Trojan horse could recruit 'Fagin's gang'

Security company Websense last week highlighted an attack where a Web site is configured to exploit a known flaw in Microsoft's Internet Explorer to download an application that encrypts files on the victim's PC. The program then drops a ransom note on the system that offers to decrypt the files if the user pays up.

According to an advisory published by research group Gartner, this type of attack could evolve to a state where criminal groups and blackmail their victims into performing 'dirty work' in order to decrypt their files.

"If hackers can encrypt and hold data for US$200 ransom, they could also hold it captive for much more... Nervous users in the future might be moved to pay blackmailers based on the simple threat of having their files locked," the Gartner advisory said.

According to the advisory, criminal groups will find receiving a cash ransom difficult because it would leave a money trail, so they are likely to try and use their victims to help other areas of their business.

"Thieves will find it difficult to extract direct monetary payments for this type of attack, since such payments could be tracked. However, the threat of hostage data could also be used for other forms of extortion, with users compelled to perform 'dirty work' to recover their files. Thieves could unlock the files gradually, drawing the users deeper into their schemes," the advisory said.

Neil Campbell, national security manager of IT services company Dimension Data, said that victims' could be persuaded into, for example, becoming a mule for diverting funds from phishing attacks.

"If a criminal group wants someone to access an account they have compromised and then wire that money to the group operating the scam then what better way than to not have to pay for it?" said Campbell.

James Turner, security analyst at Frost & Sullivan Australia, said that although criminals could use this to try and recruit a 'Fagin's gang', criminals are likely to look for less risky methods.

"As soon as the criminals start engaging directly with a user base they are losing the efficiencies of the Internet that they have exploited so well until now,' said Turner who said the simplest defence is to back up important files. "Users can easily defend against this by taking regular backups or their important files and by not visiting dodgy Web sites".

However, Dimension Data's Campbell pointed out that home users are the least likely to back up their data.

"The home user is far less likely to be backing up and they tend to forget that hard disks can crash. If it is data they really want then they can either stand tough and say I will kiss my data goodbye because I don't want to be involved in committing an offence, which is what I think they should do - it is their penance for not backing up," said Campbell.