Register For Our Mailing List

Register to receive our free weekly newsletter including editorials.

Home / 119

How I lost my files to ransomware

This is a cautionary tale, at the risk of embarrassing myself. I did not even know what ‘ransomware’ was until it infected my computer. This article is not a definitive piece on how to protect yourself from a virus. The main message is don’t do as I did.

Ransomware is a type of malware that prevents access to computer files until the victim pays a ransom to regain access or retrieve the data.

How was I tricked?

Let’s start at the beginning to at least give me some excuses. I had been exchanging emails and phone calls with Telstra, as part of a significant upgrade to faster broadband speed, higher data allowance and upgraded mobile phone plan. In my defence, my head was in a ‘Telstra numbers' mode, full of megabytes and download speeds.

Then a few days after my upgrade, I received an email, supposedly from Telstra Customer Care, telling me I was over 50% of my monthly data allocation, with a link to my usage level. How could that be? I had only just changed to the new package. Immediately preparing myself to call Telstra and tell them to get their act together, that they had me on the wrong plan, I clicked on the link to check the numbers. Bad mistake, a strike at my soft underbelly.

The email was not from Telstra. This message jumped up on my screen.

It was a ransomware virus called CryptoLocker. Google it if you want to know more. It works by encrypting all the files on your computer, and to unlock or decrypt them, you pay a 'ransom' to receive a decryption key. I immediately removed the virus but it was too late. All my files – Word, Excel, PowerPoint presentations, photographs, videos – were encrypted and could not be opened. The ransom requested was GBP700, payable in Bitcoins. They said if I tried to remove the virus, it would not decrypt the files and the cost of the key would increase to GBP1,400.

Searching online for a solution, some people suggested there is a publicly available key to decrypt the files, but this is a public key used by other malware scams. My understanding is CryptoLocker uses two keys: one to encrypt and another to decrypt the data. The decryption key is a private key, which is not available other than by paying the ransom.

What about my backup?

I immediately contacted my technical support, who said this was a particularly nasty virus, and industry advice is not to pay the ransom as most people do not receive the decryption code after payment. An online search confirmed this, while others said they did not want to encourage criminals by paying the ransom. It was better to rebuild from backups.

Where were my backups? This is the embarrassing bit.

First, we tried ‘System Restore’, which if enabled on the computer, should hold shadow copies of files. But when we clicked on ‘Previous Versions’, nothing was there.

Second, what about back-ups to external hard drives? I had been told some months earlier that there are only two types of external hard drives: those that have stopped working, and those that are about to stop working. A company called Backblaze, which runs 25,000 external hard drives continuously in its backup business, reports a 5% fail in the first 18 months, and 22% in four years. No doubt this is unfair, but I used it as an excuse not to back up to external hard drives more regularly.

Third, my computer had been set up to copy files regularly to Dropbox. When I went into my Dropbox account, the files there were also encrypted. So I wrote to Dropbox asking if they had saved previous versions. There ensued an exchange of emails with Dropbox, such as:

I'd be happy to help you roll back your entire account to a certain point in time. Could you go to https://www.dropbox.com/events and send me the link indicating the first event you would like to undo? Your account will be reverted to before this event took place.”

But over many exchanges of email, we could not open my old files. I don’t blame Dropbox for this, we just ran out of time and patience.

So where did I eventually find some of the lost files? I had older files on an external hard drive from my last (too long ago) back up. Otherwise, I retrieved wanted files that had been attached to emails: photographs, documents, spreadsheets. I recovered a decent amount stored by Google on Gmail (and it would be the same with any reputable email service) and all Cuffelinks files are ‘in the cloud’.

But I did lose a lot of personal material. I had copied photographs to my computer from my iPhone to free space on the phone. Other personal records, documents and spreadsheets, were lost.

What are the lessons?

