{"id":157889,"date":"2016-03-10T10:59:55","date_gmt":"2016-03-10T08:59:55","guid":{"rendered":"http:\/\/mybroadband.co.za\/news\/?p=157889"},"modified":"2016-03-10T11:01:21","modified_gmt":"2016-03-10T09:01:21","slug":"this-is-what-happens-when-your-computer-gets-infected-with-ransomware","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/157889-this-is-what-happens-when-your-computer-gets-infected-with-ransomware.html","title":{"rendered":"This is what happens when your computer gets infected with ransomware"},"content":{"rendered":"

The first ransomware targeting Apple\u2019s Mac computers running OS X recently infected the installer for Transmission<\/strong><\/a>, a cross-platform BitTorrent client.<\/p>\n

Ransomware is nothing new, with infections reported on Windows machines,\u00a0Linux servers<\/strong><\/a>, and Android smartphones<\/strong><\/a>.<\/p>\n

Attackers use many methods to get their malicious software onto the devices of unsuspecting users.<\/p>\n

These include e-mail trojans that exploit Microsoft Word macros, support scams<\/strong><\/a>, and compromising the website of an app like Transmission to replace the legitimate installer with one infected with ransomware.<\/p>\n

YouTuber Rogueamp has published numerous videos showing what happens when ransomware takes over your machine.<\/p>\n

Step-by-step breakdowns of two of his videos are shown below, beginning with the new KeRanger ransomware for OS X.<\/p>\n

\n

KeRanger for OS X<\/h3>\n

This ransomware infected the installer of Transmission 2.90 for OS X, as reported by\u00a0Palo Alto Networks<\/strong><\/a>.<\/p>\n

While updated OS X installations should no longer be vulnerable to KeRanger, Rogueamp\u2019s demonstrations are conducted within a virtual machine. Don\u2019t try this at home.<\/p>\n

The infection begins after you install and run Transmission 2.90.<\/strong><\/p>\n

\"KeRanger<\/a><\/p>\n

\n

Transmission 2.90 contains General.rtf, which looks like a document, but is actually KeRanger\u2019s executable.<\/strong><\/p>\n

\"KeRanger<\/a><\/p>\n

\n

When KeRanger executes, it encrypts all your documents and media files.<\/strong><\/p>\n

\"KeRanger<\/a><\/p>\n

\n

KeRanger places a notice in each folder where it has encrypted files.<\/strong><\/p>\n

\"KeRanger<\/a><\/p>\n

\n

It directs you to go to a URL, where you must log in with a\u00a0key the attackers provide.<\/strong><\/p>\n

\"KeRanger<\/a><\/p>\n

\n

You must pay the ransom of 1 Bitcoin (R6,300) to the wallet they specify to get the key you need to decrypt your files.<\/strong><\/p>\n

\"KeRanger<\/a><\/p>\n

\n

Locky for Windows<\/h3>\n

Ransomware like KeRanger and Locky all work on the same principle: encrypt the victim\u2019s files, and extort money from them in the form of Bitcoin.<\/p>\n

Unlike KeRanger, Locky was distributed through a malicious Word macro in an e-mail with a fake invoice. After opening the invoice and enabling macros, it downloads and runs the ransomware from a server on the Internet.<\/p>\n

As before, Rogueamp\u2019s demonstration is conducted within a virtual machine.<\/p>\n

After Locky runs, it encrypts all your files and then displays this notice.<\/strong><\/p>\n

\"Locky<\/a><\/p>\n

\n

\u00a0Locky can encrypt unmapped network shares.<\/strong><\/p>\n

\"Locky<\/a><\/p>\n

\n

As with all ransomware, it directs you to a page where you can pay to get a key to unlock your files.<\/strong><\/p>\n

\"Locky<\/a><\/p>\n

\n

Watch Rogueamp\u2019s ransomware demonstrations below<\/h3>\n