Crypto Ransomware's Amateur Mistakes: A Cybercriminal Scheme Gone Wrong

The article discusses the mistakes made by Crypto Ransomware attackers, which led to their failure in capturing large corporate houses and generating significant profit. The first mistake was using an old Windows hacking technique, which had limited scope and profit. The second mistake was building a web-based 'kill-switch' that cut short its spread. Additionally, the ransomware's shoddy handling of bitcoin payments made it easy for security analysts to track their group's profits and even recovered the key through various methods, including using passwords and USB flash drives.

Running Head: Cyber Crime
Cyber crime
[Document subtitle]

Cyber Crime 1
Table of Contents
Introduction......................................................................................................................................1
Part A...............................................................................................................................................1
How Ransomware Malware attack can happen to network attached backup system..................1
Methods used by Ransomware Malware for the attack...............................................................2
Part B...............................................................................................................................................4
Part C...............................................................................................................................................6
Part D...............................................................................................................................................8
Conclusion.....................................................................................................................................10
References......................................................................................................................................11

Cyber Crime 2
Introduction
In this paper, we are studied about the Ransomware Malware. Generally, it is said that the
Ransomware is a computer malware in which rogue software code effectively holds a user’s
computer hostage until a “ransom” fee is paid. The scenario that has been selected to discuss the
Ransomware Malware is encryption of the network attached backup system. This paper is
focused on different elements of the Ransomware Malware. For example, it defines how the
Ransomware attack happens in IT or other companies. It is defined one or more methods used
for the attack. On the other hand, the laws that are broken by crypto Ransomware also discussed
to aware the target audience about effects of illegal attacks of malware. Therefore, with the help
of this knowledge, the target audience can learn a lot of knowledge about different aspects of
Ransomware malware and pay a significant contribution towards the management of their IT
networks. The Ransomware malware has enough potential to influence the stored data and other
backup systems in a negative manner. The knowledge of Ransomware malware will help them in
their career because they can apply their practical knowledge to save systems from any
unrecognized attack.
Part A
How Ransomware Malware attack can happen to network attached backup system
Duggan (2017) Ransomware Malware influences the existing network-attached backup system
of different IT organizations in a significant manner. The cyber extortionists know that backups
are their most important enemy in fulfilling their desired objectives and are adapting their
Ransomware to look for them. So, the priority focus of Ransomware malware is towards
encryption of the backup files. It is done with the purpose of preventing different clients from

Cyber Crime 3
accessing their backup data and saving themselves from fine. The first and foremost step of
Ransomware Malware is to destroy Shadow copy and restore point data on Windows Systems.
This performed by the different Ransomware families who are operating the malware the special
motive to gain significant monetary profit. After planning of an attack on Shadow copy and
restore point data, it targets all attached drives and happens to encrypt the backups as well,
though not likely by design. The presence of Ransomware Malware encrypts each files system
that is attached to an infected machine. This situation might prove vulnerable for a client. Apart
from this, the presence of Ransomware Malware also influenced the external hard drives and
plugged-in USB sticks (Collier, 2017). Therefore, it is right to say that the Ransomware Malware
comes in different forms and influence the network attached backup system in a significant
manner. There are a lot of business houses who becomes failure to test their backups properly.
The main reason behind the attack of Ransomware Malware is that most of the business firms
and other small level clients did not have a recent test of their recovery process. They are
engaged in doing backups, but they do not have any information about how they can recover it.
So, it becomes essential for the business firms to have knowledge about network attached backup
system and prevent Ransomware Malware attack significantly.
Methods used by Ransomware Malware for the attack
Ransomware used a large number of methods to attack personal information of an organization.
Some of the popular and common methods used by Ransomware for attack purpose includes
following:
Exploit Kits
The first and foremost method used by Ransomware for the attack is exploiting kit. This method
is a combination of different sophisticated and important tools that exploit vulnerabilities. The

