Hackers are now targeting councils and governments, threatening to leak citizen data

Ransomware attacks are becoming increasingly complex, as hackers find creative ways to beat ordinary systems of defence.

Hackers are now targeting councils and governments

Roberto Musotto, Edith Cowan University and Brian Nussbaum, University at Albany, State University of New York

In recent weeks, Johannesburg’s computer network was held for ransom by a hacker group called Shadow Kill Hackers. This was the second time in three months that a ransomware attack has hit South Africa’s largest city. This time, however, hackers didn’t pose the usual threat.

Rather than denying the city access to its data, the standard blackmail in a ransomware attack, they threatened to publish it online. This style of attack, known as leakware, allows hackers to target more victims in a single attack – in this case the city’s citizens.


Read more: What is ransomware and how to protect your precious files from it


The latest Johannesburg attack was the second leakware attack of this type ever recorded, and a similar attack could hit Australia soon. And although our current cyberattack defences are more advanced than many countries, we could be taken by surprise because of the unique way leakware operates.

A new plan of attack
During the Johannesburg attack, city employees received a computer message saying hackers had “compromised all passwords and sensitive data such as finance and personal population information”. In exchange for not uploading the stolen data online, destroying it and revealing how they executed the breach, the hackers demanded four bitcoins (worth about $A52,663) - “a small amount of money” for a vast city council, they said.

shadow kill hackers

The hacker group operated a Twitter account, on which they posted a photo showing the directories they had access to. ShadowKillGroup/twitter

In this case, access to data was not denied. But the threat of releasing data online can put enormous pressure on authorities to comply, or they risk releasing citizens’ sensitive information, and in doing so, betraying their trust.

The city of Johannesburg decided not to pay the ransom and to restore systems on its own. Yet we don’t know whether the data has been released online or not. The attack suggests cybercriminals will continue to experiment and innovate in a bid to defeat current prevention and defence measures against leakware attacks.

hack warning screen

This login screen message was displayed on computers in Johannesburg following the attack. pule_madumo/twitter

Another notable leakware attack happened a decade ago against the US state of Virginia. Hackers stole prescription drug information from the state and tried obtaining a ransom by threatening to either release it online, or sell it to the highest bidder.

When to trust the word of a cybercriminal?
Ransomware attack victims face two options: pay, or don’t pay. If they choose the latter, they need to try other methods to recover the data being kept from them.

If a ransom is paid, criminals will often decrypt the data as promised. They do this to encourage compliance in future victims. That said, paying a ransom doesn’t guarantee the release or decryption of data.

The type of attack experienced in Johannesburg poses a new incentive for criminals. Once the attackers have stolen the data, and have been paid the ransom, the data still has extractive value to them. This gives them duelling incentives about whether to publish the data or not, as publishing it would mean they could continue to extort value from the city by targeting citizens directly.


Read more: Ransomware attacks on cities are rising – authorities must stop paying out


In cases where victims decide not to pay, the solution so far has been to have strong, separate and updated data backups, or use one of the passkeys available online. Passkeys are decryption tools that help regain access to files once they’ve been held at ransom, by applying a repository of keys to unlock the most common types of ransomware.

But these solutions don’t address the negative outcomes of leakware attacks, because the “hostage” data is not meant to be released to the victim, but to the public. In this way, criminals manage to innovate their way out of being defeated by backups and decryption keys.

The traditional ransomware attack
Historically, ransomware attacks denied users access to their data, systems or services by locking them out of their computers, files or servers. This is done through obtaining passwords and login details and changing them fraudulently through the process of phishing.

It can also be done by encrypting the data and converting it to a format that makes it inaccessible to the original user. In such cases, criminals contact the victim and pressure them into paying a ransom in exchange for their data. The criminal’s success depends on both the value the data holds for the victim, and the victim’s inability to retrieve the data from elsewhere.

Some cybercriminal groups have even developed complex online “customer support” assistance channels, to help victims buy cryptocurrency or otherwise assist in the process of paying ransoms.

Trouble close to home
Facing the risk of losing sensitive information, companies and governments often pay ransoms. This is especially true in Australia. Last year, 81 per cent of Australian companies that experienced a cyberattack were held at ransom, and 51 per cent of these paid.

Generally, paying tends to increase the likelihood of future attacks, extending vulnerability to more targets. This is why ransomware is a rising global threat.


Read more: When it comes to ransomware, it's sometimes best to pay up


In the first quarter of 2019, ransomware attacks went up by 118 per cent. They also became more targeted towards governments, and the healthcare and legal sectors. Attacks on these sectors are now more lucrative than ever.

The threat of leakware attacks is increasing. And as they become more advanced, Australian city councils and organisations should adapt their defences to brace for a new wave of sophisticated onslaught.

As history has taught us, it’s better to be safe than sorry.The Conversation

Roberto Musotto, Research Fellow in Cyber Security and Law, Edith Cowan University and Brian Nussbaum, Assistant Professor at College of Emergency Preparedness, Homeland Security and Cybersecurity, University at Albany, State University of New York

This article is republished from The Conversation under a Creative Commons licence. Read the original article.

