The Ransomware Threat Report 2021 from Unit 42 shows that the average amount paid by ransomware victims tripled from 2019 to 2020.

Ransomware

Ransomware is a form of malware that encrypts the important files on a computer and the user (often a business/organisation) is given a ransom demand, the payment of which should mean that the encrypted files can be released. In reality, some types of ransomware delete many important files anyway and paying the ransom does not guarantee that access to files will be returned to normal.

The Palo Alto Networks, Unit 42 Ransomware Threat Report shows that the average ransom paid by a victim organisation in Europe, the US and Canada trebled from $115,123 (£83,211) in 2019 to $312,493 (£225,871) in 2020.  The report showed that, over the same period, the highest value ransom paid doubled from $5m (£3.6m) to $10m (£7.2m), and the highest extortion demand grew from $15m (£10.8m) to $30m (£22m).

Why?

Some of the main reasons for the increase in ransomware attacks and the increase in the amounts paid to attackers are thought to include:

– Attempts to exploit vulnerabilities/opportunities created by remote working.

– Businesses not having effective data backup procedures in place (no recoverable, workable backup).

– Costs of downtime perceived as being greater than the cost of paying the ransom. Paying the ransom, however, very often does not lead to release of the files.

– The growth of ransomware-as-a-service (RaaS), where criminals can buy or act as affiliates and rent subscription-based ransomwares (on the Dark Web) from which they earn a percentage of each ransom payment. For criminals, this method offers a low technical barrier to entry and a high affiliate earning potential.

– A growth in a more focused and thorough kind of ransomware attack where victims are researched, and their networks are compromised in advance.

Key Targets

Some of the main targets of ransomware attacks last year noted by the report include healthcare organisations, leading pharmaceutical companies, and COVID-19 vaccine research and development organisations. For example, last October, Philadelphia company eResearchTechnology (which makes software used to try and develop COVID-19 vaccines and treatments) was hit by a ransomware attack.  Employees were locked out of systems and the attack had a knock-on effect that was felt by IQVIA, the research organisation helping with AstraZeneca’s Covid vaccine trial, and Bristol Myers Squibb, a drug-maker involved in the development of a quick test for COVID-19.

Double Extortion

As if these types of targeted attacks haven’t been dangerous enough, the report highlights how so-called ‘double extortion’ attacks have been on the rise.  This is where, in addition to demanding a ransom to release data files, the criminal also threatens to leak some of the files/data unless the ransom is paid.

What Does This Mean For Your Business?

Ransomware attacks tend to arrive in phishing emails, so it is important that staff are aware of the dangers of clicking on suspicious links. Also, staff should be wary of Microsoft Office email attachments that advise the enabling of macros to view the content, a this can be a sign of a ransomware email.

This story also highlights the importance of making sure that data is regularly and securely backed up (to a cloud-based service) and that disaster recovery and business continuity plans have procedures for ransomware attacks built-in to them. Businesses should also note that paying the ransom is a high-risk option and certainly offers no guarantee that any files will be unlocked/returned.

Other precautions that businesses can take to guard against these kinds of attacks include keeping antivirus software and Operating Systems up to date and patched (and re-starting the computer at least once per week), using a modern and secure browser, using detection and recovery software e.g., Microsoft 365 protection and Windows Security, and storing files on cloud services e.g. OneDrive/Google Drive, IDrive, or whatever work-based cloud file storage systems employees are required to use.

Fake news has become pernicious and widespread so in this article, we look at how the search engines are facing up to the enormous challenge of separating the real from the fake.

Challenges

Those trying to combat the spread of fake news face a common set of challenges, such as those identified by CEO of OurNews, Richard Zack, which include:

– There are people (and state-sponsored actors) world-wide who are making it harder for people to know what to believe (e.g. through spreading fake news and misinformation, and distorting stories).

– Many people don’t trust the media or don’t trust fact-checkers.

– Simply presenting facts doesn’t change peoples’ minds.

Other challenges include:

-‘Confirmation bias’ in humans means that we like to read stories that confirm our existing beliefs. This means that there will always be belief in many fake news stories.

– Young people (large users of social media) may be more susceptible to seeing and believing fake news according to research (Stanford’s Graduate School of Education). Most 18-to-24 year-olds consume news via social media.  For example, half of teens (54 per cent) get news from social media, and 50 per cent get news from YouTube (CommonSense 2019) and research in 2020 found that over a quarter of 18-to 24 year-olds get their new from Instagram, 19 per cent from Snapchat, and 6 per cent from TikTok. With social media platforms also battling against a tide of fake news, this is a real challenge that extends beyond search engines.

