Chapter 2 Cyber Threats in Focus: Common Cyber Threats in Singapore RANSOMWARE COMMON CYBER THREATS IN SINGAPORE NCSC analyses internal and other data sources, which include open source data, to provide actionable insights on four common threats and attacks in Singapore’s cyberspace7. The four cyber threats in focus are ransomware, website defacement, phishing websites/URLs, C&C servers and DDoS. By understanding the means and motivation behind these attacks on Singaporeans and Singapore, one can try to take measures to prevent, detect and/or mitigate such threats. Definition: A type of malware that encrypts files on a victim’s device, rendering them unusable until a ransom is paid, usually in the form of Bitcoin. It is spread through e-mail or malicious advertisements that appear when users access unsafe websites. Motivation: Financial gains and/or business disruptions. Target(s): Usually opportunistic, involving any individuals and companies of all sizes. In 2016, there were 19 ransomware cases reported to SingCERT, up from the two cases reported in 2015. Cerber, CryptoLocker and Locky were among the types of ransomware reported. The actual number of victims may be more as ransomware cases tend to go unreported. According to Trend Micro, an international cybersecurity company, it detected about 550 ransomware-related threats in Singapore each day8. Singapore is especially vulnerable due to its high Internet penetration rate.9 Individuals and SMEs accounted for most of the ransomware cases reported to CSA. Companies may be reluctant to admit being affected, as this may affect the reputation of their business. Globally, hospitals and universities were also hit by ransomware attacks in 2016. Payments are usually made using Bitcoin, a type of online currency preferred by cyber criminals given it is harder to trace it back to them. Unfortunately, there is no guarantee that the hacker will decrypt the files as promised once they receive the payment. “NO ONE IS SPARED FROM RANSOMWARE” Shukla, A. (2016, July 13). Singapore receives 550 cyber threats each day. Retrieved from http://www.computerworld.com.sg/resource/security/singapore-receives-550-cyber-threats-each-day/ 8 Singapore ranks 4th in Asia in terms of Internet penetration rate (81.3 per cent), after South Korea (92.1 per cent), Japan (91.0 per cent), and Taiwan (83.8 per cent) respectively. Source: www.internetworldstats.com/stats3.htm 9 “Singapore cyberspace” can refer to websites ending with the .SG domain or mention Singapore in its URL, IP addresses used in Singapore or Internet Service Providers (ISP) that are located in Singapore. 7 30 Singapore has joined the “No More Ransom” initiative by Europol’s European Cybercrime Centre (EC3) to fight cybercrime in both the public and private sectors. The initiative aims to assist victims of ransomware to decrypt their encrypted data by offering the decryption tools made available free of charge on the portal and to teach users how to protect themselves. The portal is now available in 14 languages and contains 40 free decryption tools. More about EC3’s initiative can be found here: www.nomoreransom.org. Following a noticeable rise in ransomware infections in Singapore and overseas, SingCERT released an advisory on ransomware in May 2016. Preventive measures against ransomware include: • Follow Internet-browsing best practices, such as not clicking on suspect links as that may download ransomware; • Updating software with the recommended patches to reduce the likelihood of known vulnerabilities being exploited; • Performing regular backups to recover files that have been encrypted; • Using available decryption tools to restore files that the attacker has “locked up”. 31