If you enjoy our content, don’t keep it to yourself. Share our free eNews with your friends and encourage them to sign up.

RELATED ARTICLES





    COMMENTS

    To make a comment, please register or login

    8th Jan 2020
    8:09am
    I just want to thank you to share your information on your blog; this is a simple and useful. Moving to Phoenix Arizona
    wilsonborne44
    28th Feb 2020
    1:12am
    NO UPFRONT PAYMENT!
    WE PROVIDE PROOF BEFORE HACKING
    Hack with comfort and get your job done systematically without a bridge of security alert.
    It’s frustrating not getting the value of your money on services paid for.
    If you are in need of
    ** Recover stolen funds from Bitcoin investment
    ** safe exploit in hacking, Catch a cheating spouse
    ** Binary Option scam
    ** cryptocurrency scam.
    Make the right decision of using CREDITSOLUTION63, and keep tab on any subjects be it Recovery of stolen Funds, Cryptocurrency scam,spouse, employees and friends information from social media, Phones, websites and erasing of certain confidential
    records you don’t want to be at public domain, we don’t brag about hack exploit it is what we do best.
    Contact Below:
    Email: CREDITSOLUTION63@GMAIL.COM
    WhatsApp: +1 9176634684
    You Can Also Text Or Call: +1 9176634684

    9th Jun 2020
    6:01am
    Hack Ethics is a Verified Experienced Binary Options Recovery Specialist and Professional Hacker that provides the experience, intelligence, expertise in Asset Recovery and successfully solve ANY DESIRED HACKING SERVICES YOU WANT with ease which includes BINARY OPTIONS FUNDS RECOVERY, CREDIT REPAIR, PHONE & SOCIAL MEDIA HACKS and so on. 

    People have lost their hard earned money through this BINARY OPTIONS TRADINGS, yet they would go to meet FAKE HACKERS who are also scammers unknowingly to help them recover their money and they would end up losing more money in the process. These Scammers also tend to put Fake Testimonies out there just to steal more from you by giving you False hope. I understand how heartbreaking it is to be a BINARY OPTIONS SCAM VICTIM after you've been promised your fortune by Binary Companies and then they ignore your Emails or Calls after stealing from you.  I'm taking every step to render solution to those innocent people affected and help them get every penny they lost.  CONTACT  EMAIL  -  HACKETHICS008@GMAIL.COM 
       REPOSTING MY ARTICLE ON EVERY PLATFORM AND FORUM TO HELP VICTIMS OUT THERE.

    9th Jun 2020
    6:54pm
    Hack Ethics is a Verified Experienced Binary Options Recovery Specialist and Professional Hacker that provides the experience, intelligence, expertise in Asset Recovery and successfully solve ANY DESIRED HACKING SERVICES YOU WANT with ease which includes BINARY OPTIONS FUNDS RECOVERY, CREDIT REPAIR, PHONE & SOCIAL MEDIA HACKS and so on. 

    People have lost their hard earned money through this BINARY OPTIONS TRADINGS, yet they would go to meet FAKE HACKERS who are also scammers unknowingly to help them recover their money and they would end up losing more money in the process. These Scammers also tend to put Fake Testimonies out there just to steal more from you by giving you False hope. I understand how heartbreaking it is to be a BINARY OPTIONS SCAM VICTIM after you've been promised your fortune by Binary Companies and then they ignore your Emails or Calls after stealing from you.  I'm taking every step to render solution to those innocent people affected and help them get every penny they lost.  CONTACT  EMAIL  -  HACKETHICS008@GMAIL.COM 
       REPOSTING MY ARTICLE ON EVERY PLATFORM AND FORUM TO HELP VICTIMS OUT THERE.

    9th Jun 2020
    7:40pm
    Hack Ethics is a Verified Experienced Binary Options Recovery Specialist and Professional Hacker that provides the experience, intelligence, expertise in Asset Recovery and successfully solve ANY DESIRED HACKING SERVICES YOU WANT with ease which includes BINARY OPTIONS FUNDS RECOVERY, CREDIT REPAIR, PHONE & SOCIAL MEDIA HACKS and so on. 

    People have lost their hard earned money through this BINARY OPTIONS TRADINGS, yet they would go to meet FAKE HACKERS who are also scammers unknowingly to help them recover their money and they would end up losing more money in the process. These Scammers also tend to put Fake Testimonies out there just to steal more from you by giving you False hope. I understand how heartbreaking it is to be a BINARY OPTIONS SCAM VICTIM after you've been promised your fortune by Binary Companies and then they ignore your Emails or Calls after stealing from you.  I'm taking every step to render solution to those innocent people affected and help them get every penny they lost.  CONTACT  EMAIL  -  HACKETHICS008@GMAIL.COM 
       REPOSTING MY ARTICLE ON EVERY PLATFORM AND FORUM TO HELP VICTIMS OUT THERE.


    Join YOURLifeChoices, it’s free

    • Receive our daily enewsletter
    • Enter competitions
    • Comment on articles