– Fake news is attractive and often seems more interesting than truth.

– People find it difficult to spot fake news.

Search Engine Algorithms Promoting Fake News?

Another less obvious challenge that some search analysts have highlighted how search engine algorithms may promote sensational fake news above real stories and may also, therefore, be profiting from showing them.  The thinking behind it is that people are simply drawn to click on links to stories / information that look sensational or controversial. When the links are clicked-on, this tells the search engine algorithm that the link was relevant to the search query (i.e. the search engine algorithm awards it ‘link relevance’).  If this link is clicked on enough times by others and receives more link relevance, it will move up the search engine rankings and be given greater prominence, even though the page content may contain fake news. This positive feedback loop can, therefore, ensure that even a fake story can keep getting served, clicked upon, and ultimately become circulated and believed as truth.

Making Money

In addition to getting revenue from adverts, search engines also track user behaviour and sell the data through real-time bidding and ad-driven search engines are able to show better metrics if they reward clicks on enticing links. This mean that links to sensational fake news stories and videos can drive (and be good for) search engine revenue rather than for the user who ends up reading fake stories. In short, it can be in a search engine company’s interest to simply show users what they want to read or watch, some of which may be fake.

What Are Search Engines Doing About The Problem?

Taking Google as the main example, search engines are keen to tell users what they are doing to combat the problem of fake news.

How Google Fights Disinformation – 3 Principles

Back in 2019, when the impact of fake news had been felt both in US elections and in wider society in what had been dubbed a ‘post-truth era’, Google (in its ‘How Google Fights Disinformation’ White Paper) laid out three foundational principles for how it would be tackling the spread of fake news / misinformation in Google Search, Google News, YouTube, and the company’s advertising systems going forward. These are:

1. Make Quality Count.  Google says that its “ranking algorithms” treat websites and content creators fairly and evenly, but they also ensure the usefulness of Google’s services, as measured by user testing, and don’t foster the ideological viewpoints of the individuals that build or audit them.

2. Counteract Malicious Actors. For this, Google admits that “Algorithms cannot determine whether a piece of content on current events is true or false, nor can they assess the intent of its creator just by reading what’s on a page”.  However, Google policies across Google Search, Google News, YouTube, and its advertising products clearly show what is prohibited and company says that it has “invested significant resources” in combatting deliberate ‘spam’ practices designed to deceive and get greater visibility for content.

3. Give Users More Context.  This involves Google users being shown “Knowledge” or “Information” Panels in Google Search and YouTube, providing high-level facts about a person or issue, using labels to show that content has been fact-checked, as well as offering users the chance to see “Breaking News”, “Top News” shelves, and “Developing News” information panels.

Google also says that it has teamed up with outside news experts and dedicated “significant resources” to supporting quality journalism. For example, this includes launching the Google News Initiative (GNI) in 2018, participating in and providing financial support to the Trust Project (http://thetrustproject.org/), partnering with Poynter’s International Fact-Checking Network (IFCN), and supporting the work of researchers who explore the issues of disinformation and trust in journalism.

Bing

Back in 2019, a Stanford Cyber Policy Center report found that Bing’s SERPs contained dubious information more often than Google’s, and that “Bing returns disinformation and misinformation at a significantly higher rate than Google does”.

Nevertheless, Bing appears to have been tackling fake news / disinformation / misinformation in similar ways to Google.  For example, Bing introduced fact-checking labels as far back as 2017.

In April 2020, as part of an announcement about how it was promoting trusted information in response to COVID-19, Microsoft outlined many of the ways that it tackles misinformation generally.  For example, Microsoft highlighted how curated resources were being used across Bing, LinkedIn, Microsoft News and Microsoft Advertising, and how Bing could prioritise trusted news sources and could use algorithmic defences against certain types of misinformation.

COVID-19 Medical Misinformation Challenge

The COVID-19 pandemic brought the dangers of fake news into even sharper focus as medical misinformation became a very serious threat. To help counter this, Google announced (2020) that it was investing $6.5 million in funding global fact checkers to focus on coronavirus misinformation.  Google’s YouTube also introduces a policy to tackle any content that contradicts WHO advice.

Also, in response to health misinformation (COVID-19), Microsoft created COVID-19 information hubs in 53 markets globally, with an experienced team editing content from more than 4,500 of its “trusted” news brands.

