastern Europe – sustained persistent attacks over the span of two years. Yatsenko, who was reportedly the leader of the ring that included more than the pair, owned a local marriage agency and had previously collaborated with AnastasiaDate, reads a Bleeping Computer report.

ATM skimming gang ringleader sentenced – in absentia

In another notable case, however, justice has yet to be served. A UK court handed down a prison term of 11 years on a Romanian national after convicting him of leading a notorious cybercriminal ring that had designed and sold ATM skimming devices, reads a Daily Mail report. So far, so good, where’s the catch, then? Alexandru Sovu was let out on bail and then absconded during his trial – reportedly on board a private plane during flying lessons. The fugitive was reportedly soon back at it again, hawking his wares on his website, albeit since shut down again. Sovu’s gang had pocketed over US$4.2 million by designing ATM skimmers and fronts and selling them to fraudsters in a number of countries.

In Part 3, we will zero in on extraditions of suspected cyber-criminals. A small added bonus will also be provided.

https://www.welivesecurity.com/2018/04/16/quarterly-cybercrime-digest-sentencing/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

Anti-Malware testing needs standards, and testers need to adopt them

By Tony Anscombe

A closer look at Anti-Malware tests and the sometimes unreliable nature of the process.

Imagine one of your children is a high school student and due to take university or college entrance exams. You know the exams are due at some time during the year, have an idea what the exam may include and are patiently awaiting notification for more details. Regardless of not knowing exactly what is in the exam, your diligent student stays home and studies hard in preparation.

At the very last moment your student hears, unofficially, that the exam is scheduled, but no details are available. Stressed and frustrated, your student does get included in the exam.

After the exam you find out that some students were sent notifications and details on the content of the exam: they were also allowed to take certain equipment with them to assist their participation. After the exam, those same students were given the opportunity to see their results and negotiate the scoring of the questions they got wrong to improve their final score.

I suspect you would be upset, maybe angry, and would likely object to the unfair process that your child endured. Would it be fair if a university or college then used the exam results to make a decision on whether to offer your child a place?

The anti-malware industry and its ability to detect the attempts of cybercriminals to harm or render systems useless may often appear to be a dark art to people looking in from outside the industry. That’s the very reason why testing the efficacy of products is important, so that you don’t need to be an expert to understand if a product works well, or not.

However, tests are only as good as the competence and ethics of the tester and while most practice good ethics there are some that don’t. For example, if a test has questionable methodology, or includes vendor participants with a special relationship with the tester, or allows some vendors to optimize their products, or is just run badly, then the results are brought into question.

The security industry has grappled with this very issue for some time: the formation of the Anti-Malware Testing Standards Organization (AMTSO) in 2008 was intended to bring the two sides, testers and vendors, together and create a forum for dialogue. The purpose and charter of AMTSO, in summary, is to provide such a forum, create standards and best practices, provide education on testing and to create tools and resources to aid standards-based testing.

AMTSO is in the process of creating standards: they published a draft agreed, in December, by the membership, made up of testers, vendors and academics. It would seem reasonable that a tester member of AMTSO should conduct tests adhering to the draft standards, after all they are part of the organization that created them, and some testers have conducted tests based on the draft, with success.

Any test run, even without formally following the standards, should be conducted using fair and unbiased conditions. For example, if some vendors are given the opportunity to configure their product to optimize the final result or are granted other privileged access during the test, then all vendors should be afforded the same advantages. If the playing field is not level then it should be clear who had the benefits and more importantly who did not.

There are further questionable practices: what if a vendor pays to be tested just before a group test? Should this be noted in the test result that follows? Imagine the scenario where a test methodology is published, a vendor pays to be tested against it to see what result they may achieve. When the actual test is run they may have optimized detection to suit the test, but does this reflect the result a purchaser of the product could expect to see in normal use? Probably not.

After a test has been conducted there is typically a period of time where vendors are given the opportunity to validate the results: that is, decide whether they agree with what they missed or wrongly detected (known as a false positive). In my experience, some testers use this later stage to monetize their testing – if you want the results to validate then you need to pay – while other testers only allow certain vendors to validate their test results. Segmenting vendors so that only certain ones are allowed to validate results creates test results that cannot be used to compare products fairly or accurately.

When a Chief Security Officer (CSO) picks up a report showing the efficacy of anti-malware products, it is only natural to be drawn straight to the graph that displays the percentage of malware detected. And when a vendor’s marketing team members use the test results they only include the graph. If the tester has hidden, deep in the report, some of the inconsistencies of the terms under which different vendors participated, they are unlikely to ever be read or considered when looking at the final results.

