New Research Promises to Halt Ransomware in its Tracks

Researchers say they've found a way of severely limiting the damage ransomware causes. Meanwhile California legislators are mulling over new laws specifically aimed at the tactic.

Ransomware involves attackers remotely installing malicious software that encrypts files and makes them inaccessible without an unlock key. In many cases, this means victims can't access the data and may be unable to use the computer at all. The attackers then demand a fee to provide the unlock key.

The tactic has led to controversy over whether victims should pay the fee, something critics say merely encourages the attacks. However, both police forces and medical centers have chosen to pay the fee, saying it was the least worst option for being able to continue with their work.

Ransomware Could Be Stopped In Tracks

A team at the University of Florida have been working on a creative way to tackle ransomware. They've decided not to adopt common approaches of trying to prevent ransomware from being installed in the first place, or trying to decrypt the files after an attack.

Instead they've designed software called CryptoDrop. The idea is to monitor a computer and look for files being unexpectedly encrypted. This triggers the software to effectively freeze the computer, stopping the encryption process. (Source: bbc.co.uk)

The theory is that if the software works quickly enough, only a handful of files will be affected. That will likely mean the victim can live with just a few files being encrypted, and thus won't have to weigh up whether to pay the ransom.

Current Laws May Be Inadequate

Meanwhile, a bill in the California state legislature would specifically target ransomware. The bill's sponsors say existing federal law doesn't always apply neatly to ransomware attacks. That's because prosecutors must either rely on extortion laws, which are difficult to enforce, or use laws designed to deal with threats to persons and property. The problem is that these laws are generally worded to deal with the threat of damage, whereas technically with ransomware the damage is caused before the attackers make their demands.

If passed, the law would allow a maximum penalty of four years in prison and a fine of up to $10,000. It appears the bill has broad political support, though it's uncertain if it will complete the legislative process by the end of current session. (Source: latimes.com)

What's Your Opinion?

Does the CryptoDrop approach sound a sensible tactic? Can you foresee any problems? Should the California proposals to specifically criminalize ransomware attacks be adopted into federal law?