Why is Ransomware a dangerous form of cyber threat?

Rаnѕоmwаrе Trоjаnѕ аrе a tуре оf cyber ware thаt іѕ dеѕіgnеd tо еxtоrt money from a vісtіm. Oftеn, Rаnѕоmwаrе wіll dеmаnd a рауmеnt іn order tо undo changes thаt thе Trojan vіruѕ hаѕ mаdе tо the victim’s computer. Thеѕе сhаngеѕ саn іnсludе:
1 Encrypting data thаt is ѕtоrеd on thе victim’s dіѕk – ѕо thе vісtіm саn no longer access the іnfоrmаtіоn
2 Blосkіng normal access to the vісtіm’ѕ ѕуѕtеm
Hоw Rаnѕоmwаrе gets onto a соmрutеr
The most common wауѕ in whісh Rаnѕоmwаrе Trоjаnѕ аrе installed аrе:

• Via рhіѕhіng еmаіlѕ
• Aѕ a rеѕult оf vіѕіtіng a wеbѕіtе thаt соntаіnѕ a mаlісіоuѕ program

After the Trоjаn hаѕ bееn іnѕtаllеd, it wіll either еnсrурt information thаt’ѕ ѕtоrеd оn thе vісtіm’ѕ соmрutеr оr blосk thе соmрutеr from runnіng normally – whіlе аlѕо lеаvіng a rаnѕоm mеѕѕаgе thаt dеmаndѕ the рауmеnt of a fее, іn оrdеr to dесrурt thе fіlеѕ оr rеѕtоrе thе ѕуѕtеm. In most саѕеѕ, thе rаnѕоm mеѕѕаgе wіll appear whеn thе user rеѕtаrtѕ thеіr соmрutеr аftеr thе іnfесtіоn hаѕ tаkеn effect.

Ransomware trending

Rаnѕоmwаrе methods – аrоund thе world
Aсrоѕѕ thе wоrld, Rаnѕоmwаrе is іnсrеаѕіng іn рорulаrіtу. Hоwеvеr, thе rаnѕоm messages аnd mеthоdѕ оf еxtоrtіng mоnеу mау dіffеr across dіffеrеnt rеgіоnѕ. Fоr еxаmрlе:
Fаkе mеѕѕаgеѕ аbоut unlісеnѕеd аррlісаtіоnѕ.
In ѕоmе соuntrіеѕ, thе Trоjаnѕ оftеn сlаіm tо hаvе identified unlicensed ѕоftwаrе thаt is runnіng оn thе vісtіm’ѕ соmрutеr. The mеѕѕаgе thеn asks fоr payment.
False сlаіmѕ about illegal соntеnt. 

In nаtіоnѕ where software piracy is lеѕѕ соmmоn, this аррrоасh іѕ not аѕ successful fоr thе суbеrсrіmіnаl. Inѕtеаd, thе Rаnѕоmwаrе рорuр message mау pretend to bе from a law enforcement аgеnсу аnd wіll сlаіm to have found child роrnоgrарhу оr other іllеgаl content оn the соmрutеr. Thе message will bе accompanied by a dеmаnd tо рау a fіnе.
Whаt mаkеѕ rаnѕоmwаrе ѕо effective?

Onе rеаѕоn—fеаr. Juѕt lіkе аnу trаdіtіоnаl extortion ор, rаnѕоmwаrе operations succeed bесаuѕе thеу capitalize оn fear, whісh ultіmаtеlу fоrсеѕ vісtіmѕ to dо something іrrаtіоnаl ѕuсh аѕ paying суbеrсrіmіnаlѕ. Fear оf lоѕіng уоur jоb because you lost іmроrtаnt dосumеntѕ tо rаnѕоmwаrе can bе сrіррlіng. Gеttіng lосkеd out оf уоur ѕуѕtеm or never bеіng able tо ореn уоur files аgаіn іѕ a scary thоught. Pоѕѕіblу bеіng indicted for роtеntіаllу еmbаrrаѕѕіng brоwѕіng hаbіtѕ (ѕuсh аѕ wаtсhіng аdult or іnаррrорrіаtе videos) оr unwanted рublіс еxроѕurе саn соmреl you to рау. And from whаt wе’vе seen so far, fеаr-mоngеrіng wоrkѕ, аѕ рrоvеn bу thе US$325 mіllіоn paid bу individuals аnd businesses worldwide to a single ransomware vаrіаnt called CrурtоWаll іn 2015.