Cyber Crime 4
exploit kit works when an individual or victim visits a compromised website. The website
becomes the foremost factor of attack within the business organizations (Golany, 2017). It is
because these compromised websites are the combination of different hidden malicious codes.
These hidden malicious codes exploit kit landing page unnoticed. If vulnerable, a drive-by
download of a malicious payload will be executed, the system will become infected, and the files
will be held for Ransom. This method is quite popular among cyber extortionists.
Malicious Email Attachments
The second and foremost method used here is malicious email attachments. According to this
method, the cyber extortionists of Ransomware craft an email with malicious attachments. This
is performed by Ransomware through some believable sources like Information technology and
human resources. Ransomware attaches the malicious file like portable executable or a .JS file.
As and when the mail receiver opens the attachment thinking, he or she will become the victim
of Ransomware Malware attack (Geyer, 2016). This occurs in most of the cases because the
receivers think that the file has received from the trusted sources.
Malicious Email Links
The last and final method used by cyber extortionists of Ransomware is malicious email links.
This is one of the important attack methods among others. As the malicious email attachments,
malicious links are in the body of the mail. These malicious links remain in the form of URL.
Similar to malicious email attachments, these are also sent by cyber extortionists through trusted
sources. Therefore, when the receiver opens the file or attached link, he or she becomes the
victim of malicious email link attack. When the receiver clicks on these URLs, they download

Cyber Crime 5
malicious files over the web (Hamadène, 2015). This process infected the overall working
scenario of a particular system.
Therefore, it is right to say that Ransomware Malware attack comes in different form. Each form
comes with different negative influences that affect the information system working scenario of
an organization.
Part B
Tucker (2016) defined the Zero Sum game as a game theory in which an individual's gain is
equivalent to another loss, so the net change in benefit and wealth is zero. On the other hand, (0
defined the Nash Equilibrium as an important logical and mathematical action that participants
of a game should take to secure the best outcomes for themselves. In a similar manner, the
Malicious Email attachment attack method is also linked with both zero-sum game theory and
Nash Equilibrium. According to the zero-sum theory, the Ransomware Malware want to
influence the legitimate user through encryption of the data. On the other hand, the legitimate
user wants to secure its data by using different protection means. Both parties are associated and
bound with the Zero-sum game theory. The zero-sum game theory also depicts that there will be
a situation where both parties the legitimate user and attacker will be a no gain and no loss
situation. It means that the legitimate user will put efforts to protect his system from
unauthorized mail and attacker take initiatives to encrypt the data to satisfy personal profits. The
Malicious Email; Attachment method also offers both profit and loss to each concerned player
here. For example, it will give a chance to the attacker to encrypt the system and data of others
through sending a link from authorized and trusted server (Lou, 2016). On the other side, the
legitimate user will try to secure its data and system by installation of different firewalls and

Cyber Crime 6
blocking system of unrecognized emails. At the same time, both players are fighting for a
common motive. The legitimate users want to protect their data. On the other side, the attacker
wants to steal personal data and corrupt the whole system. Therefore, a significant bonding and
relationship can identify the situations of both players.
Balandat (2016) said that the Nash equilibrium is a right method to resolve the zero-sum game
situation among different players. The above-mentioned situation can also resolve through the
Nash Equilibrium. It is the Nash Equilibrium which facilitates prediction of the strategic
interaction outcomes in the network security. The Nash equilibrium facilitates the effective use
of malicious email attachments for both players. This is performed with the help of three
different elements. These elements are a set of sections, a set of players, and a payoff function
for each player. It brings coordination between both players and solves the situation very
effectively. For example, in the above-mentioned case, there are two different players. The first
player is a legitimate user, and another is attacker. If both of the players choose same actions, it
will call coordination. If the players select the different actions, they each get a payoff of 0. If
they both choose one particular option, they each get 2, and if they both agree with another
option, they each get 1 (Hamadène, 2015). The coordination among both players can effectively
define with the coordination example. For example, if a player whether it is attacker or legitimate
user chooses a row, the next player will automatically go with a column, and the resulting
payoffs are listed in parentheses. Therefore, it is right to say that the zero-sum game situation of
both players can resolve with the Nash Equilibrium. This will solve the problem through
spreading coordination and bring work balance between the working scenario of each player.
Moreover, it can also be said that the Malicious Email attachment attack method has enough
potential of influencing the behavior and working method of each player. Therefore, it becomes