All it takes is one email from a trusted friend or a familiar company, complete with logo and well-designed customer letter, plus a moment’s lack of the usual caution and this could happen to you. The lessons are:

  • Always pause before opening a link, regardless of who it is from, and make sure it is legitimate. Hackers have ways of accessing your contacts and companies you deal with.
  • Back up to an external hard drive regularly, but make frequent checks and hardware upgrades.
  • Store additional copies in the ‘cloud’.
  • Activate the programme which stores shadow copies.
  • Email important documents to yourself. From my experience, this is a robust solution, and if anyone thinks it is not, let me know.

Repeating, I am not a technical expert on this subject, and I welcome comments from people who know a lot more than I do. Including the best ways to back up (no product flogs, please).

Comment by Tony Cuffe who works in technical support

This type of invasive software is, unfortunately, becoming more and more common. It opens up a lot of discussion as to how to avoid it in the future. Backing up properly is a form of risk management.

For Mac users I suggest that an Apple Time Machine is installed as well as using a programme such as Carbon Copy to do remote backups of valuable files such as photos and documents on a regular basis to remote drives. These can be setup to run automatically in the background.

For Windows users this is not so simple. There are a range of different solutions from different suppliers. One that seems pretty good is from Acronis. They do both automatic updates to local remote drives and also the cloud.

Speaking of cloud, we are now primarily using Google Drive along with the full suite of Google apps for work applications. This means that all files are being kept in the cloud and are not touchable with programmes like CryptoLocker. We are currently retiring our laptops and replacing with them with Chromebooks. The only thing needed is an internet connection via wi-fi and you have everything available.

Finally, as for email, using a hosted cloud service such as Apple iCloud or Google Gmail is the only way to go as you can easily re-download your email to any device whether it be Windows, Apple or Linux. I use both for different email addresses but my first choice is now Gmail and particularly Gmail for business so you can set up your own domain name for your email address.

 

Graham Hand is Editor of Cuffelinks. This article is a general warning and does not consider the personal circumstances of any readers, nor is it intended as a definitive solution to protecting data and files.

 

15 Comments
David
August 01, 2015

Graham, I am curious to understand why it was so difficult for you to restore from Dropbox?

All the expert advice seeems to suggest using cloud based backups (which Dropbox is), yet in your case it was so difficult to recover from Dropbox it was easier to restore in a very manual and piecemeal manner from multiple other sources?

Graham Hand
August 01, 2015

Hi David, there are a few parts to my answer. I was surprised the Dropbox files were also encrypted, not only those on my own computer. When I exchanged emails with Dropbox, they asked me to nominate the date of the virus attack, and they could provide a restored copy up to that point. Which I did, but the restored version did not appear in my Dropbox. I tried a couple of times more, and not being the most patient or tech-savvy person in the world, I simply gave up and restored from other places. As I say in the article, I don't blame Dropbox and I also expect anyone who knows more about it would have found a back up. I decided what I really needed and moved on. In fact, I first 'nuked' my entire machine, removing everything before restoring the programmes and files. It was a surprisingly cleansing experience to start again with a fresh computer. Cheers, Graham

Sam
July 29, 2015

One of our staff opened up an email purporting to be from the Road Authority regarding a fine. The same email was blocked on my machine by BitDefender, though it was not running on the infected machine - it was running Windows defender.

I removed the machine from the network and found that only the local desktop files were encrypted. Everything else was on Dropbox, unscathed. As a (probably overkill) solution I removed the hard drive from the machine and have had it shredded, and installed a new machine with BitDefender.

I have since added a NAS (Network attached storage) device to the network, and all files are copied to that. For backup I have added another NAS to the network, that no one can map a drive to, and it is solely used to backup the first NAS. It backs up every night, every file, a little like time machine for those that are familiar with Apple.

This overcomes the problem with a usually competent and astute user of a PC getting infected by a well timed scam in that moment when for whatever the reason the user opens the email or link.

It took a little bit of setup time, though the NAS systems are available off the shelf, and all your data does not have to end up in Google or Dropbox. Your own private cloud if you like.