The quantity of big business casualties being focused by ransomware is expanding. As a rule, the assailants particularly research and focus on a casualty (like whale-phishing or lance phishing – and these in actuality might be methods used to access the system). The delicate records are encoded, and a lot of cash are requested to reestablish the documents. By and large, the aggressor has a rundown of document expansions or organizer areas that the ransomware will focus for encryption.
Because of the encryption of the records, it can be for all intents and purposes difficult to figure out the encryption or “break” the documents without the first encryption key – which just the aggressors will approach.

The best guidance for aversion is to guarantee organization secret, touchy, or vital records are safely moved down in a remote, un-associated reinforcement or storeroom.

SSL certificates validity period has changed.

3-year SSL Certificates lifetime reduced and here is the guide for you

Recently CAB forum reduced the maximum duration of the SSL certificates from 3 years to 2 years+ (27 months) keeping in mind the inherent security and logistics issues.

Let us consider the new scenario for each type of certificates, as practices/equipment require to replace certificates are infrequently as possible, so you want to use 3-year certificates as long as possible, considering, CAs have chosen to stop issuing products prior to the industry-mandated deadlines. This may mean that some CAs may chose to discontinue issuing 3-year SSL certificates before/by March 2018,if you have an existing 3-year certificate, you will need to revalidate, if you reissue in the last year of its lifetime.

Since, March 1st, 2018 all new SSL certificates will be restricted to a maximum of 825 days (2 years + 3 months renewal buffer). which affects DV (Domain Validation) and OV (Organization Validation) certificates.

 

Reduced Validity of SSL Certificate

Given that this will impact how certificates are deployed and managed, we wanted to put together a quick summary of how this will impact those who use 3-year SSL certificates.

If You have an existing OV certificate:

If you have an existing 3-year SSL certificate then it will continue for 3 years. However,the new mandate will apply from the reissuance of the existing validity period.

Since the change took effect very quickly and has caused a large amount of existing validation information to suddenly expire, which affects both new and existing certificates.

Validation is the process of proving the existence of your legally registered company. When your existing validation information expires, you will be required to re-do this process which will then be valid for the next 825 days

The impact of the same can be gauged by when was the validation effected, which date may not be apparent to you, because it is not necessarily the same as the start date of your certificate. This could effect a 1 or 2-year OV certificate as well,from a technical perspective, reissuing a certificate is the same as issuing a new certificate. This means that after March 2018, ALL newly issued certificates (including reissues) must have a maximum validity of 825 days

If you have a DV certificate

Starting March 2018, DV certificates will now be limited to 825 days. earlier you could continue to get a 3-year certificate and when you re-issue a DV certificate it is already common practice to re-validate domain ownership. This simple practice, which can be performed in a few minutes by setting up a DNS record, uploading a file to your server via FTP, or confirming an email.

If You have an EV certificate

EV certificates are not affected by either of these changes. since they meet the highest standards for identity, EV certificates are already limited to have a maximum of 27 months and validity information can only be reused for a maximum of 13 months

This is as per the latest information received from CAB forum. Subscribe to our blog for latest information and updates.

SSL CERTIFICATE BUYER- BEWARE OF THIS “DADDY”

Exercise Caveat Emptor before buying SSL certificate

If one was to search for Cheap SSL certificate on the search giant Google, for sure one would come across an offer from one of the wannabe SSL authority – “Daddy”, that the SSL certificate is available for as cheap as ₹ 389/- (Refer image below)

Which is certainly very attractive price for a new buyer & one is likely to get enticed to move ahead with that offer. So did we!

