Cybercrime is a professionally organized business model with specialized departments for every step of the attack: gaining access, malware, fake websites. Ransomware groups encrypt systems and demand a ransom. Effective protection requires actively adopting the attack perspective, disconnecting systems, immediately installing updates and consistently using two-factor authentication.
Key Takeaways
- Ransomware groups work like professional start-ups: specialists buy and sell system access, others develop Trojans or build deceptively real phishing websites.
- Those who pay after a ransomware attack are often attacked a second time because word gets around among criminals as to which victims are willing to pay.
- Backups only provide protection if they are disconnected from the main network: At Maersk, all backups were linked and encrypted together with the overall system.
- Two-factor authentication and the consistent installation of software updates already close many of the most common attack vectors without requiring a great deal of technical effort.
- Anyone who develops or operates software must actively adopt the attacker’s perspective, because their own defender’s point of view systematically ignores the gaps that criminals are specifically looking for.
Cybercrime runs like a successful start-up
Successful ransomware gangs work professionally based on a division of labor. Leaked internal chats and logs of such groups show that they have their own specialists for every step of the attack.
The tasks are clearly distributed. Some buy and sell accessibility to other people’s systems. Others develop Trojans and viruses. Still others build fake websites that look as convincing as the real ones.
Eva Wolfangel has seen such fake banking websites that were visually indistinguishable from the originals. They can only be recognized by the URL. Most people do not check this and enter their access data.
Anyone defending themselves must take this professionalism seriously. On the other side is not a hobbyist, but someone with a well-paid full-time job. Security requires the same effort as the attacker.
Why hackers find every gap
Hackers find gaps because their mindset is geared towards using a system differently than it was intended. This perspective is decisive, not just technical knowledge.
A convicted cybercriminal who served ten years in prison described exactly this mindset: Where are the loopholes, where can I use a system in such a way that I do things that are not actually intended. For him, this is a bureaucratic, well-paid job.
The security officer on the other side needs the same mindset. The difference is not in the method, but in the intention.
The same gap can be seen in software testing. Testers often check what is written in the requirements: whether the system works as intended. Attackers take the opposite view and test everything that was not intended.
The “evil bit”: criminal mindset as a skill
The term “the evil bit” is circulating in security circles. This refers to the ability to put oneself in the perspective of a criminal: not to protect the system, but to deliberately think against it.
Whether everyone can learn this is debatable. One security researcher put it this way: you either have the evil bit or you don’t. Some acquire the mindset, some say they simply can’t do it.
In practice, this has clear consequences. Either you develop this perspective yourself, or you get someone who does. Relying on the fact that your own software is only used as it is intended is not enough. Others will find the gap and use it differently.
That’s the only thing that’s missing: not saying this is how my software is meant to be used and not that way, but being prepared for others to find the gap and use it in a way it wasn’t meant to be used.
Eva Wolfangel
One in five universities had open gaps
A random sample of German universities showed how many gaps there are in the network. The plan was to roughly check around 400 universities and colleges from the outside. After 73, the investigation had to be aborted because so many gaps had already been found.
This corresponds to one in five of the largest universities. Large universities in particular tend to have more resources for security. The rate would probably have been lower for smaller institutions.
No exotic vulnerabilities were found, but highly sensitive data, some of it openly on the Internet:
- Certificates, including a psychiatric certificate to postpone an exam
- Reports to the police
- Countless notes with name, matriculation number and often address
At some large universities, security vulnerabilities made it possible to penetrate the systems. A ransomware gang could have encrypted at this point.
Reporting vulnerabilities is more difficult than it should be
The biggest practical obstacle was not finding the gaps, but reporting them. Anyone who discovers a vulnerability often fails to reach the right contact person.
On many websites, it was almost impossible to find out which address is responsible for IT security incidents. Some universities did not get back to us for a long time. In one case, the responsible email address was unoccupied because the data protection officer was on vacation and no one was keeping an eye on the mailbox.
This is relevant because ethical hackers make such reports on a voluntary basis. If you make it easier for them to report a breach, you increase the chance that it will be reported at all. Having a clear, visible and staffed point of contact for security incidents is the first thing an organization can do right.
How a single attacker paralyzed Maersk
The NotPetya attack shows how quickly a company can go completely offline. The Russian secret service wanted to hit Ukraine and distributed the malware via the update of tax software used for business in Ukraine.
The consequences went far beyond the target. Maersk, one of the world’s largest logistics service providers, was also encrypted worldwide within minutes. Among other things, a Windows vulnerability was exploited for which a patch had long been available. Not everyone had installed it.
The clean-up work revealed a second problem. Employees were sent home, could not be reached for days and were sometimes only called together via private WhatsApp contacts. Everyone was given a new laptop and the old ones were thrown away.
Initially, there were no more usable backups. All systems were connected, so the backups were also encrypted. There were hundreds of copies of the central domain controller, which had updated each other and were therefore also all encrypted.
The fact that Maersk still exists today is due to a coincidence. A site in Ghana had an internet outage on the day of the attack and therefore had an unencrypted copy. Without this outage, the billion-dollar company might have been gone.
Architecture determines whether an attacker takes everything with them
The lesson from NotPetya is a question of system architecture. If everything is connected, an attack can encrypt everything within minutes, including backups.
Maersk has learned from this. The current Chief Information Security Officer reports that he no longer has a problem getting budget for more security. The company now knows how things can go wrong.
