{"id":21399,"date":"2020-07-19T05:54:50","date_gmt":"2020-07-19T05:54:50","guid":{"rendered":"https:\/\/www.lifeandnews.com\/articles\/?p=21399"},"modified":"2020-07-24T13:56:25","modified_gmt":"2020-07-24T13:56:25","slug":"ransomware-criminals-are-targeting-us-universities","status":"publish","type":"post","link":"https:\/\/www.lifeandnews.com\/articles\/ransomware-criminals-are-targeting-us-universities\/","title":{"rendered":"Ransomware criminals are targeting US universities"},"content":{"rendered":"

Nir Kshetri<\/a>, University of North Carolina \u2013 Greensboro<\/a><\/em><\/p>\n

As COVID-19 cases in the U.S. continue to climb<\/a>, government and higher education leaders have been focused on doing what it takes to protect campus communities from the global pandemic.<\/p>\n

But college and university leaders would be wise if they were just as vigilant about protecting their sensitive data from the cybercriminals who are becoming increasingly sophisticated about encrypting the colleges\u2019 data and making the colleges pay a ransom to get it back.<\/p>\n

One of the latest examples is a ransomware attack<\/a> that struck the University of California, San Francisco on June 1. In that case, cybercriminals used the NetWalker malware to encrypt data on the servers of the university\u2019s school of medicine. This malware targets corporate networks and encrypts the data it finds on the attacked devices<\/a>. This means that the device owner cannot access data on the device until a ransom in cryptocurrency demanded by the criminal is paid<\/a>. The criminal gang behind NetWalker has victimized dozens of organizations<\/a>.<\/p>\n

UCSF said that the attackers breached important data related to its medical school faculty\u2019s research<\/a>. It says its COVID-19 research was not affected<\/a>.<\/p>\n

Such ransomware attacks on universities have become common<\/a>. In 2019 alone, 89 U.S. universities, colleges and school districts<\/a> became victims of such attacks, followed by at least 30<\/a> in the first five months of 2020.<\/p>\n

Along with the financial services industry, the education sector<\/a> is one of the two most common targets of these attacks.<\/p>\n

Attempts to extort<\/h2>\n

I research<\/a> cybercrime<\/a> and cybersecurity<\/a>. I\u2019ve learned that obtaining ransom payments from their victims is the biggest challenge<\/a> most cybercriminals face, and that universities perform poorly on cybersecurity. Their vulnerabilities are becoming easier to exploit thanks to cryptocurrencies, such as bitcoin, which make it easier for cybercriminals to extract payments<\/a> from their victims.<\/p>\n

In the case of UCSF, university officials transferred 116.4 bitcoins \u2013 the equivalent of US$1.14 million \u2013 <\/a> to the cryptocurrency wallet of the NetWalker gang and received the key to decrypt its own files<\/a> in return.<\/p>\n

NetWalker is sophisticated malware. To distribute ransomware, NetWalker creators rely on phishing and spam as well as other large-scale network infiltration<\/a> such as hacking unsecured wireless devices connected to Wi-Fi networks.<\/p>\n

After penetrating a network, it can render antivirus software useless<\/a>.<\/p>\n

[You\u2019re smart and curious about the world. So are The Conversation\u2019s authors and editors.<\/em> You can get our highlights each weekend<\/a>.]<\/p>\n

The criminal group behind NetWalker mainly pursues high-value targets<\/a>, such as the Champaign-Urbana Public Health District in Illinois<\/a> and Michigan State University<\/a>.<\/p>\n

The creators of NetWalker are believed to collaborate with about 10 to 15 affiliates<\/a> to distribute the malware. The affiliates, who are often less skillful criminal hackers than the creators of NetWalker<\/a>, infiltrate a victim\u2019s network and infect it with the ransomware. They later split any ransom money obtained with NetWalker\u2019s creators.<\/p>\n

Why higher ed is a target<\/h2>\n
\"\"
US colleges have weak cybersecurity systems.<\/span>
\nWestend6\/GettyImages<\/a><\/span><\/figcaption><\/figure>\n