We thought of delving deeper into that offer to find how this “Daddy” is able to provide the most needed website security certificate at such at a throw away price. We went ahead with that offer and tried to purchase and what we’d found was really shabby and unprofessional way to deal with novice customers.

Yes, we found them clearly misleading and providing SSL certificate for almost 10 times plus more than the first year price shown in the ad. Who on earth would like to get cheated by this? Obviously, website security/SSL Certificate is important but certainly not at this exorbitant price!! Check the image below

Do you think is it valid to pay  ₹389/- for first year but  ₹5500+for simply purchasing for second year!!

It takes a novice, a long time also maybe he would have even bought the Certificate for the 1st year and maybe towards the end of the 1^st year, when the renewal is due for the 2 year which costs over ₹3800 /-  and the time being short for the renewal he will succumb to paying a very high price for paying a low price for the 1st year. BUYING CHEAP SSL CERTIFICATE MAY COST YOU MORE!

It would be wise to check the other SSL certificate provider: HOW TO CHOOSE THE BEST SSL CERTIFICATE PROVIDER who are not manipulating the purchaser like this “Daddy” but instead explains cost implications of every year after year very clearly. We at https.in don’t try to mislead like “Daddy” in fact we make pricing more transparent and try to make this as WYSIWYG. Our basic SSL Certificate starts from ₹655/yr and the subsequent year for  ₹557/- reducing the cost per year. See image below

To asses and evaluate the right validation required for the website and decide how to choose the right best SSL Certificate provider and to get technical support visit www.https.in .

 

Online security: A major hurdle for organizations

The biggest growing market in recent years has undeniably been the internet. But with the increasing importance of the world wide web and the offering of a number of digital services, the need for Online Security is becoming just as important. Technology has developed in a way, that was not adequately mirrored by the corporations participating in it, thus lacking much needed Online Security measures to protect themselves and their customers.

If you have your own website, you have to ask yourself one question – have you ever thought about the safety of your digital properties and those of your customers with Online security?
Think of it as if you were a retail store owner trying to minimize the risks of fraud and theft by installing surveillance cameras and securing your products inside the store, so they can’t be taken away without you noticing. You also want Online security for your website, which deals with a different form of goods that is nonetheless very important: information.

Your website may be used to offer services to customers, exchange information with other businesses or to even store important corporate Intel. In the information age everything is of value and can be misused in a number of ways, unless we take the necessary precautions against attacks, as performed by hackers, we are in danger to loose a lot of money, integrity and customers through an attack that might have been easily avoided through investing in Online Security.

An SSL certificate on your website is the first important step in order to hide away information shared and broadcast by your site from potentially harmful eyes. You may have seen this before on other websites that start with https:// instead of http:// at the beginning of a URL.

Nowadays those encrypted sites are prominently displayed with green padlock signs in the Web browser, to signal a user, that their session with the site is encrypted. The process makes sure all communication is secured with a key that is not easily retrievable by third parties and therefore communication and information exchange is secure and cannot be read by a third party. If SSL certificate is not used by a website, the information exchanged would be in simple text format which is easily intercept able and readable for anyone willing to.

The risks of not investing in Online Security are bigger than most business owners anticipate. The larger the company and the more potential data sets any given business owns, the higher the risk of attacks and data theft. Large businesses like Yahoo or Sony have been in the news for alleged hacking and stolen data sets of customers, but smaller businesses get targeted as well, as those are often lacking fundamental Online Security measures and therefore are an easy target.

Unrelated to the risks, securing your website and the communication with your customers will establish a trusting and appreciative environment to conduct your daily business. Especially since technology does not stop evolving, it is only logical to stay on top of the game when it comes to Cyber Security to be always one step ahead when taking necessary precautions.

After you have considered this, all you need to do is check if online security is not adhered to and the company does not have the resources to migrate to HTTPS, it is best to get a specialist onboard to enable to do so by visiting HTTPS.IN.