If the test report is going to be used to make a crucial decision on what protection to select then it’s critical that the methodology, commercial relationships and ethics behind the test are taken into account. If this information cannot be gleaned from the information in the report then contacting the tester for clarification is a must.

It’s important that a test takes place on a level playing field and that all the teams taking part are afforded the same conditions, opportunities and validation options. If they are not, then the results are biased in favor of the vendors that were afforded privileged conditions, and the results belong in the circular grey filing cabinet under my desk.

Quarterly cybercrime digest: Part 1 - News, views, and insight from the ESET security community

By Tomáš Foltýn

In Part 1, our roundup of some of the most notable law enforcement actions against computer crime in the first quarter of 2018 will focus on arrests and charges involving suspected cyber-crooks.

Compared to combating conventional crime, efforts to bring computer criminals to justice involves a host of specific challenges for law enforcement. The difficulties reside on many levels and concern, for example, the attribution of such crimes, their borderless nature, the (relative) anonymity afforded by cyberspace, or the challenge in gathering bulletproof evidence. All told, cyberattackers often perpetrate their crimes because they view them as a low-risk, high-reward proposition.

Notwithstanding the varied challenges, law enforcement hits back in a number of cases. The first three months of this year saw dozens of success stories for law enforcement, both in clamping down on ‘lone wolves’ and in unraveling the tangle of large cybercriminal schemes. We reported on several such cases, including on a jail sentence for a man involved in a ‘hacker-for-hire’ service and on a crackdown on a global fraud enterprise.

However, news reports of cases when authorities – often aided by security researchers – throw a wrench in the works of cybercriminal operations may sometimes get ‘lost in the shuffle’ of constant news streams. This is where this roundup of notable arrests, indictments and rulings comes in.

Arresting and charging

Fourth ‘Celebgate’ suspect agrees to plead guilty

Early this year, a fourth suspect agreed to plead guilty to charges in connection with the notorious “Celebgate” nude photo hack in 2013 and 2014, according to The Register. George Garofano admitted to using phishing scams in order to break into more than 250 iCloud accounts, including those belonging to Hollywood A-listers. He may now face up to five years in prison. We reported on previous court actions in the case back in July and October 2016.

Canadian charged over operating bazaar with stolen details

Also in early January, journalist Brian Krebs wrote about charges against a Canadian national in connection with his alleged administering of LeakedSource.com, a repository of three billion stolen or leaked online credentials. Jordan Evan Bloom may face up to ten years in prison for trafficking in personal identity records between 2015 and early 2017. According to an investigation that spanned over 18 months, Bloom is believed to have made US$200,000 from his shady business.

Russia breaks up ring suspected of hacking gas pumps

Russian authorities broke up a massive fraud ring that is believed to have installed malicious software on the IT systems of dozens of gasoline stations in the country, ripping off countless customers in the process. The scheme, as reported by Bleeping Computer, worked along these lines – when car owners came to refuel, the malware redirected up to 7 percent of the amount of fuel into a hidden tank that rogue gas station employees had placed for that very purpose. The unsuspecting customers were charged the full amount, of course. Once the tank filled up, the gang re-sold the stolen fuel and pocketed the money, while additional malware cloaked the transactions. The scheme’s alleged mastermind was arrested and charged.

Australian charged with hack of car-sharing startup

Speaking of cars, Australian police arrested a Nik Cubrilovic on accusations that, among other things, he had broken into the network of a car sharing service, GoGet, to take his girlfriend on dozens of free joyrides in luxury cars. In a notable twist, the man – described by the website of the SBS TV network as a “prominent hacker, entrepreneur and IT security consultant” – had reportedly advised GoGet on flaws in its software system that could expose it to a cyberattack. There’s no indication if this is what made him the prime suspect in the hack.

Two men charged over jackpotting heists

In early February, ArsTechnica reported that US authorities had pressed charges against two men who had allegedly stolen huge amounts of cash in ATM ‘jackpotting’, a type of attack that involves using software or hardware to manipulate cash machines into ejecting all their cash reserves. This was only a week after security journalist Brian Krebs wrote about a secret service warning that this kind of attack had found its way into the US.