In my view, colleges and universities have become attractive targets for cybercriminals because of their weak cybersecurity measures. Research shows that the education sector<\/a> is the least-prepared to fend off cyberattacks<\/a>. In a vulnerability test of U.K. universities, hackers obtained sensitive and valuable data in all cases within two hours<\/a>.<\/p>\n

University networks contain highly sensitive information related to research, patents and other types of intellectual property data. These are targets cybercriminals desire.<\/p>\n

Most students use the universities\u2019 wireless networks to access information. Email addresses and other information about faculty, staff and students are easily available. Cybercriminals can use such information to send phishing emails.<\/p>\n

It doesn\u2019t help that some universities rely on outdated and insecure software<\/a>. Or that departments and individual professors<\/a> store some of the most sensitive data without help from cybersecurity specialists within their universities.<\/p>\n

To pay or not to pay<\/h2>\n

Generally law enforcement agencies<\/a> and cysersecurity professionals<\/a> oppose paying ransom. The FBI has suggested that victims report to law enforcement, whether or not they are willing to make those payments<\/a>.<\/p>\n

Extortionists promise to provide the victims with encryption keys for unlocking encrypted data if ransom is paid. NetWalker and some other ransomware criminals threaten to publish victims\u2019 data<\/a> on information leak websites<\/a> otherwise.<\/p>\n

Many victims distrust the extortionists and doubt their promises to unlock data after ransom payments<\/a>. This fear is well-founded. In 2016, only a quarter of organizations<\/a> that paid ransoms recovered their data.<\/p>\n

Desperate victims may decide to pay, hoping that the criminals behind the attacks fulfill their promise to decrypt data. Cornell University reportedly bought bitcoins<\/a> to pay to extortionists in case of a future ransomware attack. If companies rely on data, paying ransom could be less costly than the alternative.<\/p>\n

Recently, ransomware criminals are becoming more selective<\/a>, going after only victims for whom data is extremely important.<\/p>\n

Some recent victims of NetWalker also reported that they successfully recovered most of their data after paying the ransom. In March, NetWalker had hijacked the computer networks of the Champaign-Urbana Public Health District<\/a> in Illinois, which serves 210,000 people including the University of Illinois. After paying a $350,000 ransom<\/a>, the Champaign-Urbana Public Health District retrieved 99% of its files<\/a>.<\/p>\n

A growing number of organizations now buy cyber insurance to protect against future losses<\/a> from these attacks. An insurer, for example, paid all but $10,000 of the Champaign-Urbana Public Health District\u2019s ransom<\/a>.<\/p>\n

Tracking ransomware perpetrators<\/h2>\n
\"\"
Most ransomware hackers operate outside of U.S. jurisdiction.<\/span>
\nseksan Mongkhonkhamsao\/GettyImages<\/a><\/span><\/figcaption><\/figure>\n

Most ransomware criminals, however, operate from jurisdictions that don\u2019t cooperate with the U.S. or European authorities fighting cybercrimes. For instance, the criminals behind NetWalker are believed to operate from Russia or other Commonwealth of Independent States<\/a>.<\/p>\n

To shore up their digital security, universities should mandate strong passwords and encourage all faculty, students and staff to report fake emails and other incidents. It would also help if they could constantly back up important data and purchase cyber insurance.\"The<\/p>\n

Nir Kshetri<\/a>, Professor of Management, University of North Carolina \u2013 Greensboro<\/a><\/em><\/p>\n

This article is republished from The Conversation<\/a> under a Creative Commons license. Read the original article<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Nir Kshetri, University of North Carolina \u2013 Greensboro As COVID-19 cases in the U.S. continue to climb, government and higher education leaders have been focused on doing what it takes to protect campus communities from the global pandemic. But college and university leaders would be wise if they were just as vigilant about protecting their […]<\/p>\n","protected":false},"author":44,"featured_media":21400,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[292],"tags":[8373,7689,614,612,6419,6975,1812],"_links":{"self":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/21399"}],"collection":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/comments?post=21399"}],"version-history":[{"count":2,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/21399\/revisions"}],"predecessor-version":[{"id":21470,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/21399\/revisions\/21470"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/media\/21400"}],"wp:attachment":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/media?parent=21399"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/categories?post=21399"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/tags?post=21399"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}