Automation and AI

Many people now consider automation and AI to be an approach and a technology that is ‘intelligent’, fast, and scalable enough to start to tackle the vast amount of fake news that is being produced and circulated.  For example, Google and Microsoft have been using AI to automatically assess the truth of articles.  Also, initiatives like the Fake News Challenge (http://www.fakenewschallenge.org/) seeks to explore how AI technologies, particularly machine learning and natural language processing, can be employed to combat fake news and supports the idea that AI technologies hold promise for significantly automating parts of the procedure human fact-checkers use to determine if a story is real or a hoax.

However, the human-written rules underpinning AI, and how AI is ‘trained’ can also lead to bias. Whilst AI can do many amazing things, it is also not yet at the stage where it is able to exercise anything like human judgement as this is based on past experience and gathered knowledge.  This means that AI is not yet the single main way to tackle fake news at scale, although it is certainly helping.

Looking Ahead

Whether search engines benefit from fake news content or not, the problem of the spread of fake news goes way beyond search engines.  Social media companies are also involved in an ongoing battle to tackle the problem, as are other national and global new media outlets of all kinds. Much of the focus of the fake news problem has actually been on social media companies (e.g. Facebook), who have also introduced their own measures to tackle it (e.g. fact checking and introducing their own curated news).  The fact is that to tackle fake news involves wide co-operation, collaboration, and initiatives between multiple entities such as fact-checkers, civil society organisations, researchers, media and tech companies, government agencies and more to bring about a bigger societal change in the right direction.

If you would like to sell a phone, laptop, tablet, or other device, but would like to know how to completely wipe it first, here’s how:

Firstly, make sure you’ve backed up things like your photos, other important files, and WhatsApp chats. Next:

Windows Laptops

– Type “Reset” into the Start search box and select “Reset this PC”. If this option doesn’t show, look in “Settings” under the “Recovery” tab.

– To wipe all storage drives, on the next page, click “Change Settings” and change the Data Erasure slider to “On”.

MacBooks and Macs

– Reset the system and press the Command + R keys together to load the recovery menu.

– Select “Disk Utility” (the system drives will be displayed).

– Right-click and select Delete on each applicable drive apart from the MacOS install partition.

– Return to the Recovery menu or reset and use the Command+R shortcut from a fresh start-up, and select Install MacOS.

Google Chromebooks

– Press Ctrl, Alt, Shift, and “R” together from the login screen to bring up the “Powerwash” box, or, from “Settings”, select “Advanced” and scroll down to “Powerwash”.

iPhones and iPads

– Go to the “Settings” menu, then the General sub-menu.

– Use the Reset option, and the “Erase All Content and Settings” control. To do this, you will need to use your Apple ID password.
Android Phones and Tablets

– Go to the “System” part of “Settings” and find ‘Reset Options’.

– Choose “Erase All Data” (Factory Reset), or similar and follow the prompts. You will need your unlock PIN.

Apple Macs have long had a reputation for being more secure than PCs but where does this idea come from and is it really the case?

How Did It Start?

Apple itself supported the idea that Macs didn’t get computer viruses until (in 2012) it was noted that the claim was removed from its “Why You’ll Love a Mac” web page.

Mac Users

There are also successions of fan-like owners who, judging by their online comments and based on their own experiences, would support the idea that their machines have never had a virus. Historically, more ‘user-friendly’ and more aesthetically pleasing, Macs were also the domain of those in design professions and/or ‘non-techie’ people rather than those using banks of much lower priced PCs as daily office workhorses and business tools that required them to be online more often, getting more exposure to viruses and threats.

Although less technical users may find the macOS platform easier to navigate and to keep safe, this can lead to perception that few safety precautions need to be taken, thereby weakening safe user behaviour.

Fewer Macs

There are far fewer Macs in use than PCs.  For example, looking at the OS market, although macOS’s share grew from a tiny 2.26 per cent in 2003 to more respectable 10.18 per cent July 2019.  This could mean that:

– If Windows accounts for 90 per cent of the market, it makes sense for cyber criminals to target the majority, and that this could mean that there are fewer Mac-focused cyber threats.

– If there are fewer Macs, owners may simply be enjoying a degree of ‘security through minority’.

Operating System

Apple’s macOS is based on Unix.  This is generally accepted as being more difficult to exploit than Windows. That said, the level of security for Apple’s macOS may depend on which version it is.

