Is there now an increased risk of ransomware in pirated software?

Question

Ransomware is on the rise, much due to new ransom-paying opportunities via Bitcoin.

Has there been a reported increased risk of ransomware in pirated software (i.e. so called “warez”) – outside of the so called “scene” verified releases – in public BitTorrent trackers and P2P?

Ransomware adds new dimension of monetization for the malware-maker. As compared to previous infection motives (like adding the infected computer to a botnet, scraping personal data, or just deleting your stuff for fun), does this new opportunity for monetization increase the likelihood of pirated software hurting infected users to a higher degree?

It is my understanding that most ransomware implementations usually builds on a few “ransomwares” such as CryptoLocker, KeRanger and others. Since ransomware implementations then are built on the same foundations, are they identifiable by standard antivirus suites usually used by average users – or are the implementations modified in such a way that they pass detection?

In short, bottom-line: Is it advisable for the average user to avoid pirated software, even if they use antivirus protection, due to these new circumstances? This is of course notwithstanding the legal and ethical implications of using pirated software.

Answer 1

Ransomware is a critical threat to users and company data these days. According to what I have encountered in corporate environments, usually antivirus software hasn't been able to detect the latest Ransomware versions (I have used specific tools).

As you have pointed out, it is important to understand that paying the ransom will continue supporting this activity (and it is not a guaranty of having your files decrypted).

I haven't found a correlation between pirated software and increase in ransomware risk. As far as I have seen, the primary distribution vector is email (with infected attachment) or a link pointing to a file (also infected). But, of course, it is not crazy to think that it might be used in the future, as several types of malware are distributed via pirated software.

As far as I understand, the most important countermeasure that you can implement is to have a solid backup schema (and regularly test the recover process).

In order to avoid propagation, I have:

• Removed unnecessary mapped units over the network (and have replaced some with shortcuts).
• Perform an audit over the file permissions in file server to ensure that everyone is allowed to access what they need and nothing else (Principle of least privilege)1
• Block binaries running from %APPDATA% and %TEMP% paths. Most of the ransomware files are dropped and executed from these locations, so blocking execution would prevent the ransomware from running.

As a final recommendation, it is important to stay up to date with O.S., and browsers, and avoid using pirated and uncontrolled software.

Answer 2

Most of the large scale campaigns with ransomware were delivered either by email or malwaretising, but that shouldn't give you false sense of security. The amount of pirated software that contains malware, trojans (Including things like Trj.LockyDownloader - most detected trojan lately, downloads Locky Ransomware), backdoor or other intentional or not intentional problems is still quite high (But its not 100%, as people get frightened by, its probably not even 60%).

Another problem appears with the fact that user usually unreasonably trusts pirated software, allows it to get through UAC, sometimes even antivirus leaving less obstacles to the malware creators.

Its always advisable to use original software, there are very few occasions of when pirated would be better then original.

Answer 3

It is always advised to avoid pirated software. For this answer I leave the law for what it is and talk about the security risks.

For example in april 2016 The pirate bay did spread an huge amount of ransomware to victims who visited the site through ads. This is not a case for the software itself but it is a case for the main source.

Allrigt now the software itself: Lets say you did not get a virus while you did visit the torrentsite and did happily download Fallout 4. Ofcourse you are eager to install your freshly downloaded game. But do you actually know what you downloaded? It says it is Fallout 4 but maybe it is a virus or worse ransomware. You could prevent this by just buying the game.

Most antivirus softwares make a database for known cases of mallware but while the antivirus software engineers are getting smarter the virus authors are also getting smarter in preventing to be caught. And this won't stop anytime soon.

So to sum this up: Be safe and buy the software or face the risks what come with downloading pirated software.