Ian Burgess
July 27, 2015

Everyone should consider subscribing to the free service provided by the Australian Government Dept of Communications.

www.communications.gov.au/what-we-do/internet/stay-smart-online

Select just the topics that seem relevant to get timely warnings.
Yes, Cryptolocker was a recent one.

Hard Drives?
Yes they may fail, but having two and only connect them alternately at backup time (so they are not attacked) and you should be safe.

john
July 27, 2015

Yes, I have received emails purported to be from such as AMEX the day after face to face confidential discussions with ANZ. The emails were not from ANZ or AMEX acc to these companies and all they said was to ignore them. As I never receive these sorts of emails otherwise; it cannot put it down to coincidence; also this situation has occurred before. Something is happening between some of the banks and whoever creates these spurious emails that are trying to persuade actions by such as myself. ANZ basically ignored my requests to investigate!!

Graham Hand
July 26, 2015

Fake Telstra bills sent to thousands of their customers:

http://www.dailymail.co.uk/news/article-3174036/How-spot-fake-Telstra-bills-fool-Customers-country-hit-online-scam-cost-hundreds-dollars.html

Geoff Walker
July 24, 2015

In the instant before I click my mouse on any link, whether it be in an email or a webpage, the hovering of the cursor over the link brings up the "real" link in the status bar at the bottom of the email or webpage browser window. It's then very obvious whether or not the link is from whom it purports to be.

Make certain you have your status bar displayed! In Safari, the "show/hide status bar" toggle is in the View menu.

Paul Salmon
July 24, 2015

Acronis was my choice several years ago, until Acronis failed to restore backups. I've since changed to Cobian which does not need the program to be present to read the backup material.

Mark
July 24, 2015

great article-my friend runs his own biz and had it happen to him. So I have an external backup and use it - not as frequently as I should and have restore thing going.

Chris
July 24, 2015

Just read your article on the ransomware. Definitely got me thinking about my backup strategy. My photos would be the most important things!!

Peter Richards
July 24, 2015

I also had the joy of being infected with Cryptoblocker. I use Dropbox to back up all files and thankfully had all files reinstated by them without any problem. I have a business version so maybe that is why all files were there?. Still lost half a day as Dropbox is based in the US and also for the IT consultant to clean all traces of cryptoblocker from hard-drive.

Graeme
July 24, 2015

You've been robbed, blackmailed and told to use non-legal tender (surely no authority in their right mind would have approved Bitcoins). And because it's the internet no-one will be able to do a thing about it. And Telstra wonder why so many people still want their phone bill sent through the post!

Graeme
July 24, 2015

Breaking news.

Talk about timely information. Just now I have received a scam email supposedly from Austalia Post about them holding a package that could not be delivered to me, with a link to obtain more information. The grammar is so bad that I wouldn't have clicked anyway.

What is also interesting is that I am waiting arrival of an ebay ordered item from oversees. This is a rare event for me, so I'm sure it is related. Seems information is not that secure.

One thing I've found useful if I suspect a scam is to Google part of the message. Invariably something will come up, in this case a Courier Mail article.

Leslie Goldmann
July 24, 2015

It's fairly extraordinary, it does makes you wonder if they knew that you were sending lots of emails to Telstra or just lucky timing on their part. And now that it's happened again even more of a worry. I suspect pretty much nothing connected to the internet is actually safe to anyone really in the know - no matter what the supposed level of encryption.

Could be a good investment trend - internet security companies?!

Thanks again for the timely warning, sounds like paying a small monthly subscription to Dropbox may be very cheap insurance.

Leslie Goldmann
July 24, 2015

Thanks Graham for a cautionary tale I thought my files were safe with dropbox but sounds like I am not covered for this sort of thing. It really would be nightmare to lose all my data like that.

 

Leave a Comment:

     
banner

Most viewed in recent weeks

How to enjoy your retirement

Amid thousands of comments, tips include developing interests to keep occupied, planning in advance to have enough money, staying connected with friends and communities ... should you defer retirement or just do it?