Alleged Avalanche mastermind arrested – again

Remember what happened in November 2016? Never mind, neither do we. A little clue, though – a law enforcement operation involving authorities from some 30 countries dismantled a criminal network that had provided infrastructure for large malware campaigns. The network, called Avalanche, was responsible for compromising up to half a million computers in the world daily. Around 15 months after the crackdown, one of the ring’s alleged dons, ​Gennadiy Kapkanov, was arrested in Ukraine, according to ZDNet. Or rather, he was re-arrested after being first nabbed back in the sting in 2016. Then he was released by the court and disappeared.

Poland indicts alleged prolific purveyor of ransomware

Polish authorities arrested a man who is suspected of having authored the Polski, Vortex and Flotera ransomware strains, according to Bleeping Computer. The Polish national, identified only as Tomasz T., is believed to have made over $145,000 from his criminal endeavors. In fact, in addition to ransomware, he allegedly dedicated himself to banking Trojans. His ransomware is said to have encrypted thousands of computers during a series of online attacks on various Polish companies between 2013 and 2018.

Nine Iranians charged with hacking universities

Meanwhile, US prosecutors indicted nine Iranian nationals over cyberattacks targeting 144 universities in the US and 176 universities in 21 other countries, as well as 47 companies globally. During their alleged three-year campaign, the accused allegedly exfiltrated more than 31 terabytes of information, worth over US$3 billion in intellectual property. The network intrusions are believed to have begun with sophisticated spear-phishing campaigns.

Romania, Italy bust alleged spear-phishing ring

In late March, Europol reported that Romanian and Italian authorities arrested a total of 20 people suspected of being involved in a banking phishing scam that had defrauded hundreds of bank customers of the equivalent of US$1.24 million. This group, too, reportedly sent out spear-phishing emails, although this gang is thought to have impersonated tax authorities in order to harvest the online banking credentials of their victims.

Stay tuned for Part 2 on Monday, in which we will zero in on court rulings and extraditions.

https://www.welivesecurity.com/2018/04/13/quarterly-cybercrime-digest-part-1/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

This ransomware wants you to play, not pay

 Tomáš Foltýn

An unusual ransomware request has been uncovered by researchers.

Researchers have discovered a new piece of ransomware that holds the victim’s files hostage. This one, however, comes with a rather peculiar demand in return for recovering the files, according to a Bleeping Computer report citing research by MalwareHunterTeam.

When executed, this ransomware – called “PUBG Ransomware” and detected by ESET as MSIL/Filecoder.HD – encrypts files and folders “only” on the user’s desktop and adds the .PUBG extension to them.

Then, a splash screen is displayed that contains the ransom note. It turns out that, in order to set the victim’s digital belongings free, all that the rather benign ransomware wants from the user is spend an hour playing a game called PlayerUnknown’s Battlegrounds (commonly known as PUBG, hence the ransomware’s name).

Or so the ransom note says. In fact, however, it was found that simply running the PUBG-associated executable for three seconds is enough to trigger the decryption.

Either way, if you’re not in the mood to even touch the game, the ransomware seems to let users off the hook: the ransom message includes the “restore code” apparently with no strings attached.

An analysis showed that the ransomware keeps tabs on processes running on the computer and checks if a process called “TslGame” is run. TslGame is apparently triggered whenever PUBG is launched, providing a way for the ransomware to determine, albeit somewhat simplistically, if the victim is playing ball. It’s unclear how this ransomware is being spread.

We reported in our mid-year review of last year’s cybersecurity landscape on another piece of ransomware that demanded that the user play a game. That creation, called ‘Rensenware’, required the victim to get a high score, at the “lunatic” level of a Japanese PC game in order to get their files back.

All told, however, these curious tales should not detract from the magnitude of the threat that ransomware represents at present. Campaigns from not long ago are a stark reminder of how much damage extortion campaigns can wreak.

ESET Senior Research Fellow David Harley is keen to point out that this incident should not be treated lightly, “While this program has been referred to as ‘what could only be a joke’, it’s not really that funny. For a start, messing with a victim’s data might conceivably go horribly wrong in some circumstances – it doesn’t sound to be an impeccably well-coded program – we saw this time and time again in the heyday of the virus, where malware written by hobbyist virus writers had some (presumably) unintended but unfortunate effect. In any case, seeing a message like this could cause a victim serious concern, if they didn’t understand exactly what was going on.
Even more important, this still looks to me like activity that would be regarded in principle as criminal in most jurisdictions, since it involves unauthorized access and modification. The fact that it probably wasn’t meant to be malicious doesn’t mean that it shouldn’t be taken seriously. The next such ‘joke’ might turn out to be even less humorous”.