Cyber Crime 7
the responsibility of both to focus on the resolution of the zero-sum game situation and turns it
into a profitable situation.
Part C
Crypto Ransomware affects a large number of laws associated with the chosen scenario of
network attached backup system. It has broken the data security legislation developed by the UK
government. These legislations are following:
Data Protection Act
The first and foremost law broken by the Crypto Ransomware is Data protection act, 1998. It is a
UK information security act that regulates the use of personal and official data by different
business houses. Personal data is referred to information regarding the personal lifestyle, and
identify (Lloyd, 2017). On the other hand, the official information is about the office financial
records and other systems. Crypto Ransomware is completely broken the Data Protection Act by
adopting illegal practices. It is because Crypto Ransomware hacks the personal and official data
for the sake of their own benefit. The Data Protection Act states that personal and official data
shall be obtained only for one or more lawful and specified purposes (Lou, 2016). But, the
Crypto Ransomware did not do so and use the data to gain sufficient profit and influence
business performance of other organizations.
Freedom of Information Act 2000
The second and important law broken by the Crypto Ransomware is Freedom of Information
Act, 2000. This act states that each individual can access to necessary and required information
held by a university or other institution, subject to a number of exemptions. Therefore, in order
to collect the required information they should file an application in writing to the concerned

Cyber Crime 8
department. But Crypto Ransomware did not do the same and stole the information without any
prior permission. Therefore, the Freedom of Information Act 2000 gives an individual right to
sue the hackers and file a complaint against them (Liska, 2016). The Crypto Ransomware did not
care about the data and privacy of business houses for its profit. Therefore, he continuously
proceeds further through adopting illegal means. So, Crypto Ransomware management team is
responsible for getting punishment as per the Computer Misuse Act.
Privacy and Electronic Communications Regulations 2003
The third law broker by the Crypto Ransomware is “Privacy and Electronic Communications
Regulations 2003 (Lloyd, 2017).” The Crypto Ransomware does this by attempting following
illegal activities:
 Unauthorized access to computer material of different professionals and organizations.
 Unauthorized access with a wish to facilitate and commit commission of further offenses.
Due to the use of the above-mentioned illegal practices, Crypto Ransomware is considered
highly responsible for broken of Privacy and Electronic communication regulations Act 2003.
According to this act, it becomes mandatory for the business houses and different working
professionals to permits individual to control the direct marketing information which they
receive from the different external sources (Newman, 2017). But Crypto Ransomware turns them
into failure through unauthorized access to received information. This performed by the Crypto
Ransomware to enhance the size of its profit through illegal activities.
Human Right Act 1998
The next and important law which Crypto Ransomware has broken is “Human Right Act 1998.”
This is the act which is related to information privacy of an individual. It is one of the most

Cyber Crime 9
important and relevant information security legislation of UK. According to this law, it is the
responsibility of each business firm and individual to respect for an individual’s and organization
private and official information. The Crypto Ransomware uses this activity in a negative context.
Instead of giving the respect to personal and official information of individual and business
organizations, it stole their information and used them for personal benefit (Kharraz, 2015). This
thing performed by Crypto Ransomware is completely wrong and unethical.
So, it is right to say that the Crypto Ransomware acts are totally illegal and wrong. It is because
the Crypto Ransomware had broken a large number of Information security laws that are a core
pillar of whole information technology industry of UK.
Part D
The Crypto Ransomware attach has become the worst digital disaster to strike the internet in
years. There are a lot of mistakes that had done by Crypto Ransomware in its past. These
mistakes are very common, and a security analyst can easily analyze them to generate a
recovered key (Sittig, 2016). These mistakes can understand by following:
For example; Crippling Transportation and Hospitals globally is one of the major mistake done
by the Crypto Ransomware in past decade. When the security analysts identify the reasons
behind this act, they got information that this is not an act of a hacker mastermind. Instead,
security analysts identify in the recent meltdown a sloppy cybercriminal scheme, one that
discloses it an amateur mistake at practically every turn (Chong, 2017). Due to this mistake, the
cybersecurity community has faced a lot of errors that are occurred by Crypto Ransomware. On
the other hand, they also made the second mistake through the use of Windows hacking
technique. It is an old hacking technique and adopted by the Crypto Ransomware to infect more