Results from our retirement experiences survey

Retirement is a good experience if you plan for it and manage your time, but freedom from money worries is key. Many retirees enjoy managing their money but SMSFs are not for everyone. Each retirement is different.

A tonic for turbulent times: my nine tips for investing

Investing is often portrayed as unapproachably complex. Can it be distilled into nine tips? An economist with 35 years of experience through numerous market cycles and events has given it a shot.

Rival standard for savings and incomes in retirement

A new standard argues the majority of Australians will never achieve the ASFA 'comfortable' level of retirement savings and it amounts to 'fearmongering' by vested interests. If comfortable is aspirational, so be it.

Dalio v Marks is common sense v uncommon sense

Billionaire fund manager standoff: Ray Dalio thinks investing is common sense and markets are simple, while Howard Marks says complex and convoluted 'second-level' thinking is needed for superior returns.

Fear is good if you are not part of the herd

If you feel fear when the market loses its head, you become part of the herd. Develop habits to embrace the fear. Identify the cause, decide if you need to take action and own the result without looking back. 

Latest Updates

Economy

The paradox of investment cycles

Now we're captivated by inflation and higher rates but only a year ago, investors were certain of the supremacy of US companies, the benign nature of inflation and the remoteness of tighter monetary policy.

Shares

Reporting Season will show cost control and pricing power

Companies have been slow to update guidance and we have yet to see the impact of inflation expectations in earnings and outlooks. Companies need to insulate costs from inflation while enjoying an uptick in revenue.

Shares

The early signals for August company earnings

Weaker share prices may have already discounted some bad news, but cost inflation is creating wide divergences inside and across sectors. Early results show some companies are strong enough to resist sector falls.

Property

The compelling 20-year flight of SYD into private hands

In 2002, the share price of the company that became Sydney Airport (SYD) hit 80 cents from the $2 IPO price. After 20 years of astute investment driving revenue increases, it sold to private hands for $8.75 in 2022.

Investment strategies

Ethical investing responding to some short-term challenges

There are significant differences in the sector weightings of an ethical fund versus an index, and while this has caused some short-term headwinds recently, the tailwinds are expected to blow over the long term.

Investment strategies

If you are new to investing, avoid these 10 common mistakes

Many new investors make common mistakes while learning about markets. Losses are inevitable. Newbies should read more and develop a long-term focus while avoiding big mistakes and not aiming to be brilliant.

Investment strategies

RMBS today: rising rate-linked income with capital preservation

Lenders use Residential Mortgage-Backed Securities to finance mortgages and RMBS are available to retail investors through fund structures. They come with many layers of protection beyond movements in house prices. 

Sponsors

Alliances

© 2022 Morningstar, Inc. All rights reserved.

Disclaimer
The data, research and opinions provided here are for information purposes; are not an offer to buy or sell a security; and are not warranted to be correct, complete or accurate. Morningstar, its affiliates, and third-party content providers are not responsible for any investment decisions, damages or losses resulting from, or related to, the data and analyses or their use. Any general advice or ‘regulated financial advice’ under New Zealand law has been prepared by Morningstar Australasia Pty Ltd (ABN: 95 090 665 544, AFSL: 240892) and/or Morningstar Research Ltd, subsidiaries of Morningstar, Inc, without reference to your objectives, financial situation or needs. For more information refer to our Financial Services Guide (AU) and Financial Advice Provider Disclosure Statement (NZ). You should consider the advice in light of these matters and if applicable, the relevant Product Disclosure Statement before making any decision to invest. Past performance does not necessarily indicate a financial product’s future performance. To obtain advice tailored to your situation, contact a professional financial adviser. Articles are current as at date of publication.
This website contains information and opinions provided by third parties. Inclusion of this information does not necessarily represent Morningstar’s positions, strategies or opinions and should not be considered an endorsement by Morningstar.