Macs Under Attack

There is (what appears to be) a mistaken perception that Mac’s don’t get viruses. In fact, contrary to popular belief, now that Macs are becoming more popular, they have become more of a target for cyber criminals. Examples of Mac threats include the Flashfake botnet, the Koobface worm, and Mac Defender malware, Silver Sparrow malware, Pirri/GoSearch22 adware,ThiefQuest/EvilQuest ransomware and LoudMiner/Bird Miner crypto-mining software.

Larger Threat Growth For Macs

As highlighted in the Malwarebytes (annual) State of malware report (February 2020), the growth in attacks on Apple endpoints is outpacing the threats targeting Windows machines.  Kaspersky figures also show increasing dangers for Mac users. Early last year, Kaspersky reported that two years on from its detection, Shlayer Trojan malware attacks one in ten macOS users, and it accounts for almost 30 per cent of all detections for the macOS.

System Vulnerabilities?

In comparison to Windows users, Mac users seem to suffer less from threats that exploit system vulnerabilities without the need for downloads.

Speed of Security Fixes

In the past, there have been reports of Apple being slow with security fixes (e.g. its patch for 2012’s Flashback exploit taking almost 50 days to be ready for distribution) to macOS users and even then, only being made available for those running macOS Snow Leopard and macOS Lion. If there has been any lack of urgency in the release of security patches and updates for the macOS it may simply have been down to a historically lower threat presence compared to PCs.

Browser Security

In the light of the increasing rate in attacks on Macs, Apple’s Safari browser has been updated to block ads and (unwanted) pop ups. However, third-party browsers like Google Chrome and Firefox may be considered to be more secure, especially against the newest threats, because Safari appears to have a slower update cycle.

Threats To Both

It should be remembered that both Mac and PC users also share common threats which aren’t linked to which flavour of computer an OS they have.  These threats include phishing scams and other social engineering attacks, spam, human error of the Mac or PC user, and the threats of theft or loss of the Mac or PC.

Whether a Mac or PC user, clicking on a link or downloading an attachment in a suspicious email can mean an equal risk of falling victim to malware.

Taking Precautions

Mac and PC users should always take precautions to reduce the risk of viruses and attacks.  These include:

– Keeping anti-virus software up to date and making sure that all the latest patches and updates have been installed.

– Not clicking on suspicious links or downloads in emails.

– Making sure that (staff) users are aware, educated and trained in spotting and dealing with cyber threats, scams, social engineering attack behaviour (on and offline) and more.

What Does This Mean For Your Business?

Macs and PCs are both vulnerable to attacks and threats and the increasing popularity of Macs means that threats towards them are growing. Users of both Windows and Mac operating systems should always stay up to date with measures that ensure that their systems are protected and should make sure that staff are educated, trained, and motivated to spot and deal with threats in the right way.

Mac users may can check the advice on Apple’s website about features (found in System Preferences) that help protect Macs and the personal information of users from malicious software/malware, such as that embedded in harmless-looking apps.  See: https://support.apple.com/en-gb/guide/mac-help/mh40596/mac

Using the Investigatory Powers Act of 2016, it has been reported that a recent government test of tracking users’ web histories has been helped by two ISPs.

The Investigatory Powers Act

The Investigatory Powers Act 2016 (also known as the ‘Snooper’s Charter’) became law in the UK in November 2016. It was designed to extend the reach of state surveillance and requires web and phone companies (by law) to store everyone’s web browsing histories for 12 months and to give the police, security services, and official agencies access to that data when requested. The Charter also means that security services, government agencies and police can hack into computers and phones to collect communications data in bulk and that judges can sign off police requests to view journalists’ call and web records.

Back in December 2018, human rights group Liberty won the right to a judicial review into the Investigatory Powers Act 2016. It was decided that there must be suspicion of a serious crime (one with a 12 month or more sentence) for the government agencies and police to request browsing history records.

ICRs

The records of ‘metadata’ that ISPs/telecoms companies are required to collect and store about users are called Internet Connection Records (ICRs). These show which websites a person has visited, the relevant IP addresses, and how much data they download, but do not show which pages within a website that a person visited.

Latest Trial

The latest trial of the new powers under the Act is reported to have involved the Home Office, the National Crime Agency, and two unnamed ISPs.  The ISPs involved cannot identify themselves because the law prevents them from disclosing the existence of a data retention notice to anyone else. Reports indicate that the trial is small in scale and is still in its early stages.