Cyber Crime 10
than 200,000 systems across 200 different countries. Most of the security analysts conclude it as
a poor choice of the crypto Ransomware attackers. It is because the Windows hacking technique
has limited scope and profit.
Apart from this, one more error performed by the Ransomware is building in a web-based "Kill-
switch" that cut short its spread, unsavvy handling of bitcoin payments (Brewer, 2016). It is a
poor hacking technique which makes it easy for the security analysts to track their group's profit
and even a shoddy ransom function in the malware itself. All these mistakes make them failure
in capturing the large size of corporate houses and generate significant profit out of it. At that
time, the security analysts recovered the key through a large number of methods. The first
method they have attempted to recover the security key is the use of a password. The password is
only a method to the password for a key that unlocks the data on the driver. The password key
unlocked the drive and generated available data. The recovery password that has been used by
the different security analysts is consists of 78 digits which are divided into eight groups. This
password is further entered by the security analysts to recover the necessary data which is
blocked by the Crypto Ransomware. Apart from this, most of the security analysts also utilized
another method to generate a key of Crypto Ransomware attack (Ab Rahman, 2015). They used
a USB flash drive which has potential to broke different locks and recover console. During
recovery, they inserted the USB flash drive within the system and recovered the data
successfully. Therefore, it can be said that the above-mentioned Crypto Ransomware keys have
enough potential to help security analysts in recovering the hacked data.

Cyber Crime 11
Conclusion
After studying all this, it can be concluded that the Crypto Ransomware was a worst digital
experience for the security analysts and business firms. It did not only influence their personal
data systems but also locked the necessary and required information for day to day functions.
Moreover, the Ransomware situation is like the zero-sum game where both of the players
influenced in a similar manner. Therefore, it can be said that the Ransomware had broken
information security laws and became responsible for legal punishment. On the other hand,
Crypto Ransomware had also performed some mistakes that become the foremost failure factor
for it. These mistakes influenced their overall profitability and objectives. So, it becomes
mandatory for the organizations to take proper security measures to avoid Ransomware and any
type of hacking attack.

Cyber Crime 12
References
Ab Rahman, N. H., & Choo, K. K. R. (2015). A survey of information security incident handling
in the cloud. Computers & Security, 49, 45-69.
Brewer, R. (2016). Ransomware attacks: detection, prevention and cure. Network
Security, 2016(9), 5-9.
Balandat, M., Krichene, W., Tomlin, C., & Bayen, A. (2016). Minimizing regret on reflexive
Banach spaces and Nash equilibria in continuous zero-sum games. In Advances in Neural
Information Processing Systems (pp. 154-162).
Chong, H. (2017). SeCBD: The Application Idea from Study Evaluation of Ransomware Attack
Method in Big Data Architecture. Procedia Computer Science, 116, 358-364.
Duggan, M. (2017). The Legal Corner (TLC): Ransomware Attacks Against Health Care
IT. Journal of Informatics Nursing, 2(4), 30-31.
Collier, R. (2017). NHS ransomware attack spreads worldwide.
Golany, B., Goldberg, N., & Rothblum, U. G. (2017). A two-resource allocation algorithm with
an application to large-scale zero-sum defensive games. Computers & Operations Research, 78,
218-229.
Geyer, F. (2016). Security versus justice?: police and judicial cooperation in the European
Union. Routledge.

Cyber Crime 13
Hamadène, S., & Mu, R. (2015). Existence of Nash equilibrium points for Markovian non-zero-
sum stochastic differential games with unbounded coefficients. Stochastics An International
Journal of Probability and Stochastic Processes, 87(1), 85-111.
Kharraz, A., Robertson, W., Balzarotti, D., Bilge, L., & Kirda, E. (2015, July). Cutting the
gordian knot: A look under the hood of ransomware attacks. In International Conference on
Detection of Intrusions and Malware, and Vulnerability Assessment (pp. 3-24). Springer, Cham.
Lloyd, I. (2017). Information technology law. Oxford University Press.
Liska, A., & Gallo, T. (2016). Ransomware: Defending against digital extortion.
Newman, L. H. (2017). How an accidental ‘Kill Switch’slowed Friday's massive ransomware
attack’. Wired. com, 13.
Lou, Y., Hong, Y., Xie, L., Shi, G., & Johansson, K. H. (2016). Nash equilibrium computation in
subnetwork zero-sum games with switching communications. IEEE Transactions on Automatic
Control, 61(10), 2920-2935.
Smith, M. (2016). Ransomware attack forces Michigan utility to shut dow n systems, phone
lines, email. Network World.
Sittig, D. F., & Singh, H. (2016). A socio-technical approach to preventing, mitigating, and
recovering from ransomware attacks. Applied clinical informatics, 7(2), 624.
Tucker, A. W., & Luce, R. D. (Eds.). (2016). Contributions to the Theory of Games (AM-
40) (Vol. 4). Princeton University Press.