Conventionally, ransomware involves an action from the user which triggers the download of the malware. For example, clicking unknown links, downloading email files received from an unknown senders and the use of public networks.
An emerging form of ransomware takes advantage of files uploaded over a browser. Ransomware over the browser begins operating once an upload of a file takes place using the File System Access API.
Cybercriminals entrench ransomware into the API. When a file is uploads over the browser, the ransomware activates encryption of all the files residing in the open folder and its subfolders. When the malware deployment completes, none of the files remain accessible, as a consequence the adversary demands a ransom.
Antivirus software cannot detect ransomware over the browser due to the program looking for an embedded malicious payload. However, ransomware over the browser runs directly in the browser therefore remains difficult to prevent and detect as the traditional methods do not apply.
The following tips help reduce the impact of browser based ransomware:
- If a system is infected by ransomware over the browser, isolate the machine by disconnecting from the network.
- Install all browser updates and security patches as soon as possible. This reduces the possibility of adversaries exploiting existing vulnerabilities.
- Maintain regular backups of files with removable media in another location offsite or use cloud based alternatives.
- Verify the use of browser based tools limiting downloads to reliable sources only. By ensuring the use of trusted sites for downloading tools such as video players and photo editors, the risk of ransomware over the browser reduces.
As the threats from ransomware over the browser progress, the complexity of the attacks will increase making them more efficient. By incorporating policies and keeping up to date with the latest trends minimises the risks of the emerging threats.
19