For you, this means separating systems so that an attack does not spread unchecked. This knowledge is available. But it is far from being implemented everywhere.
Why you should not pay
The recommendation from the authorities is clear: don’t pay the ransom. Whoever pays finances the business model and thus the next attack on the next company.
Technically, the blackmail works because the data is usually actually decrypted after payment. If word got around that you wouldn’t get anything back despite paying, nobody would pay any more.
However, paying does not solve the problem. Authorities report that paying companies are often attacked again because word gets around that they are willing to pay and are quick to convince. They also underestimate how much work, energy and time it takes to rebuild a system after decryption.
Security is a cost factor that becomes more expensive without damage
Security is often ignored in software development. At some point, a pen test is commissioned, the protocol delivers a result and the point is considered closed. Examining the topic in depth rarely happens.
The reason is usually that it is perceived as a cost factor. Security is expensive, that’s true. Anyone who calculates what happens if you leave it out comes to a clear conclusion: the damage is definitely more expensive.
The difficulty lies in getting this thinking across to the people who decide on the money. The calculation is obvious, but it rarely reaches the places where budgets are allocated.
Physical pen testing: through the front door into the building
Security does not end with the system. In physical pen testing, people try to get into buildings that they are not allowed to enter. Most of the time they succeed.
The methods are banal and effective. Greet the gatekeeper in a friendly manner and walk past. Make up a role, disguise yourself, take a back entrance, stand at the smokers’ entrance. There are many ways into a company.
This has consequences for the organization. Porters must not be left alone with the task of stopping friendly and nice people. Nobody wants to do that, and that is exactly what attackers exploit. Physical systems are needed that do not place this burden on individuals.
What you can do specifically as a user
A few consistently implemented measures close the majority of potential gateways. They are not costly, but a question of discipline.
- activate two-factor authentication wherever possible. The extra click is annoying, but prevents many attackers.
- **Install updates quickly **Attackers keep a close eye on where new gaps appear and work on exploiting them.
- Only keep used apps and check the origin of each app.
- **Do not enter any real data where it is not necessary ** Why does an online store need your date of birth? If in doubt, use a different name or date.
There is no such thing as complete protection. Sooner or later, data will be pulled from a poorly secured system, and administrations are regularly hacked. Nevertheless, a sensible middle way reduces the risk significantly.
For teams building software, the same logic applies on a larger scale. Do it properly. Get the attacker’s perspective on board instead of just checking from the defender’s point of view. Either acquire it yourself, or find someone with the evil bit to help you.
Frequently Asked Questions
How professionally are ransomware groups organized?
They operate with a division of labor similar to that of startups. Leaked internal chats and logs from such groups reveal that they have dedicated specialists for each stage of an attack: Some buy and sell access to third-party systems, others develop Trojans and viruses, and still others build phishing sites that are visually indistinguishable from the originals and can only be identified by their URL. On the other side of the screen is not a hobbyist, but someone with a well-paid full-time job.
Can anyone learn to think like an attacker?
That’s a matter of debate. In security circles, the term “the evil bit” is used to describe this ability: One security researcher put it this way—you either have it or you don’t. Some adopt this mindset, while others say they simply can’t. For teams, this presents a choice: develop the attacker’s perspective themselves or bring in someone who already has it.
How secure are the IT systems at German universities?
A sample survey of 2,023 institutions had to be halted after 73 were tested because so many vulnerabilities had already been found. The plan had been to conduct a rough external audit of around 400 universities. Certificates—including a psychiatric one—police reports, and grades containing names, student ID numbers, and often addresses were publicly available online. At some large universities, the path led all the way into the inner workings of the system.
Why do discovered security vulnerabilities often go unreported?
Because reporting them is harder than finding them. On many websites, it was nearly impossible to determine which contact was responsible for IT security incidents. Some institutions took a long time to respond; in one case, the report ended up in an unattended mailbox because the data protection officer was on vacation. Ethical hackers report vulnerabilities on a volunteer basis. A visible and staffed point of contact increases the likelihood that a vulnerability will be reported at all.
Do backups reliably protect against ransomware?
Only if they’re separated from the main network. At Maersk, all systems were connected after the NotPetya attack, so the backups were also encrypted. There were hundreds of copies of the central domain controller, which had updated each other and were therefore also unusable. The company was saved by a stroke of luck: A location in Ghana had experienced an internet outage on the day of the attack and possessed an unencrypted copy.
Are companies attacked again after paying a ransom?
Often, yes. Authorities have reported that companies that pay are frequently targeted a second time because word spreads among criminals about which companies are willing to pay and can be persuaded quickly. The data is usually decrypted after payment; otherwise, the extortion wouldn’t work. The effort required to rebuild a system afterward is often underestimated. Every payment funds the next attack.
How easily can attackers physically gain access to a company building?
Most of the time, they succeed. When it comes to physical penetration testing, simple methods suffice: greeting the security guard politely and walking right past, making up a story, disguising yourself, or using the back entrance or the smoking area entrance. The solution lies in organizational measures. Security guards should not be left alone with the task of stopping friendly-seeming people. Physical systems are needed that do not place this burden on individual people.
Which protective measures are most effective for private individuals?
Enable two-factor authentication wherever possible and install updates promptly, because attackers closely track where new vulnerabilities emerge. This includes: keeping only the apps you use and verifying their sources, as well as not providing real data where it isn’t necessary. Why does an online store need a date of birth? There’s no such thing as complete protection, but this balanced approach significantly reduces the risk.