Issues

The trial has brought criticism that has highlighted the many issues around collecting data about everyone’s web activities.  For example:

– Privacy. The blanket mass collection of Internet histories in the hope that something will be found in it seems like an unnecessary level and type of surveillance that impacts on privacy.

– Compromising the role and values of ISPs. Commercial companies such as ISPs that need to protect customers are being made to act as an extension of government agencies, thereby being forced to compromise their role in a way that may erode customer trust.

– Security. Storing browsing histories for a year has raised concerns about how securely they are stored and what extra level of risk this poses to customers.

– Transparency. The law does not allow the disclosure of which ISPs are involved in the test, plus it is not clear how often this could happen, or whether it is necessary or proportionate.

– Oversight. There have been questions about who/what is overseeing the process.  This has led to the Investigatory Powers Commission announcing plans to appoint 13 judicial commissioners for independent oversight of any surveillance.

What Does This Mean For Your Business?

The popular justification for the introduction of the Investigatory Powers Act (Snooper’s Charter) was to improve UK’s ability to spot and foil potential terror plots, and a qualification for agencies requesting a user’s browsing records/history should be suspicion of a serious crime.  With a lack of transparency and questions about oversight, this has increased mistrust about what could be happening under this law and how the vast majority of law-abiding people are still essentially under surveillance while ISPs  (with whom customers may think they have a normal business arrangement) are obliged by law to secretly pass customer data to government and law enforcement agencies. While national defence matters are important, for some, the Investigatory Powers Act feels a bit too much like ‘Big Brother’. Some people argue that if a person has nothing to hide, they have nothing to worry about while others argue that this attitude simply gives the green light to the erosion of hard-fought rights that could have consequences for everyone further down the line.

After Liz Truss’s (the UK’s Minister for Women and Equalities) suggestion that flexible working should be standard appeared at odds with the Prime Minister’s views, will remote working be the new norm … or not?

February – The Prime Minister

In February, Prime Minister Boris Johnson said (while on a rail industry conference video call) that he believed that workers would return (all being well) to their physical workplaces in “a few short months” and that he did not believe that the future new normal would be characterised by people not moving around and commuting and simply doing things remotely.

Views Shared By Goldman Sachs Boss

The CEO of investment bank Goldman Sachs, David Solomon, who moonlights as DJ D-Sol, appeared to agree with Prime Minister Johnson’s view, saying of home working (at a Credit Suisse conference) “And it’s not a new normal. It’s an aberration that we’re going to correct as soon as possible”.  Mr Solomon justified this view by saying that remote working isn’t compatible with the innovative and collaborative apprenticeship culture at the bank and remote working would mean that new employees would miss out on things like “direct contact, direct apprenticeship, direct mentorship”.  JP Morgan is also understood to support the idea that remote working could mean a lack of mentoring for young staff and that remote working can lead to a drop in productivity on Mondays and Fridays.

Liz Truss

Liz Truss’s recent comments, just ahead of International Women’s Day, that employers should make flexible working (including remote working and job sharing) a standard option to help level the digital divide appear to be at odds with those of the Prime Minister. The Minister argues that the pandemic has led to “changed mindsets” and that allowing flexible working as the norm rather than by special request could help open up employment opportunities to workers, regardless of their sex or location.

Research Supports Remote/Flexible Working

Research from Cardiff and Southampton Universities shows that 90 per cent of UK people who worked remotely during the pandemic would like to continue to stay away from the office.  Also, research by the Behavioural Insights Team (BIT) and the jobs website ‘Indeed’ shows that job ads that explicitly offer flexible working would increase applications by up to 30 per cent.

Hybrid Model

It is likely, however, that many businesses may opt for a ‘hybrid’ model of working in the near future.  For example, according to research (Feb 2021) by global human resource consulting firm Robert Half, 89 per cent of UK businesses expect hybrid working trends to become permanent.

What Does This Mean For Your Business?

For many service-based businesses, switching to remote working during the pandemic led to several discoveries (such as the idea that they can continue to offer a good service), many employees like remote/flexible working (due to its compatibility with the real work/life balances and challenges), and some businesses have discovered that it allows them to reduce costly office space.  For example, HSBC is cutting its office space by 40 per cent and Lloyds is cutting its office space by one fifth. In many sectors (e.g. the hard-hit hospitality sector) flexible and remote working is not an option and for some businesses (e.g. Goldman Sachs) there are clearly concerns about how physical separation could affect the development and training of staff. Looking ahead to the near future and with predictions that COVID-19 is essentially here to stay, many businesses look set to go for a hybrid solution to working where possible.